6a41f27d45308f281b986b4dfed2989781a0b69cbf069bc84f28e333b56d6dbf

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

callout_8_overlay.xml
Size

2KB
MD5

65a2809f038ffa4146cf59a57e6bb32d
SHA1

3b5e30bf5de229cbeb085e1ea355288d63ebea51
SHA256

8dc35b01684c284e85275509e698edea94e73f6e328732993a96b881f20eaaff
SHA512

2f792059b6aa0a1dd32924169fb9176e9c6523c6f17b17cbaa2486bb246b6f726e01717b47372d9558501cb2dc5f51c1564b7ce195bcde1769e07b3fb8a7879b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249379"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae000000000200000000001066000000010000200000008190ea41208580716c800b2b2acf389aaddd418fcee056888bc612a0a43cbaf4000000000e8000000002000020000000106198b62d53ae5962ebc5de11e56edaa98f6c1db0fc707e82c62bc26bd11e9390000000c227b098598184c5450a6dc3247ae9e08d151477ac98059b9e180a014abbc3568267c443ae5a3822d033d78bd74b7b0abb0a7b03b47cc223d5fd076757afbe250c7ac5d5901430e84f23260156e1dc7672c3dd1b0132d44aac358c3d44f44d9450aca99e0acc6d4495da59e76a3a3928e6c2378290214e7484f08679338011c163deea805072d893c554c5fe966617874000000074208a504c211dc15b33dd0ea5c9bd0dcc104cb27a3a5a7ae866aa696d34103357cb81b58678237eb3cf3beaba28ae79ed2f8af84f58011ece7f3750466f71b4	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40342c7469d8d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae0000000002000000000010660000000100002000000033220f89ca84b6f415a8ee0a7ca3606170d6dbf2c1e1f9e92c14fc8c5aca5fc1000000000e8000000002000020000000906e6c1c12274fe922a23c4aa13626bc901029d6086d1a369d8016d0c252632e2000000014774d5b4db12f09e2b5ae29b4103b5273deb2f1b875f6594221c4e89212b0fd40000000baa9aa7c44d298c3b0f20319fc2fbe7de5771be7e39d49e17d6ce3738f72ea28c0e93f30e67a52aaf2ef655d9241ed3499b2855c7d507fa1944f3fb528294e99	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F687881-445C-11EE-A5F9-C20AF10CBE7D} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2000 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2000 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2000 IEXPLORE.EXE
2000 IEXPLORE.EXE
1948 IEXPLORE.EXE
1948 IEXPLORE.EXE
1948 IEXPLORE.EXE
1948 IEXPLORE.EXE

pid	process
2000	IEXPLORE.EXE

pid	process
2000	IEXPLORE.EXE

pid	process
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1524 wrote to memory of 2672	1524	MSOXMLED.EXE	iexplore.exe
PID 1524 wrote to memory of 2672	1524	MSOXMLED.EXE	iexplore.exe
PID 1524 wrote to memory of 2672	1524	MSOXMLED.EXE	iexplore.exe
PID 1524 wrote to memory of 2672	1524	MSOXMLED.EXE	iexplore.exe
PID 2672 wrote to memory of 2000	2672	iexplore.exe	IEXPLORE.EXE
PID 2672 wrote to memory of 2000	2672	iexplore.exe	IEXPLORE.EXE
PID 2672 wrote to memory of 2000	2672	iexplore.exe	IEXPLORE.EXE
PID 2672 wrote to memory of 2000	2672	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 1948	2000	IEXPLORE.EXE	IEXPLORE.EXE
PID 2000 wrote to memory of 1948	2000	IEXPLORE.EXE	IEXPLORE.EXE
PID 2000 wrote to memory of 1948	2000	IEXPLORE.EXE	IEXPLORE.EXE
PID 2000 wrote to memory of 1948	2000	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_8_overlay.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503ee13e7dcf2546d2374606a4c8eb55

SHA1
0dea46e316e188ee073d02a791496bc78f9c3205

SHA256
70ee4e497ca4a2449ed46ce85a274bf67abdcdc94950a63247d6939201c31136

SHA512
944f7ad4b30c587b13717d672e95fcae82a7314f1b99c74b24692e937304df834f076255c70d48a9caf730e4742f4b6fb38241baa2d443008b7199b899fbd42b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8506e9e11eea81375bb82cc90d05c0dc

SHA1
a776c6527f2f0f643dac4309a20a8e25bdba494e

SHA256
c5ad2851f366a7a27f4cfd860ec2626b0a01434937d981199c3a98aa7bde64bc

SHA512
7ba88545f9deee9bba250e092fc2ae98ac4732c9b27c10b34b627b89427e3ba474d624bfe06d1714e99d96b93116bd0d47e341e8cef2d71953ae9ab09b408c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb1d3f7cf2963d6584583adacf04b69

SHA1
b4096fd9d865f708ca7e7d85d83245e83f4e63e8

SHA256
f780ea503371b3ac22f5e0a020538c9d526cd2fa79961c724675a5fe2387ceeb

SHA512
b9322bf1b7bcea4d0d7858588776e97186d5c1712285669a03f6260ba5177023f5afbfd2df8cd661676f9286fdc5b08fb58b657ab703c18e32beb590f3b959a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49542a0eeb64d8b53d881391ee6ea957

SHA1
bff879830b2aef14a683b5c7b30eb0d1355053f9

SHA256
39251496db1f1bdd9fc70ae0ba857b36c0c999c98a349a8caa3420e0f4b1f12e

SHA512
73bfb82cbd6462abee938613e49913e568f712a42f9849a66a9d8d45638fa1e27d41a852e26483193dc278474038fba6bc19a25361294536cc02efdc70ada303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98276c8d93030e8847af4fb6b69800a3

SHA1
e4b480819a28bcbba945ee0a65ea84286d89662c

SHA256
34b8628bc045a329bd177eadf090614dbea45c73e10229b7b2f485d29f18105f

SHA512
200874bb7f13714a735816051549a90479c277261e23deffa43f27ec62acee0c8a01e538fe5543423e8c51e493bdd8a5411d3b7340f9370d1a31ae1dacaa3863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
417e7e06dca8d6cac5f37ac6df2b0e63

SHA1
6adffc52e5cf850afea7f74397f5de7728d8254e

SHA256
04607278a27a7020792710f0bdc7b7eecc053b9d6009be83cdd4f0dd592b0c81

SHA512
c0f20f38996767541434acfc939b461691ef9aa170eff8ccfedb1a57fcb8aab98ba0211c575d18d9860ab8a0d09ef5fbd1ed3eb927a35cf0bde1c17b792ad861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5131bb7023d573a70701926899f6d37

SHA1
963f4d5d1e7470cb752eb6f6c395f5630323b6ba

SHA256
5f7b5f316959afbb799e6bcb8913b1c0ce97d03a574bfc76de0b4fa4266aaf15

SHA512
1ea17df89bc480829f80142120beefe010a37f083d503033b03c9d4e156b001dd37393991146be44c85d9b0cdd43ab950554486d8bf4bc801ad20b829b3ddd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c9bfd45009755df0bd4ef877290558

SHA1
f9deaa0cac57f93f8c90b9ec0ca0851a08500f9f

SHA256
a07e25cbc2112d429d431105bd6b6efd10897187b200ed3f8c6bf2eb792c16df

SHA512
4bbabedb52d097f660c4877a2b82e341445ecdd76f7e30deaa6f79e062d3f9684cafeff334ec993afb7a2a208d7e8b66709bb8c460fae76c202a1d74f896a327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c78ee462814f74742842b47ae53570b1

SHA1
67959a1dee495a7739d1b9ca397aafb6e01e189c

SHA256
077681bc02a50d231c04628b1d7f5367acd82178d6eb4342bf11c64d554aed91

SHA512
f8915f1b9a8584c5073b2b86fbdf26782099b161b5769ae7b2add58d4aff07a46be2e40396031ee2ed4e76af396b651e0adc4dfe9622f27be8d68de9c446ae71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b3378acc3b9045e0932ec4797fac3f

SHA1
01283a89b90e2e5c4bfb56fe5c805659eec2ec52

SHA256
de88313326b4accf79ea29b96385e8a18ae571f7fdd4257e17d486b84ae1d89f

SHA512
ae6827fd8049455738bdcc7b771c22d6741e8ba35361f2fd3c48ad740707255414b9f35d2a8a6da6fb6917e3f266ae6bedd0279e2a4447cf8d40c1492a14d3b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
567abf76487c18613c141ff24cc35d38

SHA1
d2b620d1375906d783567033f174b1772551e3d9

SHA256
c5d977cb7777eed27c27b6a0035ce5acd99bef956b91a38403f23adf3760fb59

SHA512
2771f2357a5778b7889e2c5307ff9a79a5bf0c622271e59487985d37ca604b94b1c7a058b63ba3a598e471f819ef27b8ef50d3090679388d313e5237595afd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE14D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3F3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit