f1bcf62ae8af19e38cfa19809e5a65cddd9b638cce72598f053774dda76bf398

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shape_16.xml
Size

1KB
MD5

d071555e770aa899a60ec89d524231f6
SHA1

d12e7658da72e21b2447a0ab017f45f45bc27afe
SHA256

d808488d2ce5c294a551dd6cab016c098f87fe5025ca4737d60e76cd391ccf12
SHA512

02190ef1bc3823fe84d79b147dc8c16ef66325175a798178324b44ca114a12a0601d5717f25f0df7219e0406528a070d6b6a10793a4c51dd461eb1fefe0cfa51

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08e82946ec9d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000ebaf09d4be2e50cffaad85089d4ff07e0dd233a2043e940d60c1317fc45f45df000000000e8000000002000020000000ac1eaee95a6927840383302f0b24495da2b173a3fe378cf292c60b6f230c995990000000e6e5cef57c3cf3bb6d23bc2a69f20aad721573524449c290753ffb5d2efd4e3af6739b6eeb2aa184279cea011a45b1ead11b44604f859cb6b8657630787388af8dd74277af3f93a71ab3387094af7b0f8f03aa45c868a4c7a204d2fba8406ad1ee63b6690a5cdee2ca6e7e2aeaeae07508f8d1dada595d7d50b97cf6bdb78b1d0f8cb2d4f9e34a4ee42b96b9c3af1b6440000000a832f8f28f9c52b688e3470a96ea7c177af39c730a57aae7562324efda96d4d345586d362f094b0399bfe4e539cd300e50331ec6c8869d658167b24907ff9448	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFAE4891-3561-11EE-A427-4E44D8A05677} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000007c9cefe03b4eca3af1a7652c64a79f253128522dd05e3567ba2bacbcedcb3e27000000000e80000000020000200000004c6208d9e06c34b81710edd7a8ec5a9fdb3ca9c59fe6cd88974875f9acf8dbbd20000000fec78378a3a878940529369a7d77de054993b1369853e9c6ae3255befe47a3d440000000b91466932aea51e808d791d41b09ee414f40bb6076442bafa327153a555251b24ae06f9fe155badb34b42fb514531f39f9d213c90c3e029e950802ad9170e800	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602313"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

3020 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

3020 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

3020 IEXPLORE.EXE
3020 IEXPLORE.EXE
1564 IEXPLORE.EXE
1564 IEXPLORE.EXE
1564 IEXPLORE.EXE
1564 IEXPLORE.EXE

pid	process
3020	IEXPLORE.EXE

pid	process
3020	IEXPLORE.EXE

pid	process
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1816 wrote to memory of 2236	1816	MSOXMLED.EXE	iexplore.exe
PID 1816 wrote to memory of 2236	1816	MSOXMLED.EXE	iexplore.exe
PID 1816 wrote to memory of 2236	1816	MSOXMLED.EXE	iexplore.exe
PID 1816 wrote to memory of 2236	1816	MSOXMLED.EXE	iexplore.exe
PID 2236 wrote to memory of 3020	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 3020	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 3020	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 3020	2236	iexplore.exe	IEXPLORE.EXE
PID 3020 wrote to memory of 1564	3020	IEXPLORE.EXE	IEXPLORE.EXE
PID 3020 wrote to memory of 1564	3020	IEXPLORE.EXE	IEXPLORE.EXE
PID 3020 wrote to memory of 1564	3020	IEXPLORE.EXE	IEXPLORE.EXE
PID 3020 wrote to memory of 1564	3020	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_16.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7b0f966fecd9d9c07c07967c77039d30

SHA1
1f07a685d297e1bd7c7be9cba8d714c635c94255

SHA256
aee799773a57dba37d1c0662d76faf5d6ee1e67abd2317ab28f93809ab6394be

SHA512
82dd1e28373480bf46a2945b8c076224a8896212575d4e96c5f0e5e0d5e7d51dab083a25c56c8cc600e2893eddc2bb9f6836fa591084234c0854c45e604483bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a7b60b80bc22950230577eacaff43e

SHA1
583918f38d149beec13765361a6bf2a6bec1e86d

SHA256
8791e4b83c1496a686653ec31ebfb020c9764a878246c43f163c00789ad5a669

SHA512
771d1f98d58efef82cde9565c819a5f2f63a13167f050b0388cf29345b290dc110da05b4e407975aecdbe003a0cc4420e91c0930a1c681db9889324ec941cd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76c2479d87cfb0528d60893ed865d07a

SHA1
5735d0a4650e1011f9f8a064b747d4c90fdab084

SHA256
5a0776abd256d6f944b61930e22d885d8be2f76615e3079b338e9d250c7ffeba

SHA512
464bd1ef3b6f65a46e812f0d365c4673c3c64d03011b61054b1dcf8faef624fa3d0f5ffec17ff90a9b5b7bc3828af7608a14c318a01fb5f72d877a343dc8ef79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1222b26db187d1723a2230b34f3f3fb

SHA1
fc779471c615859c7c0bb0dab1ec1f82f0b33621

SHA256
d4fa4668fc77f559b7c3ae24968f80bc11678e8c6c8c102de192db03c7f2254a

SHA512
8f9d229ce8b237dc4f765248a92c2a85ed6c84b6ca4f4294ad4bb1221e47b1b6d55343d908ea5c5604557fda66dea603552b235733a3a770c2debba61710be29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f696e6fc9229aba12c8c4ce3e79abc3d

SHA1
3f2915f440576d92d0021da5fa4bfec99b6afbbc

SHA256
a7ee9f2e1a2a22987c4b3d984344ddf879ea344e819bb4912934aa2a3fc35a57

SHA512
357baf389cc35c374ec615c81bd91e9db23e08d2f11b5954655039d231c309a919c0410e0420ffc6b2218d331c78ce8aa0b6c5561c377fcecab0f3712434b8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9c5e5f76536b2b26c00b4b0adff51d

SHA1
f8930d5842039a88810bb5182cb8c45f85e1fae4

SHA256
c4a9b8def18f957097f8cbb14b128b96f4b9fbfb6a7050775afa84653c5d541f

SHA512
1b7bd7de5f3421375cba82582fde6a0a39b028b90e93a92cbb363838e75df80581e89c232b34fce4ee4f52f5db8100e750a58f82f76240374dfb1a5ea94c91d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a105328c4dafb757b59b32be62a426

SHA1
d54e86a8e1c292ef752fa674e6bdd7d211b6ba50

SHA256
4123a4f90b8347c221b4ff55b433741fd4aa5cb9bb95d527294c855c5af8c61b

SHA512
2586a3c8867f051b1ecd8018a70fb37eb121e82387973c30ff838a63348cbf22f43ddaab59494e9ff22fd4638d7d7d89013589e148f04725b7d24969307464df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24ab5856125b5b80695701eaaa2a41bf

SHA1
54257386d409c30f357e3f53a51ba2acd6738b81

SHA256
4f4593d933aea4baf1f504784c57bff8caf5e1cae94ee6dcac7d76e9bfc6bb77

SHA512
40f95daa4b21f919c459ead4d0d2d59a26dba36f34e4a40661fdffe2f2071020b23325fc198b14985ec9629b277da75745ef5757d6d5b0b37b921421450827c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb3a3b4373c481c9f05c19d11dd4cff

SHA1
1686146b17ba493891bca38820b449ea0566fbd0

SHA256
2cd25e576e4da42b76720c03974ee5337c27e8bed9cf4c380c23c1ea6d4af457

SHA512
1a36d6d6a85efecfe7727f53863d9ed93bd5ab222744edfd4ae4cdf49bb5bcf9badcca2f9c06d95a4f3badabc76f7a5038154f71824af8a1fd044a70c1ff09cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824cfb1c6158c0c612bec3c28fc547a5

SHA1
8d4f78217c1d693f67a71b0b46ba8cfcf7db2b06

SHA256
fd67955cb43dd8c2b08fdcc7fcc752e42b738e183a4311521c89a2747eb35477

SHA512
02995ac8bb78c883c9864913b86b669c926f7e03117c8ec4eb78e483ed9de659c57ad34cf8a421126b5cb8cb1a4dde85cf06dbb91438cb5d813d93d80de9e600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0688d0557ee88bb361012d88b731f1b

SHA1
74631a1cad9dcb91145560c99eb356fffb2c9722

SHA256
7cc282d9acb59d3ad529eef628cbe6e4444be87054ac2a07e307a13256b6ba51

SHA512
9a4f4007ad7463997597d722ba6c8f919b9266921a9c517d4e5c07966051c49a068c782e9bea547d7e38b34b3e8e5b9f1bb40b28afb104cf4781f40dbf662754

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab871C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87CC.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit