612122f55d5859458323f874ac961cb46291de4359284feec5bd6181d8b163cd

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_pressure_entry_local.html
Size

2KB
MD5

1cdeabe6877fd1045588c42a174a7e01
SHA1

376b5eec8b187c05c562e65dea56622501840f77
SHA256

2f1b3beb96e982fc3a873335c5117682f212f870d5fc4ee6e0e9c2f9e861f2db
SHA512

b3ff351f1ab2a406f8f1b01d6f8ce58052f5edc5307d84c331febe2c972fa3354ecaae2da9f97e278666692ff56a80d020d49c587b184307557b8adfcff234be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10af9cae69d8d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000605c2d405ad0a899bd4497d65e41ae1a0ef65ca752bfb124e94b813898be59c0000000000e8000000002000020000000a6b8c15d55fc40f5280219b428a4cd66e5b566b463271330c6b14640b9d08a3c200000009763856fb1d84664b20703098260e72cb4298845a4804c179bc670f998605bb440000000e3455fef1255ffbdfcb22e64a8efcd88f0b897fb3d7088dcbea3667bacce89e6aa10fddf0e16d9685bf3a886c31f8e73576d027664e7e3a6f4191972a73c9bff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249478"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9C37F21-445C-11EE-92BA-D2B7D0620653} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000006595085252ca35c132751b09ed79e49c7715c21176718edd179162defdfc9650000000000e800000000200002000000012dd7c9824bf3459816c55bcf299169c0e8afc5def9a5fc134d17392d02731899000000036cf7f8d520a93227c88350973cfa37cfa9af8d595ca2f201996482d363288e2f463c6516d4f092e0cfa3e9f3b827b923117eb259fa7ad17503893d9592429a0f9a7a66979d73c534e88ed99ce148c6d92e4408fc280c3cdc201d0a69ea87acd339674ab1e1345263251fb0d2b62deb545fdfb63e1fe91e8964fdcf7bc176f7c89b6ec9d6601fa057866288af2e982dc40000000732fc3f5fa72dde4d07e8d3d6d3119781c4422627d0a7bfa1f44da963ec7b12ea04f7a044e310bae8ab312f1064af9d90be11defa09e7e745cf7d3a80877cf04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
612	IEXPLORE.EXE
612	IEXPLORE.EXE
612	IEXPLORE.EXE
612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 612	2656	iexplore.exe	28
PID 2656 wrote to memory of 612	2656	iexplore.exe	28
PID 2656 wrote to memory of 612	2656	iexplore.exe	28
PID 2656 wrote to memory of 612	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_pressure_entry_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
861c7703e43779fed0f0798efa15dcb2

SHA1
bbb1475a3e0351885b482f6035139e1da8a8a37a

SHA256
d1f76a8a769f710a33bf1761605c9ce58e41f5537c14add33bcac7132a302a68

SHA512
c064e18a2ad290014e7ce1c6727697a477b7f40dbef2ccbd38900d4fdf8bac5ee6ae1cc23643636230b6dc0f2a78dc105146dfa16c8af1752820ffc5be87c3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68822c9513fbb00708cd30786209d918

SHA1
8ba6cae6b9fd64b5d5006204319099a1db5568ff

SHA256
3f22dea72decfcd1e990b50c6047ed141fa1c6b8ee2e500a69205213c6878388

SHA512
ab91a0bbdfc44a834d253e45ff628df59e7b9b0aef0e01e1d940d48642f6aeaee1aeaa256b301b5ba45ed593164c060b374f2e36d1fc3a5b0c58ae456ad856fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab9481e570b613e82cebeb0a531a160

SHA1
b64d6145afdb7d48c1621d4f32e81220f846338d

SHA256
8c0dd8e3ffd6dec7109c85f5e610e1e7e99b9ebe4b035b5ac813264fe41b30b6

SHA512
248a55b5b859a4f778bf0012a5f93911aa522ab1c6d8c95ac4257b99594c0a68b22c7969da5bf988abe2b9577334bbcf4b2a2c5ae876c5224019c44be7d276fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffb416efd825b75fd7e27956549a27b6

SHA1
25f41d46d14e99f6cfe605ca693f7dcbba5712d0

SHA256
5e9b59a6aa854d351d600d6572e1b73058e7252f86c83a3bcbaea6ab28ed939d

SHA512
75a01b7b2a4a62749683e3ef47aeef5f50af2974786b43f8bc4b092e3688c4fa855971a37264bd1fabfbbc4ba2a690971442fcbf6c618102cedf93822cdc00de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf47d53b0a86a311cd6a4ca4788365f

SHA1
53496a56b66d2745ffb415e0f75f7333e591d4ae

SHA256
e5b74987e34b3c96ff3c5be7819f4c2633e913eba560fd18d8f3365cee5420c7

SHA512
5fa8086adf372fbb61a9d75b16464d1756978dc5621c091f9185c623708f31f43894401aab2cd39c95975d9f552f76d235583dd25e1b7c2581d4c2b904a2ccee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f012389f7baa58be0c284906d8fa7647

SHA1
1ebf0c59950b6df66449aab9fc9c4bd81f1c138f

SHA256
3f04b0ae137e2c541987a485b248c828300c6c3fbb4aba1f315a0bf97d83f70e

SHA512
a9504b9505f83b4fa8ff5a5fa1dd43010733c98d7eeae202d808d5eff8750eb141950e2c8161b886a0a60edc40801b68de396d47d8ae62f31fe0400814f2565e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ca82a4aa7a5a450c87fbae8989a8d0

SHA1
4aac1e15133ed610a813d0e1ab44237c9d4480eb

SHA256
c80e6920b82c183316121a8eb00597fde22eca0f765f98a0071356b263f70acf

SHA512
9d877ca6cf14043256fd08d1f24e5616dd2574114add87372dd379ea4d9831483afc5c4c81d5981909fd2330bddb42271e9b7f74d515eb711556fca1b033c031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22b11b74141ddd588aa5f931542eb1ef

SHA1
0c848fac61a7042dc28c095f74e63b6c1b8af679

SHA256
f349ac710f15579f02ba2e764c9d47a6098ecb449313b35b8316582f7ef74372

SHA512
11ad3079b66f5f076bde03d5f5f3d822cf40f37de78d2121597fa25273c9f09a98b608c5d7fca3d09ec9a6fbd910e4f5af334585a0088c3fd00288ed4b671acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de3262c46f09bca05f063771fc50594

SHA1
95e67de376b64b65c5b3c0dc11632fd68c69eb2b

SHA256
52c1671402d5e4d0a915d072cea497fb4920d7f1fa9cacc9372ac0a2375ed654

SHA512
058097a25fed99d5c6cde83de99735caab8cf7c7c04f5566d7da3c30366fa3d57573cf53210193c66e345ec07972e996e9a4994ab47ae9c047b7b3f5cb8d31ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a858b515251aa8782b8751ea4f44d7a

SHA1
69fee1c877a0a7fd891e237b4a798ab86cddec0c

SHA256
e06348f737941933c4130fe46664bafd7391030a47ecb94c36a4d9dd10154f4c

SHA512
598975c22032711e2e3e529279fc7eca1b963399f969354da830aaf994ed744eba609f24e94df0c06f953ad1af600ce1455cf6c7f74f62c8fb5f2d12b3da0cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e79da6b0698c3cf049892386cbe3ecb

SHA1
8a780f584997e5790815c8eea7519ead2d699d4a

SHA256
e32746413e10d9266f270f9d117d7bc42eae887dd28d7d24b0f85a18acd19ef0

SHA512
507cea37b17f01e4dbc207a591ba256d89efc87c6a7685372bbe05edcd883414c5a8506bcf0a419aa8bdb7606ea4c751982ead4ff7f49a81db28193301e24a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e32eb5e3c29bb64b42584c75ab3a173c

SHA1
d5eff5994800cef0eb6270cf6f827dd7422cfaaf

SHA256
d82e95b8a05c5c5af76429709be188e066219908484b14c926c4d54d1c3ec1a7

SHA512
abd70a09ae686746efc9d25ffd9a1f8038c381ebdddee40fc05d28d4d022134d01971abe23a776097bc37a5dfd16f45fa6d03bb6560976dbe4b337bb729eb539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5460e08d1b2b484897d5aab2f7e87150

SHA1
5c83995d4f25a247d72a16f9972814f317119f15

SHA256
215ee52be0ce701fda35e764a788232dc0e658a91e105f2b4d818bed1c3e8837

SHA512
6e6a199a653fa4f37a40251b2779a256e1babacca9c0426f9edfab75c8ab06d34f9091e591102503805b7e2b4000faffddb0724bfb7298e2a3872583ce244564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a527782fb1aeffc818f55aafe380aab3

SHA1
3da9fb3541418c2f012a68dfd3f8ab44c91cb305

SHA256
89014c16c3bc33b5a137e896f363f40909e8c42af8f4eccbe02303761edbec85

SHA512
625aed2daedd40648c5e9c44b2254d847d84b9f9266e8fd874482d4c9101fce0b57d905ebb26f74f2aa225ff522802ebbe9b245bb541978903e965757b507e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
758efa71e9fb32ff2b55457d57e2673a

SHA1
45945249d917fc9151d5b869b3d44cfa6c72dd63

SHA256
ea7778165273aaa9d7c1d09f106ff389299bb314d352861e7051e3c7fd8c6004

SHA512
a727e2360e642cc55546685cc9a3913d490505a640bd446ebdb78a88f2387c0edb629563c1a4569465d09a88dc5b3efef527090c81cade724353fb03c05f6643

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB906.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBDA.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit