38658ac74d5516bb56c20c604b95306dab9fc707c5662501225a8a6c18e3d7b8

Analysis

max time kernel
135s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_tracker_local.html
Size

1KB
MD5

829e307fee543203f205da867683e4d8
SHA1

c93c4c81b6bf30ec3e4fe7c0da4a550ba29e5fd6
SHA256

61a79942092e1d3685ca18930e82cc56697e81e432a185a0298fde79fcfe396b
SHA512

61007e65a212858c355c9cff799fea23cf0032f5cefb31a3a45080463e707e34da0dc14cd51b6a099ebcec9c1b718aa2a749550864c04c2e25f3a7e02f6c6753

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16C2C0D1-3561-11EE-A701-FEA3F30CF971} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000513240777ac006027eb49a6103725680862462d39c256630a51167b2a48ec4ab000000000e800000000200002000000093f6cc0e67cbacc6d09daec40ea3ee22e46f4aa5b1fa8caa748d79c40616e7d9200000007e65138a492a5cf97107e5697de5f2ef47afb304f3c3ec99650c1b125b30cd1f4000000042c5138ca3de70638c38e98598638cf868af22a0bb04c16424a32bf0028f41d08d5b7a081ffa0f42f6644a615ca3e93eb5ca3cbe9a748702ebf1f8b806753c93	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000414d4a95aa3abcffe41dd3be841c990abcdbbf4daf00313031aa284ca820937a000000000e80000000020000200000005314ea2c36277aa1fd83b3d09496ac76560dba704b36335714beaef87ecf69629000000023e068b93e2367fa211fe722425ed3397f5d1f1ce42c2abae7ca37c295067e641c0aa345ba3603569d7979d37c976d00f48c79613beda4163ba9413f3787f97e012ee6d41ae2c1a595b94d9659c53790fcad4f5310ebf7a7330a79fc0b5e2a6c1e781aed1275de564aa58d04d4332aa06ac9e5beefa3cc0fdd3b399409ccf91cf46fe2e265a6c122fec42c17375010444000000084958e3acbd01b00410444143e40deacba690af2fab56d2fc18af11009d2de49d4bdd42fa79a2da8f780bb6d5c1d71a37d86568ff1c5265c0f9c909775d0175e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0607beb6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3040 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3040 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3040 iexplore.exe
3040 iexplore.exe
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE
2916 IEXPLORE.EXE

pid	process
3040	iexplore.exe

pid	process
3040	iexplore.exe

pid	process
3040	iexplore.exe
3040	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3040 wrote to memory of 2916	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2916	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2916	3040	iexplore.exe	IEXPLORE.EXE
PID 3040 wrote to memory of 2916	3040	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_tracker_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e95a7632beb7d66516d443af76107d

SHA1
150de353edf40659583a2231cdaf904588d42058

SHA256
a7b0d7c6bc95e12bffa5792b2c66783dd99549d52cf22f4558ce59a557fc6d08

SHA512
f3056eaca56e153bae1be6d8d90c20ad3bd77795c0dc03746ec7c2544c330c6c3f93dc0cfe82701e2a472537c5b2fcb4b2ca19b9cfdfd5ce62c11137e05d7940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aefb5e24dea50f16315de971db34d480

SHA1
e164f51a2cf711148e4ea7c894ed8d5531bc93b9

SHA256
1d117cc09f81e8b94fd8b566c80616aff2b871c5d76baece49fd067d530cf3b6

SHA512
f7c6045d9db430c66048c13bac7f249ecf1307dab889280af070d29c937b7ffe6e13568efc3fc637fec55d86ddbb01dcee5e0620954e3db77e04bda50100b52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82e1186b05f5eb1cacfac2e51c53824f

SHA1
b313972801052f9b1a426b72834bc73a86827cd5

SHA256
91bd2c7727b4a1efc93f6998b1728744b5afba75ee6bd78fe6acab7d211bfd74

SHA512
9d579a615a7d6964117ca19aa6a6cf2f9579834cca65c08bbd4df15698512aa1b765a5e95520a7989f32ea068b20443d835065338baeac58f8861a86cea48d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d148f9e0c4812abe9aef8bdc252e54

SHA1
3ba5d32933b36a8b113a95ec2c8111b4caa6a84b

SHA256
8522decf0bee10a45af4b62aa4e1f72cdc784485b01745f4fb830b2b3086bb67

SHA512
d8ead8ceff9c6cc5555dbb470e9abd41ebc69ad201157a12d99f4064d59bd65be938d481e328d72f08617036e342feba2a44ca7041d34fb6aff9e4871bf8e961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63437fe6e94426b8149456f24d73cb95

SHA1
645d43d2e4a7052ddeed27c57b29c1b7066c65e8

SHA256
38f8a22fd7391199f29c078485dc45ffd85a6363d978f754fea2f1fa54fb5634

SHA512
961f28e80a51938a5f69074a9192cac134508e1539ef2b1d7dff50da808fb9f56996d823a83f8adfd1539f573357e8c6076007bfbe5c0d3c500286c125697e6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f379e686e1c8504b54813b2a2825dc23

SHA1
b29fe949043a5e1d15fa907f85de0a00a7bc4958

SHA256
6eaa26fa55a679e949dda2813a7326246035ff7ba55e5122ff5f2c08502306e8

SHA512
2d0ad3cf925f673fd129b822d54efd8418f594649212ce3790327f1ab6382aa1aefecbb58541f34c599d2e5ebcddc8bd45c6f9f2efd02c5ee9d6c3d3161a2a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7faa84073148eaea88e90908ebbf1f9

SHA1
4c9a37c9388664b97b7fc1635e76c2915abb0460

SHA256
d3a78ff94c5ea8491469fecf9887fab68c0326838bb4b25f039c61fad2c4012e

SHA512
7b27ff0595abbc32ee6d0464a4eba389e0334fb8e7a1dd67c30d15247ed4262ad05ae3d60ad5a1364c04bb0dfa1ebd923508ca7a06a0d4cccaca0281a968a7f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38443661120b95780b2767d9e23d4186

SHA1
9e049c807846864690fa75d3e7444cd59156af59

SHA256
5e1606ae6368bec154de5d20daae6944e6dab9bf434807c7ea1217b4b354c383

SHA512
cbd8981305f5dbdde6c547303979e91c142c31da0ed9bf218504b3739a35acfcd393d6c5da64dd03fe058f042eee15ea85a1e222bba4a4d7e13b00688e81ca0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B95.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C26.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit