846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
submitted
25-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_glucose_entry_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E58571C1-5BEE-11EE-8900-7AF708EF84A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401841079"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000ff2680d05cb189b9e5f49c64b68352ea445b522400cacda3f75f4bc321b4d472000000000e8000000002000020000000d1f4f73aa08e6db93cfc1de0fb43139b8285b68f5f283a8467e7cd312343fedd90000000b36cd03e85591ab79a77d8c5c2316ce5b8460d620f0fef1c93aa3e8daefd6a2f7f8864a84884470041bc911bc3d27dfd3ca825b2c63a36308a8cde7426df61f7d7dfcd9c272d52442253c8935ba30291e581a1620fdc949b73f41bd60e3ed337baa1f825632e027d6b78464407905654924edb29282c35744ecd7a08f29b0d708e18ba631125dd4bb23052d75db5a5de4000000062815b03aac22c0dca4ee1fa2d5812e65f9a37a42725e0693ec12099c28e5bb21af6d3f173237342d4645decc9ea74f87bcc8aa7fe403d8f4b8fd9fd0c0791ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000005c701c6746e6d574efc872fdb9d462151a43fc614bf30090d071e52ac5bc8cce000000000e8000000002000020000000e3f52d7d7d7671de872fbe4e3376673b038d6f8502921ea2acc636bf89257a1a20000000b3e60f3f95679caed25bc1e8375ebe61d4466c2901fa65b588def6dc1b5b6b4840000000950b300ab50ff1c02ea1fbf63545c2d64fc372c7c052a29b47048e450b46242563c57b5873a9954dcc006fae70ee962701240a56b561333e1a95c73675041038	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cbd8bafbefd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2108 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2108 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2108 iexplore.exe
2108 iexplore.exe
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE

pid	process
2108	iexplore.exe

pid	process
2108	iexplore.exe

pid	process
2108	iexplore.exe
2108	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2108 wrote to memory of 2120	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2120	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2120	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2120	2108	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_glucose_entry_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053f4d9892b8cef5bdf7e6f2b13ef26a

SHA1
0234b1379846313cc956d7410711c07d622f690e

SHA256
22885536769e9efaf6c87dde9c016a3be3c30532733832b98880ffc6fd734bf2

SHA512
636a1d83104bb5a7fd70468cd5ed4c1bc4848880bd812bdd0e8fbd226ca0550c6bf907fff77e372b240d73d39a7fb3dea7d3dcc630a3e62b5a39124a2c30bd87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f5964888bfe74a4bd2374aecba41069

SHA1
c79fbafba073c475f2afa930e610720861c7ef18

SHA256
6313e9aad16e61983665402687cbde1c287540d21dfa46953b958efca2ee4b83

SHA512
8218d82722b4bdd4393e2124c7a76ce54d1954bedd1c4bd548a0005190b97ecc8ca981354d447d308825b4de81f77e45945957dda9ed27ed85315dd7e1c79147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
194123a2c0e049caa3cd27813a497d9e

SHA1
c961cf9ca6478aa7c8410a76dd2cfbbb2089f5cf

SHA256
1e5f5ea24c90578a6d4e3b6ab25784423590990bc406afdf35278ccdcca1ee47

SHA512
9c00b346055849e24e7cb1885cc703fb50b1363d64dd9117b62ac006056c588f84b51896681d584d7b74096701108b360d175a431ee8aac8a2323e6d4f7f5761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
434b1a0c3d816666306ac279f517e58e

SHA1
7cf7c1d15b7fa9451332b2453b3ea87dd032a251

SHA256
ca50809f3da2c413106da5cc7106cb23d757c48c84827b6cb7fc133a7f4dd0b6

SHA512
b96594c9a2a9adfab5873640f9d37c622ccbae8a3709a871af096ca85125a52b6e1df18a1690088bb3ccc369830f4f8b457f73810149678ee96102fdcc4f78f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e89ab6b8166d647bc6fd794af7196de

SHA1
c63b83926b057aa467313841fc753dae9f43f771

SHA256
7fdc187904670dc14d21c13745588c56cbf0b3b95d410d9d7f96116645809ee9

SHA512
bec36b3b4f6451249a53b9a3e4809dfaf278a3ff9a865ad4ca8d51d7b175fd68fc163678c9e434a4827179c1821de5f468cb52cfedd1758f117255a03c94dcaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2009ef009f3b053755b50a0e10b6c4a

SHA1
28e3af18d2bbfc7dd6d7631448fc6b3486ec3efb

SHA256
25ff6b290d5b08a5b40b85d57101de18770279420fc857139a4b36e446ae6ce2

SHA512
f1d64c80ed30cfb91ba616f501ecf2536019559cd77df57373a6bdc568dc50e197ba88d194e6d0c83cabc916c1894d6af333244ad3609cce201edcd455f95c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a056c5b8b3b1eb41fd0cb9f766b5d52a

SHA1
f915a098666caa1b172b6a41b333822fd1df0a7b

SHA256
bc85a92e5dec9ca0470b58c459301923845063a15ea55d007d6f57b7b83aa276

SHA512
21f1920e007f09a67e715882c2649db0d81e61f796f2276fe2f866d1983350455b74e02fe952962629c62d75dca7443c32cdf869c83cbe844ad709f049fb4c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd6bbb20f37bd656c1f99de4ff6d364

SHA1
f2a6b68197a0f403786afefbcd8afd7c0f552ad2

SHA256
da0a5d5b0a954b8c4c459fc481a4861bcf44fd1599c5b3c780d6ec63f5a60a49

SHA512
7dfc188045c5a72a0671973318831ccd106c145848478e601c486a1c107d803cc962857b4152636d54c1d0379f0494f3d8d8ef20301945c096773dc122bf5823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1df8f2198f943f15d697f722fc1e681

SHA1
a3781c9e7c431d8ac6040be9de730708c092e233

SHA256
9e27684b6c83292389a9f5b925a7d3fc2618a714eecaaa0bb3631ed3c35fd07a

SHA512
e7dd6d5cf04808c03607ed776a694409ec9a86605b04d76d5b92e85eb5253deaae87515fa92c787ae9d9a5b99c5471c441d712ec9f5af40ed7809aba532fad0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cee90a77ad42d27d3d23ba078286e5f

SHA1
6413b0f5f33d3c177d19a729c3c8d1999e4587ea

SHA256
bed63e820384be0f5cdc7abf8d0b0f07a27eb6303fe4b25992f4de216c573a08

SHA512
6879033bd8e6f2a235b782de339c20e2d7d5275cbbf6b4e471f227949b249113e44e02bcbf763bd0eeb069222aa6aa8c06e074536357be68f307d2efd6b8bd3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf87a42637a2d8f6d90b90aef17f49d0

SHA1
c84cedd02346a9d88c6dd98d1c38ed20b1ee03c6

SHA256
5766011c6065bcd2d8f2efba2d2cd712e97ba1efe9e1d93656c1e219025a0963

SHA512
f8b4183202f4b0e6d0ddc35c38a641f78550c796f5055b23bfffadd912d9a79675fa8c7fc1116e099c44392bb9667e3a464f4cbb8410e94f535d014842a373e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6798bdcf6b46742d493f9672a262d21c

SHA1
4781294b5b100f78c812f42c2e43742afe4483ef

SHA256
3df8fe8f12bc687841ffee75926e9317df948f2433e2fb0bfb487c2776945945

SHA512
fe06e3c223c2c142e25abb79fa6dc673d962de2fb20f938b67283cc92698aefa817e8d615389d936ad2eab793a51dc74054c29456837f02564a48b88b1c91461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39aeb0c8ab12dc694b3197849e15b1bb

SHA1
813165bb1b67dac6c1900e0a418c337d092499e1

SHA256
0b3968b4a6ec4ff2ebc100addfd20e756751c840ba155ef71d3dc6736e5709fc

SHA512
7176db3b1c1edc079efaaa2ab801849a13ce6f1cb8489c09b158eebe5e38ca181363d647c9082035f23a0b7abd2ba3b095293301c408ae0bc697c5eb8bd0a9d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3F0.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA422.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit