d169f5cddd7b7d6b45dfed7e9e216a4af93b9738eb2b736362484ee777d76bac

Analysis

max time kernel
120s
max time network
175s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/09/2023, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ionic-push-notification-android/android/app/build/intermediates/assets/debug/public/svg/accessibility-outline.svg
Size

765B
MD5

1e143e36df31407dd0feac9c197a905c
SHA1

bf274d4faa7851f002fcec797cb937180783ce07
SHA256

fe28ab175732f35ebf2057ddde8f5c7469d1c73ecf4fe2dd872543e623cd4234
SHA512

4404a216b70e1606b68451ef796e868fab6fa82647386acb97bd9bb5879529af07b2d9c6a05b77b0e0308d7c9d0e619f1cd2603d6d483cbbe8c331e73a661a40

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{144A37D1-4B3B-11EE-BB58-5EF5C936A496} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000dd2609be50d3869d194e8c8efdde54417b8c9ec77f085b9efae6d63d97f8203e000000000e80000000020000200000002ad2c47922166e7384853b5f1fac3de52f56a7cc6419a8af20525e8c0af9142f900000000c631e63476974d7ee278df02e591c4d111d30f79a8631ad005da6a52708db166e5b6d5694da0808738c871a929a926110fa136b3e05258fdc3c0e7db1e427aa69837a323318c72e7cd0fae6105666b71d347d612ec7137fe1283ece40f882b6c571b55ffdb906d298e361e7d6ee8236990560149884588fdb87b4a6619a19b8c9536a63aefe1d1c9c1ef0c7c967b0694000000093e1ad6a97c3026ea2641fae440558b9441896467a2b29e9e3ccd66518bb348c94e0b16efb7967d1040bb8609eeab3790d31e2a9ed0212bb5cb50a0bed3990dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000006d5207986ee1f81edc18f3ea11d2be7e15a1665e2cb30b05e146adce5a31750d000000000e80000000020000200000004230397f81c54dcc0ec19d141debcf5dd3b34b298e8c64ecdc63f7523f68de252000000069c2867abe3d5bbdc64ce43d8b2d3367c787c5d5c15b1ff6185150ea405efcd24000000055977991fba64c0fcceb891467ecd766ca45748032103103b8f1d97168eb2b186c1b6bc862ce625f8aba97538eb8eb99dcb85c778f35e275eded625f60a83833	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04336e947dfd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400004650"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2020	1656	iexplore.exe	28
PID 1656 wrote to memory of 2020	1656	iexplore.exe	28
PID 1656 wrote to memory of 2020	1656	iexplore.exe	28
PID 1656 wrote to memory of 2020	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ionic-push-notification-android\android\app\build\intermediates\assets\debug\public\svg\accessibility-outline.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
270b19329b99311845b653af57832f76

SHA1
84867906cb42f08981e44ccc8d2b0745ca02a734

SHA256
a33119dcb34eee62eea0bbc4c88b7d1808bdde25d2fe5e002d8d390ec86d5897

SHA512
1616f4284adefbf8186fa780682cd735b8c0ace676361fcf6e751aa4bcc997c90338bc0c7573266e863719deb37da7aa0eacf8ca55f7c19472b87fec68637f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c6267ba034de58937d9352174d9409

SHA1
9e23799a47b492319dc0289d8f917fdea715cf52

SHA256
e2a36ac0770a746122e5eccd525a3f787f4bf220f18e68cb1df1ea355c5f26d1

SHA512
5c38d47dd48d7d2f5cbf5ff241d62a8782a2953cf2ae423240f66edd1be3cb330d429a7fd3c3caef0267e350e4e20a488be8eaa8f545c96a189a54c966cafa97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae541e884b9e27b0018e110296a294cf

SHA1
8a7cb370a3856f412e05792863634e0c48b68b9a

SHA256
87ac062538264dc9fc0301fcc9fedf49b27b94bc5e4d7c1c62411cc95db95f88

SHA512
ffc5c4324a8cba1b1dee14c6d2f6a4b70cc656f034d247518a75f4c8fa4c36d0164c66778bb3e8538f79bf7d2100bfb2cae122afa40cb3a8ca645ca632ddffed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1391b7b715d6f33453310b494648f1e2

SHA1
f6850f7b59b29b8d27982b5f047bf1d2c890452f

SHA256
d612e1b8e35b06bd4b5abd5921dcd3cda5dfb35581c627cbe2d9b1ff9a0cf4d1

SHA512
20c7cbd37bf78f086a565ab1e50a90dcee27c85615381b351356d21e955cb6b8ff5d5c24b0b85431cc6b3bc0b439d6b978d2e3e68b1179ee9f058e7dee8cb180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe3da77369c29c4de25cc528226c96d

SHA1
38970756c3928cb107a5e259ed3fa7077be31e79

SHA256
602a027f0b34465fac714d13cd0868d4e536666010ee52048f4cac4fde42e650

SHA512
d22329fb284e0cdb06fac45b3a0a6d16bc6eb6f7a95e00290512e92d03789be514a322aa214eb810a9dc2674af37065b52dbc2f09056b2691b9cfe027fe3d695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
998346f2d8c44c85390776596e793f4a

SHA1
80cdc93c505a2d24c99cd22fc3a46bea3872b015

SHA256
8fa8b6fe039a960f1435e6123e2e191351109f19b16fab25f1fc1bbf4d6cf294

SHA512
8d541152178cea02df82cc0e9ee10ed3997b6aed025dd3a634031caffecdd493eca0cb129b30d94f8cfef5fa1b43cc44c9517eb20bd55c5b2646d3342285fd28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a9bb7b01a29fed74640a8addd69faf7

SHA1
6e808e51d40952b52fc7a38e660b1bba008935aa

SHA256
279ea802d6fe141a95c1019fb17c1ea3e302290f3c1053c770b77597cd8e915b

SHA512
298440d288fb12e90b8305439d77314f8ff4cb1ff791cdfa6cd9cdd8a4a0bd36d55dc8285b9b0875fdbbf4a4e1dd00e568fb553d2fad0862cba6d43407cc42e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15ed92f4fd18b5c9dfe6b84eac18cae6

SHA1
e49f7251606a201b40fbede7b85f60ec619e6512

SHA256
0edad3bbb5b3400c26812f4bde6496280f0ec8e38a102bd076270d308c18b2e0

SHA512
921068a349b6784e240b0d1226f6af411c949bc6da7dff6399ede46e40ee425c79bf692d75b32de151464b3f4c530300a7d934ddceb7666edd5cb34e89d93c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f2cc264dbbea957a6fda708b180941

SHA1
b99a73e7378c1a621f957cb0358772988d79ccf8

SHA256
2d2733d3f6c11f54524d7520bb2a05367937e6c24bea91cb64c80fd40b98d4f3

SHA512
8d96fe8bda5c4d1f594d48af8b943320baf2ca3d96e63447ac6dad22d1877b49c94e553e1ddf03b87084e19138c0ff0779506be0aee8c38252bd0d0a82d8a513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb9e137aba1cd49b1595420744ce555

SHA1
02965ced0d55ab7336eb5d8c7fbd9318613f3a7c

SHA256
d4df009bf7bc1a3686ca0524c9c8f91721199b6364c1b18a5042ab71c2d1e2f8

SHA512
27cd07eedc7fbb8f07d3394f72e4fdc6f95ce67a6b1ddc01eef7f48e4649f02c8d233410b611d65b1ca1fd47db19c8acd1e0d500103619d63440fbf90655ae47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ad3e6157e168560c550565511e9706

SHA1
e9e11f260e9e95df457b91cb3e41fd35a2ec6cf9

SHA256
af35c0fa77237d450f54c48910b9321f265ac82e5f7076284e7317a819644797

SHA512
5e5fd1c4314426dc6757ce850288c6fa9900beb1f8299143438cfd07d7477aaece23bf74f4f680851adf9bc337acfdbac0e106cfccf291911a77978e8728586a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA180.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1E1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit