38658ac74d5516bb56c20c604b95306dab9fc707c5662501225a8a6c18e3d7b8

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_insulin_local.html
Size

1KB
MD5

bd79c33de563833c2964df05bf71082f
SHA1

5de4fb1397af8410b28696572cb0e7260d266003
SHA256

a5e73c51212b21c1046a77882673f0c2cce8c5851f78ea6dd4924ca7d1ee566f
SHA512

5b3e3be332146401133d43574021c7cd28b52fe6660f5b6877b6db449c0ec208fc7ad3d4661ed4c88f63ee28dd8d8dbd2415bca40c62eb5ee18fa40040a077a6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15CD1631-3561-11EE-A427-4E44D8A05677} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ae92ea6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000a240d9900621a6a85a9c5290f6e7bfc7f4f212fe7a7a80cd8e7bc613cde02c0e000000000e8000000002000020000000e2ea4d6775f33f81c686e1bd7df2afeace554f629e8c97b40e40c79d815706b6200000004b08c8ea36cbc9b667cebb2463932db10c84b6962dcfbd70f34fbb960575059740000000926c0692aeab4e1a6e9d3f68122554929515e136099949e7dfa81b8eaf1e264aad40b344c96db0541e53c4420ea0eb63047100903dddd9616b68c1340fae8c57	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000b7c7b4db664c932a4e27486e49a76217197e4c35864693f7d62dcc6a89e94fe4000000000e80000000020000200000004d55eaa6c2b56570cb8f7c186ef4607969b701d86b3abe4e78b55e960055635690000000732949f365331e89fc9fed1733359f4bcddd091439f128194210740c36033dca81847949300b10da2e2304a7d05cfe8bc30655aa5447a18ba62fcf204b1c8ad08a0b2de8e4ccbb24d00506dbf20ec35e1ee145fe9f5cc7beed6f7d93838d8f6f8af02efd94b157cf8e0029868b159bade882952baebe65fb7b7664113318534356ef85f97e068252ce5394a1ebbbce1f40000000e3d39a17be9c0dfb0d02984ca0dcd9a9e9077e41d24a35bc2acdf167ddffc94bc622ea149c97602b8d51aa08248569853b48ba40914c909534f112ee891f5d63	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2468 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2468 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2468 iexplore.exe
2468 iexplore.exe
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE

pid	process
2468	iexplore.exe

pid	process
2468	iexplore.exe

pid	process
2468	iexplore.exe
2468	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2468 wrote to memory of 3020	2468	iexplore.exe	IEXPLORE.EXE
PID 2468 wrote to memory of 3020	2468	iexplore.exe	IEXPLORE.EXE
PID 2468 wrote to memory of 3020	2468	iexplore.exe	IEXPLORE.EXE
PID 2468 wrote to memory of 3020	2468	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_insulin_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dfccf225b4ba9e8489ad74c0538f6dbd

SHA1
b3c497ab49d49fff73a0c22a59e0ed06353e733f

SHA256
c585764cdcb3848bf5280c70abdbab2f4fc099a2e5e226cdda67a45f032dda5c

SHA512
013ad7c89f88489fdbbfa285a2162c1d95a59f9533ff696c049b9f9187d9f6367c5fdee7ac80e126e1b8a3d66db791a781e8da7d815eba8f814de3b39e422f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa57de50f3121104464f6001e614fcb

SHA1
5c524c82a3ce1ce225fec06bf2f376e89fc35ed4

SHA256
7e2e18a5b75b8fd9efd5cee86f30862042aee95e25c547a455f97caef51d42ab

SHA512
7c64ccafd2981c1d6ff5829d8bd0781e4b5eabe1cdc796a8ec3baeebdb87e868fa3768434cffdcbbb648fffa4298f47fb01e0d90acd2a906a000e385fa74c7c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8195e226ce72b13371a76c53d5896ca6

SHA1
2b745e20ab8c6ac9a13a5ad5a7bad803ad04667d

SHA256
588f3743bff598e4dfdf1cc96ef7e3b874c5d39ba812937fd123a0f06ff1d675

SHA512
baa73cc309a18204dec19a58aca5ae36b02e004c161783efbc6f883cd2e295852c3f17d71f88183f2204dc14da2e813f3312fb2490eefcbd40b1ebfb6883adb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2cea3e9152661baccf590228ad5ba50

SHA1
6d8d7ea134628c733f7412ffb165239a719fdc32

SHA256
f316cdbab4a4c1ccc8034d311bcb8060304fd6bde731067df401f9030e4aab00

SHA512
4c884071c8cbd1f782285d3f34fa4271588905b5d1f97bc6ccf65fc8148f472a3b45d937c2993bca607e58eaeeaf2433da1d8be1ac268aa92ba3557541a8b244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e1be4ed7b3d9b86aba57b4b5e33ea7

SHA1
9e157c9d7a16abb298e0d17b3f6657c1eca765e1

SHA256
884d3c6822e0f9584873eed14a7864357bb353d6dbbebcd260f5c824c8fe4cbd

SHA512
7ee43c90f3b1687363fe0e74179eb6b8e61ede8742e22a193994dcfec96b0e342628a0941b68a0965a319071577f3e70f4376c30f5c3fb94a8eb9b31b4086504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0b6ea827b08704399dbc8d17de82c52

SHA1
555f700bb2870c8c854e7922e6ba0211d70411c8

SHA256
2d37fd37e77ffce060b0564049e4a99d9bc0e2411756239d6cdd01ac36f7bc57

SHA512
cd12e07e576d0aa26c1f3c9999f7c4dc7d7c5c749fd212f470fd992ffc6434006fbc484b3070d5dbd11a43b23c7065934b787158c481b5f8477192c0954b52c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ddc7a063d5b85e0450df169a80efde

SHA1
9c8b1603d52d1bcfc21a54bb30530503b74d6400

SHA256
2992a48a1d8007942a540651fdb339a7b6c7f80090bdccc79d2722faca17b465

SHA512
5604dc2df97587df3e15440a2efa0586a581d30059f942f12289601c8231ca45d96ddf5e71ff9981618767b7cdac8479f44343976d2b594ca9cf11f9c636be01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b9b0f16357a83cb1cf45b89a3b9d34

SHA1
b0e8fc64267de26534cd3289a79bc425df3228f7

SHA256
0ba1250107a44664ca6a18c5a12152d2544e1343896cb0489f9098833ac71b9e

SHA512
ab2a5b4c0b53719025a929225340d791524075cd0c995bddbebf4e26b9021cfe6912787a7e7ec937046ba6244160ce849168be55dac4bf24e959f7dd1736a7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf240bd3d6c13d0e3f1d3e28efacb26

SHA1
4da739d0a71825fdf87929c2950a7fd0ab46c99e

SHA256
6f23e0c3bc787e258604fee6ecf663d32cf690005a5c8079f12d183fdd64ea3d

SHA512
6a572cb0cc7c739520e24ff90d42cbebc112bb388ddb295326cff5e42e0c7eb36d0bdca1604419732d668f9abfd07d3d33ac46ad32fd9d3e459b34f35832b048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efccead28f2f07413cd14f898f7f543

SHA1
60364415287db439f35c25f0ad36d1ec922d963c

SHA256
360562abcc08452224fa2e9e1488cb4c64cbf155158bb10d411e293d62030d69

SHA512
d5127f71394b6c8d81b188f8a2a502cc4c1b5b670e90bc9a0fdb6362c06d696f4faa90aebfce326de2a86cdfc358ae0ed52ffa193889d9ddbf9b794288836d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecdb0653cbb92eb29c7bd8fd5f77a926

SHA1
48ab7c7df3c342d674f4ceb87a9aea117f829cd2

SHA256
c9a0c8b5329288478cb41171b2cc700b6843bcd07a6e6d5974ae774ab7aabe59

SHA512
e259b9ada6616c5bfac45306ccc88703975219382aca355aefc9d79971ca2f1ceb4bf2a21eb47c824837a03df8325d57d6da44510f82445fd71997cab6acc871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8846.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88B6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit