846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
submitted
25-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assign_labels_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401841081"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000006204af27a38130f802814388c2a1f21f0d15b0fe99ef21660f5ed287f34c572f000000000e80000000020000200000000664b71a2b3535febdf191ba7d8a8ada8f6680c2c3b576a4b91fbb85b03a8c1f20000000719cc280ee552afeca18002472436c21c6defdf6fcbb29ab486dfa0e83d4f85a400000005f4640e047c84679f812a45def3cbcfb8734f4793078c0e877e6e5d5704831ca15e0789080f2f3783653928333fbae9714c03c54f7a1171e6983eb5c45e1173e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e047bbfbefd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000000b0f1b8868551de110bc3e89a52e74f3c523dc0923febb508034a257d3fac6e5000000000e80000000020000200000008e359f13639636d03013951e43b3bd48a682ff49c872dddf0c581903f0808032900000003dd033c62fc44bb0d75e185d6e0578437a165617f9dd2fff8beb0a844f229c467ba96bde3148044a038c38ab4f0b20538de94f46198c031381f8010a168a331bc54ecc09060b0f41c16c010e5d974e4dd97f98c7a40ac4cccd15929dcabe9454c94a4beb63d833b447ea2533a61e42ba9a6446b60af3122a6d183327871803d23942e6218d901bc9ff087fc42c42b7dc400000003c26025d00416b3216ac3948de8569e8606f4c1e4f8b9ef528742d297ee3d9f998a95228825a796d552af9048e93bff51996cc315dabfc6490ec578ca48da465	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5F8E471-5BEE-11EE-964A-C6004B6B9118} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2996 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2996 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2996 iexplore.exe
2996 iexplore.exe
2140 IEXPLORE.EXE
2140 IEXPLORE.EXE
2140 IEXPLORE.EXE
2140 IEXPLORE.EXE

pid	process
2996	iexplore.exe

pid	process
2996	iexplore.exe

pid	process
2996	iexplore.exe
2996	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2996 wrote to memory of 2140	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2140	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2140	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2140	2996	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assign_labels_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f7bc3754b677d39a1609d2ded00089b3

SHA1
ac83dc64b446aedbc4989ac56d2785ee978872c9

SHA256
8da9590c6270ca627c7e15059cbf6b483102035ee23c6cc1eb0eb638f7de30c9

SHA512
02fb23b3f34be193286c65c1addb719bc2a57a4b99ab29c2d2f41e11f1ed59038c64b6e6f03180755c7b0aa3ab4895e0d054f1d2edc2bb3d96171ca65eea2ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d022cf8a07a366efae1df1c3ff94998b

SHA1
d6cc0c73f1b0b7894d9c94b1db62468f45f23620

SHA256
cab245977ed3b7a87b6b09b1594b804a9a513506b4db38291c391d859b7b6344

SHA512
91352ed14a4d8cf8f4d419a3b313dde5c5ca603464a4ad33aded4fb12e7c5ba1215f4e3e5c9b6d8db40f2c6c6983b5f4792b155a658bc3466a68de93f17e65a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4637bea73ba56c00b9c5bef7eaf7df85

SHA1
aa496c8cb6ccdaad5d77a586e4958c6458dc2b67

SHA256
fc1178068fea8e3b728da53fd8e7dcc727368039bd501df7d33c85e22769e4db

SHA512
87bf52945a2f934871954d236d797e90cd0bf85a4f5cb5f8e1faa52afdbd4646c8d07f0373326a0f53b1172b614bcf790dfc3616b4d091d106d43c4f05b35092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
178cd781da60eabafe9789f7049d12b2

SHA1
636e651d089260a2bca4fbb8df66f718cdde0699

SHA256
5ac845189c3ad49789a8b2669b4a9b093787acca0c372ac911d5d9cf3e5098cd

SHA512
b0e5bae628937c2108048a402d73e311c987c1d247479655b65e5429bd1711137aef543fd2d787cad4693bfb132592f333d2197d1a0e09ba4b94a0fb9d149df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
35ebe0670b8baf40f3aa834f31882a87

SHA1
b55949e46a1c1e960e66a3fbf7f1c0c0435e7392

SHA256
17185c372fefefba2ff828e327a8dc669fb957903a3817a18c00dab9e3a41b10

SHA512
1a658da8ac512c92d05202d2d889e4ce5aba74cc83a93423048f5b6738bd1f3322d2f65fe44322a24849752d2b6fc40c8005d8ff0b880cf3ca76198efbe4da26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6bb3d370a93103aa7e9f213e5c3c4d5b

SHA1
2a8e058cfb338a87eef5eaf9b88003a89cb13761

SHA256
ecc9cbb433931df9271c60a8be26ea09f909c7862fe6d3bb73e6363508bb0e5b

SHA512
763a99ac6898775f0f5684f8ac5c20a2936fb6426f424055d6c3fdc6e0ac33b25ef6f39524c15cbf109ef9cc9c828e8f0347d484b0c95ce7574006cb43547bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5fadcc7a13f5d2b69e7a7ae5ae767b26

SHA1
ddc1e18a78284a22822039d8a236d5cfd2b343df

SHA256
aafce0202349327c49d33d77807064e639620c14d775e0c2b9cfce6df29fb9f4

SHA512
4bd099d4424ec446c46da461556f1021701371f2a5f47a745931d467f7600efc33d913aa1c005d484a1f1b4fcf2c1b0b4b52271c78b708b4793f56792fcdea95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
040fa6f7e9793b8e7bbf6fd52dcbba3e

SHA1
923ba7e2508d0bdd79695bda63d517f2726ad901

SHA256
3a4bd595f20d1216e1c3e09882d65fdbc85745ad5b7585500fa9bac087b9c773

SHA512
5b0ace73c0a7060a310b76536b56eed676c5efd170319a5f1ebb90bd526892e3f12881ae80e03cef1d37fc09a26228c1f58908853fabd1e96263d91810a62692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a0d95e24c27467abf7eacdf8cb3d874a

SHA1
f08119545528398c71be6d6aba5d1f852e95de98

SHA256
8371d2c5ea9096e3ec679efd0489c02d1454ca63ac397b195a991d3e1427e54f

SHA512
3d65b0d85de761cab9e071803b7e64a276a7e9d105097752aafc9e5e4c071b613b7b2ae29cfb16cc70739779164c886ebdca9b5a8af69244fe7e6b4010ddbbc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b25f3636f17ad8eab37f1548cffe473f

SHA1
347e18e9e68fca5567290a7c44b13075b9b6e9ff

SHA256
0263c7224ccbd6c37314b994a28ff2302b5e1c0e374016dce51d3b367955b299

SHA512
c2cde88b33ecc4c924126634da423d65fb30afe3693fe89cc8f38924c6486d4d6ef187f44c9839410a424dcf035a06b9a4ccb88dbeb2c7df4d4d530afe38cc66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
afb944f6272e4694ebb9481afed9cf63

SHA1
ee19ef4c46a22e6a2ee3079e737f9c74f57d1517

SHA256
50540c146f64d520d243429252110e6518f4375733a227e3ec5721c71b0dce1a

SHA512
b498794545b2f20a63b3ab594a32619f5f631bbf9d6087ba7986f47a2990778d686dd8c28829ea560c79b2b81fe0a935ca6f77c69fda36e751aef35158ba89fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3bc509f82856911f7ea1f1de31c98720

SHA1
300362835853120698fc00b664e81fac522cd12c

SHA256
5d898a244c47f67cee5c94fa5cbefee4fe1d329cc5389170acee0c9ef03d9d54

SHA512
cde2ea7050d030b79ba63cb6a720ebb2ad3e2589b2f2c56607c5c6e48e84b92794e02340f0cd9b1ddae055c6639e7f426a2225360ffca611000ff2889809f7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2522ccf7628b16fe9889e7a99725536b

SHA1
65cebac0e04020cb8f66948b0dde2bfce0ca81f6

SHA256
911e90b14a46824fe3ef69fac46d29aa5047edd1ea26481b71f1c4ad5bf7d4a0

SHA512
56155506ca3660ced12b21c1299f7a96d978fbe896986eb78700bd01a0eace215f78152b45d3d9b2807285a2e39a6e1961b5f2a1c6b1abbc7905f6986cd38614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
395d2791b7edc599cc1ead0d4ba57b59

SHA1
a7bd9268691a74e9db0ceb6853375597f69c6ed6

SHA256
74da80c1043729402d3a1b6adcfdf07c85c1c6425d315e237ddf75c0160c949b

SHA512
21f77d631e92286cafbc12a2156efe223a5dfe8e36ca46a8c428bdf7a1a33710a96a45a65f1fa0b7f4561f147df75837c18312a40185e4fb5f1452a39ef93d25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c144c6c4713875e5bc4dc9e01a8254de

SHA1
de101dc3ff50c71fa0f5e13ef97ebc118c559a3a

SHA256
ce4a899840ed64e80eee52367c059a95c217c16b2e249a10e3f037bf0e1563b4

SHA512
90981b9a22349ccbf7a1e089867e625e55ff64a9f509c024c0d9e344338547b2723d612dcbce97e4fe73c6920150717a2b72e37786bfa0688d792d582c58c26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d4c8c7f13d7722b66c1c60dfa79187bf

SHA1
78dcdf29d68323eeb77e9b879b367e8d910fd12d

SHA256
da9e5a44723ed849e694e5584327442a647d4ff63f05924aabed8826abb21633

SHA512
8b1053254863dd0efdf13efe54e4ebe40a35d72d8ba1603d771733776fa7fb06da6f0ea2a8aa7ab4a520b16bfbc137ee90499e9fc88c962b624f78a4d0a111ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA40F.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA49F.tmp
Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit