846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
submitted
25-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

diabetes_reports_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000007ca9ffa8b8502b9bff1deef371f31f419dea261965a8b9eb54f8cad6bee1beb2000000000e80000000020000200000007916cc900d29170f31c0fdda4d0cad5119d37d88a55283abd5c77a532f2e100d90000000766e95bfe615af9548a299a2ab529d21403d88edbd3aab46eea9f5a763169ee68036faa5f005f6af1931dd1df0af7b596a3d08e2284a7c39eefa9d9f1c85254a37e4c76e1a3d9607ee428fe1cd8aff6dc9d14192e94c6564cd505e8155554eff3483d796cc636cd75798fe8e3871252f38e9c9ff227071784b6b776482f685eef4317a9c22f4455d82c4b27a4e103b1e4000000091b4a9f54d7b461d199af35388865237406629c51486dc3f78aff738b35984779c3e16116c03a4b95332d76f0e23f1474edd71c433b77a35b4cdb4932244c862	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bbbabafbefd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401841079"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000f0befab96e399ec1728d331fdfba25b776ce4c72d0a5ff6030efefa3fd751cb1000000000e8000000002000020000000318d8c071ab55c581b31dcccdcf16f8f649e7b0e77de9200ddecb2b2fa2ebd8520000000300f9b61ce8ccb2c23fa853667634b896907c9dc1e72a4156f22d3ceea556ee4400000003afbab81f411b6161972db2229f69fca3036be14ca2d33138e54dadf3341e9057bb88909a610ea7560973c04c0b7b096b855b2b555edc85452fa839066c77005	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E577B621-5BEE-11EE-A68C-D2B3C10F014B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1268	iexplore.exe
1268	iexplore.exe
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 804	1268	iexplore.exe	28
PID 1268 wrote to memory of 804	1268	iexplore.exe	28
PID 1268 wrote to memory of 804	1268	iexplore.exe	28
PID 1268 wrote to memory of 804	1268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\diabetes_reports_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7f072acbb303c11969b86714f93b34

SHA1
98a19b5d93273411d07050b257c6b1b14c45ee2b

SHA256
db554e2b86e4cc5503d9b3f305332667995b42bfa49b20a07ec6c9915c438e43

SHA512
8600bdda8781e971c144d792d2b1d359b89699efe002eeadfed93a41a500d89786d3bc74f50ea0f7702cbd2781ad5c9bc556d49ce786058a554d09f555afa6a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a5647814956b16f794c472483fe0b6

SHA1
f65f3dbd006ff057398a7df8b31984876338a251

SHA256
c5f28512b371f1c36ff2e0d3e8dd4e36ec8c32f9a7a9304b39ced6b16cafe404

SHA512
3a012e33cb3669a7111488ad47dbf1ad1a454b0ad16239bbb32476726afb11e9a93fed50f1f2e5a9a803725c6c22a9e4b3e2fbbf1b1489790321da0e4899a5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f05208cba52a66187db3221874e0edf

SHA1
fc52ec24ab1e269b3179b03896e15258503e56e3

SHA256
9f748c1e7781c109a93704de160afe198166fffc1c7d91cc2c53705043ed9df7

SHA512
bee2798e378721ac6481375bae1b38cbc9bf9de940f282c6d79320a9457b2ebb92e6e3631f7ea2b6caa30b6bec06887166c65d1cce5748cca24b5728bd9b7a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ec8dd4407b1d7f7a5ac42ca2d343d4

SHA1
c4ed16c208e12a2542b39f9a47adb9fba4083572

SHA256
17a14ea4736f43982091be389cb9175ae1f33c19c9fc293af71dd235b63d21ee

SHA512
6db18303f82af6c7e054c5967ad047b831e3722f54c9689a3796ef812d5cd66e7d0ce769b535d2c7bfcaca88f596fd379fd0a8d78fbab6807ba2867377ef733d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49250392d900ff6475b344686b20fa5f

SHA1
a4aab55be5fd3b9f307b120a1b82c60c1c9c4cff

SHA256
6620c5276fdd5a67015eee8b33b902523174fbd66635d64f38846290e01ef6e9

SHA512
9e930a178d25a06727b2d17f63346c6d2c443af4800131b269aa554b8c2e99ff56eb8d67765a78eeafbe5f027daecb7f1310c952ef6bbf179a68c78f874f74e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1cfd196196f4d0ff2af12c0c73b1b65

SHA1
4ba88e630679fff79601675a302f28c1bf4cf153

SHA256
7546004044a71bfa56093883e72877c06e6e88083248cb94d061defdf86ef8fb

SHA512
61bda7c52b9326727158f255e9f90a9e360cf4de82de253b7265e7c77ca2a246c3c2731d51ee96689c63ef3797d3b0c1214deedce648a79a2764e64ead9476de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d426b22046ec0df912a66d3c8888872

SHA1
c51b6029d4c09860ae2663ead69d4224f328b7fe

SHA256
8b155b52735893fa4cb72597bf5b804cdc4139cecbed1a57d2f80c18e04cc3af

SHA512
f549ba4240afc4fdf978eb9d465690ba97fedd6a392a25bc4ed47019a406c0ed22ecb9676d6d83bfb2b34f02dbcbec2c298da4ef8da3142bc4d5cf2a6981ad68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ebda97be10b7306110bac4bcc81b621

SHA1
e5072700c918bd24acb148b3387916df38c99916

SHA256
10fbbe0cb3f39ff75c70e6e7619c6a6ccddf9802d18ff3da41ff6bda86c03510

SHA512
c7c654c36f728f46b7ea334211f963954a69f8615bf9439926450fc33377ecd788ed9e4cfb2dfa5cdd96496dceb25332dc563079f0ca32fc176d15905b8cab2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee110aa0e13b9a661bed38218b910b6

SHA1
fe07985440576571bc10a2d9428ebc2a1f9ec84b

SHA256
0f12d5dedb281036256fa50aa67f51fdbbe70a8882bddfb28c0d97eab10cda23

SHA512
eb33f94b7c002ad57c7de2f58b35399f34ce283bfd07e8f7c3b9a80aee9e91256049c1aaa0ffe6f38c95b5c18a2966f5a2e2a8194acc7e38ec8b9d696098c99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb917d056701d4389a36085372fcba12

SHA1
cd3f086b006c5ac478cae8b119082d33fe4ff45c

SHA256
bdb37bab7776b78d53168d71a04abcd3579391edfcde2f0a1a30f6d7693e8e67

SHA512
371e425598a85f623ffcd285893a16a7468c85da5a0efe83c99e7bc0e1d4677da54c6acc28be60a5e7d89e270e25487bbd26b4c96808ac37c3e1aa09c66586b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc03432a6a73d21a1e7e9eec9d61a28

SHA1
60cee1c8a4f8afb41eb7c4fc6325bb3fd25c5170

SHA256
ae960647694c6c0d23f4838152012ec6d60f4b4c8eb704b5a23d98c1fe2325ba

SHA512
446d797e8c15f842a9667660554a65ee72aaccc84454c57a69150696272b23e208a4cc587ec868b91486edc4f3ad09d0e6b44d34402c6317aaf8c45e78080365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1df743e054a8139571c394965165abc

SHA1
a7281e9794b2881017984b6d341f3718d88d2510

SHA256
01e99dc84bf5ac2a004d9e56b2a2cc0502592e454473ffd6f7781f979efe1a46

SHA512
9d05cafe747d7866abe448613d1b6545655632789b78ce309dca9dd9811820b3738e03ee29236435b16773ccc8de8937d877ff22a757113746e49d0bc0366b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e21b9f276fed4245b626de47e361c8

SHA1
73131aeb444c57e1af8f63d8008f5f008e257587

SHA256
2217a3463d4697021742b3737ef0669452e37010b6d06005d65add9d0f53a6b8

SHA512
da117adc51cd168a0525270e49b96ff7bd6f2173a649e22456bc944a7c4763d6cae5c1fe5b05a9468dcaeb3cc76be5f79104e69fa91eb88d6e85d34dcfc1bcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275e0734c44ecc4b7565835661712d7c

SHA1
10ca69e69d71263b9a1631b29b970bbd6d734684

SHA256
4cc60533b26be695601d16c9bd8424b2ffa6256c118bdedbc07265ed339b9b83

SHA512
fb1319f4a2486535a12343f0c3f1dd8f1c9a9d964ed8417db2a794b0b7cbdf385b7328929ee97471738d93bb92282cd9fb06b5e4af9275a7e1938ab7d1f13ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95502c243b6660f4057d37e6c36a6614

SHA1
bacc86e03a8fe835bd62c29a0633847676e91a53

SHA256
b7e6e528e5bd6b3791c5e1cf7ba3f737b83dfbdde1ca4932c47241fa4fd07e27

SHA512
531d8b2e80248a41d294b67be3b6015d0c1576593ad20a56bd071cec5f1d356d4255d25d6fc973904e615d6a2484ef574aa15a2fb89560422ef4861d85f89a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5228.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar52D7.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit