846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
submitted
25-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_tracker_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401841082"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2006debbfbefd901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000db843725cfb46074129db44cf12765935098bb6a775a5b1e69d9bf91038a92e3000000000e80000000020000200000008018d3f81113496f586a15c9b82bc932f5993480414d3ac3f25d00c525ec82b490000000a3bc83e27661aba4cd68b9c3fa3426c5f1d70c81a3e76f9e7da8acb41230511effd60dbc3e748923e5edcc2232fdf6994d07225d2ac78c76265dba60866b5ff94782d9aa7aa63220dc8c9e065bb832d00a72f5b4d3be5e513a4e2d9a68d12f0e097e8f0d6a896e55b67114cf43d88deb100c99ce1730e2fa29f063045f8aa703bcd8718d6f01a01f51fd29ff1c593507400000005fcec7e1a986a03861d427fa79680ba42c75807a8f7ffa7da19b3549db9e4df4c658a81e10d87189d032e503d65e1713421e7e4fbce1235326041a4939f75502	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E707E371-5BEE-11EE-8E84-7200988DF339} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000003efeaffa554e49bab616a55c4cd798986683d90d14bea164a2986bd13ad614f5000000000e8000000002000020000000e0257f97ced4d0035c5a94da0904526749b22cf8632e767d1680cd95017cb7082000000067fb62e46be1366290250838e86826661b89f4a31386c9f25c5227aa7033f8fa4000000069ccfd9cded18bb971bc14f3e731cdb9409f2bdb99f5d46fbcf895ffc5422e22f002e3bdd2a9eec41fcd5570e642b1d70efe99a8200607f38c56e8c707d24b9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2332	1864	iexplore.exe	28
PID 1864 wrote to memory of 2332	1864	iexplore.exe	28
PID 1864 wrote to memory of 2332	1864	iexplore.exe	28
PID 1864 wrote to memory of 2332	1864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_tracker_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8984d1ddf49235ab7b5f272ccddacc9b

SHA1
a17e78eb99efd4abfef09229233aa9c5a99b684b

SHA256
3c1e3d4a685fc65185710627e72ef01d6d955994dbd163e9bbe3992a7e93c481

SHA512
26d7544b3af7b8ad0b260e10c451660ce245a7634171e286e5bf5fc10b392d8d1f6578c513e503e79e144b513a71215279ec2e9e4cd1d3e934524fc2abba33d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451d1bed2b94465711cb83ed9f859a4f

SHA1
f9b9620e46efe192f9731be0c520ca742844d50a

SHA256
55e609c7aa327af62da74cb28692a497ba628bcd923a563be1070164f116a5d4

SHA512
68cce4d003992f137f958048cd64da99418a3cd47ea29c9dd058ee1e3524cf96dd9a9dfb733f355f807f8cd64d30b24ef3ac94a47310ff78c730019e8877aa4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5c1ca4fc953b4273f1a81f8f9002e2

SHA1
7a8799bf75b0fdb1a7e47b0c6aa14013f61a814a

SHA256
503a1ba9e085c76949da82a3867120ecd0d5fd1b372667bf69c70879ce01d308

SHA512
5def62da172eda5ae8d65cff0e95c24ec6451b5d5859b9a4c13d1b126dc3a085f0a1e5676e65a36ceb2f6669f2838b22d4f2e166da91c1871e39460e5d53770d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb8d0eff6306289561ddc09f79a14cb5

SHA1
78945c9bdc10adf21df3a5415612509295cc729f

SHA256
b375ff639d7ef906c866c5785b6bed77901b6e741f27a9bb232d49392c6b347d

SHA512
a88274ac8fa85bda615608dfee5cddf28872dc74d888247ee7fcd3eabc4ca29c4d6481ccc9fd59195ccb47b8f7b01eaf485bda884f99ab10e98eb788dcad13ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c7ec905e12cf9dcf771bfa40b779a35

SHA1
e1b0c3329e2dda5b14e28e89bb2b76c85b8ac8b2

SHA256
ed22da05d15cc1a5f6f5de40b43a9ca9cf06f90b03006c9e61af9ed7fe00b459

SHA512
6fb4de696426380407209c4b3fa33fc257a00ae6bbf530069aea3d40448f7a1abfc752ff1439f1aba8b0af71ad0b14b37c5c459544966f70bc4a9c055ff72a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcb8822527cfe2bd5d21f7f6b91aa373

SHA1
1bdfd1d03c0f27fc8c05d390ac458fab1f06b631

SHA256
c5aea6ab1b4b9e658e9eccc8ffcc2617b08188aca89afacb472a354d6cb8155c

SHA512
73820251425d06cf8329ac69670b5b60237446c5e655a2b2d4c138049ad20169396527d31f84691446613391f070e1762095e289fc0c844d8f1cf4745d5487bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f6b06ab26a977d4160aea14c7027b64

SHA1
ee0dd09c66f7c17128c5b270b667fbc7f608c28a

SHA256
5194e2eeb145c3da68f57fdf92d2b8cd79a345b664ea229183f5491592d96829

SHA512
3527aa07fd5b6a3cb9fb889b3109a1b7bec1ad4ff461fdf64f8dfa44853ee8b9bb5924119bbec27c6b794916e0d3da4583ffb682bc9dfbe2052916f1f321ea2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05060897be2e51d031f85cc8c6929849

SHA1
b06ec67e95b583d9816277c6c549d8a5d3c56098

SHA256
2d96ae286fde59d16384d14ffab9ccf3549ea11a024823907de6e60bdbee4ad9

SHA512
09f700d0de9a6b3fb745f620ef0ab63f045621d1f080cbfff4d4aff8077e7b0c1a1a4edad9b3657f41bf19ef7dcbb7ba2642755e3ec77bef7bf7afacfc8d5759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c500947dfd65dc7975f8376d8427510

SHA1
285ee82c019acdfc12a48e204340eb6ba90ae38d

SHA256
ec5fd6e5302650a81f5cd6e70401a0aabbc7449cca23c81691e878fa19d6c0ed

SHA512
94fbef8707221ca30796edf13576ab6604f9003479d206104fe1f0853a55126cb20018c6e66358eeb68d86fb247ee12faf320548fd25b32e591e6661304584da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e0313613b4f4d9950dff5e920b6118c

SHA1
84b74fb7b172157598d87ae5883cdb0104bca742

SHA256
1d529516ad1cffb972e7d199e5caf1b0245dfe7e994249fbbefd91d654858455

SHA512
bf103364ba403250897895c23ec240816c05f1152e4a6bf2d281b078f6236741e9a003f0b13690f86d5eafb87ac69e1fe2975ef9276e09cc40b666e6ab4b086a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5580a8cf131002938d984f249a62840c

SHA1
a0645ec37eeedc609378298d59c0d8985ccff68a

SHA256
c574962b8efb5a25fbf51aa3ddd20bd02ddad95e83a6eeb847a14672194360dc

SHA512
d443e431a493ee12de1485deb732f863678b72efef4b8b22876e2a504c4a32f4ef06a912b2a4ab07f69a0c04e2e3ddc1311e8ec20ae4ad10653eb39cef6c9f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27f82558f5607fcd2beb56c2f1c75229

SHA1
f2287ebcc8f4c6205865a830a8fb2a71b759fea3

SHA256
9a4c26117390ab453e8d3e37aaef0972598ee355657c4508e1cdd88480ad7f72

SHA512
914e6e3308bd67a84a42fa9d92a952c963da0dafec6aabea4083be649a733f3b5ee28203b916bd24355982caaff025d789bb0e3ea7e7c9a5c8a01040b3464afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e2ae6a93b9976b69bc44b1cb46e829

SHA1
0ee4bc2d6e47f40f8e83414277c82609f1ff7ffe

SHA256
76c2a699d388361626ca74d3ca4c1bd43459a134acc2fae3610c1cafe3818cdd

SHA512
2a593333d19e65860ff4a70fe11d551f4fdc5c38c438d502de1eb3e250a7e9805429a049ada5e2f70da30d1b0ddc86920f31c151b2d814cdffdb28423a109fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d28b6f5e5da84ff63f87f60f243f47d

SHA1
e8b5308af4d568f4aae8f521567fe802a278027d

SHA256
6400e741169cdcaf6050037ccc012fc6fc0ae75a200d30f1dfc8d5dc7d877def

SHA512
2d011310020de718c0595f88938690df917239dbf4667671caa6d2b11e97ad0f507c8d786ed7c83190cb957093aa38053d0c620ccbdb740260eca97178f2a4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8cf9623e8c2daefb83b0e252aa48a3e

SHA1
42cff33ca59e7d68e4df268702d9f9e679e8788a

SHA256
d97c4a1490d8ea96ce7cdc1feffd2c87d1db9274598c9a78380fe7360e323684

SHA512
8e730d03a311631d8b577a79150cb0f456ba1b02c01d4277fabc488afd336634371351866bb8757de169125c7b1f7bf7c9cad247d1874da67733f2d2cdbcb253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9628bc32967acd664733ca63ed4d88b3

SHA1
d7d9faef92b32b527dc4b16ab8b881d25619a386

SHA256
79ffbf0ba38ce59afdc8c5e636d4d8c60192121527da6a54c7a6c73987ed788a

SHA512
598d51bd99e79eaa12e511c203ef309be37dfb4a6f6c69eb4ebf3f0aca7373bb5057a1d882f488878b29ab71e26f5df2ffe5423d63161d50cbff31dfdd1b9163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af9f36f20417a1bfd01e17865c0bb4c5

SHA1
b5c6e8a675fd2df563b65b096283e08910f1c031

SHA256
83e106c146646ac4b3c9be7c1de91f926a1dc1d5f6a56856ac9b043764f6771c

SHA512
9eac91c650b8c500ab09f369306a28d8a89eb8723c9d149d2f255d0259c12f6514e133862c72ee2495841579a9b38794b93cb20e8a792adf7655bb39b9a519f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E97.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F07.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit