e47f973b2e997059589fdcb011e2f6095a1251ee54daffef56e060046932f79b

Resubmissions

29-06-2024 23:51

240629-3v89bstaqn 1

29-06-2024 23:50

240629-3vnbvszbrf 10

29-06-2024 23:44

240629-3q9paszbld 1

26-09-2023 13:19

230926-qknhnahe4s 10

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
26-09-2023 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HTML_Obj_list.html
Size

2KB
MD5

71274b421d3cd7646b01f3b9d470d04c
SHA1

47d5fd4647a5948f1a00871f6ed0dc602230b642
SHA256

c72222d06efcde95006dd8e5103ebc74c9a7d0d0d1aacdf62a7e9aaa4a13d1c5
SHA512

ea237affda8714265d40edfe04b2f1b6ebba3eb0ced12165b831be12a1a89b0e9b87c43ff723da12323d31d497345ddf570c7a606cab8227447495800bbd486b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000a4e619664cfd8f6b3a850e87d6e7bdbb3d57f71ba5842dba02cb8b7b22d073db000000000e80000000020000200000005711eaed2518ebd953ad73bfb074cc52407f91d4b66022e414541105c846d1192000000074d7c28b95a276bdfbaace6e52b3ef40e108ca8ebf6151ac59f9a87cb764ce9f4000000060d6c3b538f2417450262607d0529c19c199f9568c1727918d2831ac3429f4b7cc0e2fe5267961c21537724385c67c37538df6d3995d23fa16b14bb2e42a7810	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c40b2c7cf0d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5222DDB1-5C6F-11EE-8490-EEDB236BE57B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000c369e54bfe76ac8be22f8425eb50f1c1b48be4c7467622d382f1c5ebe8b04e3f000000000e8000000002000020000000c8f606ae2f8807e5ef2c93acb7134e9a44c831381a26e9d066066da4878f4c40900000007a0cf531dc990400e3b1009e9bed8d84f11bdbc7dad69ba89bc2b4a6ff0dc1128bfdad8000c52bbd445f828eb3dfc79cb6f455faa43cf2b059dceefd7faa989d51f689aab71e4a9e3e717caf0af61fbb3dd1dcbc0acd20103866c3aae012802ff20ec66af345c6d317cc0f5470bc840db8015b1972007464e11776aa755e6d2bff4cf52c749146270018c2fc54db53c1400000007d945b7f41bc6bad18c957056a2b24beabfa64814bea126d9c4109be8e4330274d9a816914c0bd35daad53b19615d3d445d2705cfe595bd906bc925a1bbb0e2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401896236"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2380	2228	iexplore.exe	28
PID 2228 wrote to memory of 2380	2228	iexplore.exe	28
PID 2228 wrote to memory of 2380	2228	iexplore.exe	28
PID 2228 wrote to memory of 2380	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\HTML_Obj_list.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00c26d8e6b66d2f00141a43a83487e3e

SHA1
6493f1f64eca187f2c331b870b0a42d031e1784a

SHA256
7375eb92cfe2fc4d729215359479a30ecc827b4e08e2d2dc88cdc62814128410

SHA512
4d6157f624fa921f2dc6e7022eae94a8ad68dc8636a46ee95b516dd4c21928d09592c7a760935cc368c5a005d1d37ec1d77bcf782d75df8312caf224d448c0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f93296fd3c18fd9132c57931886b499e

SHA1
22845081920a1ff4344b616605dec112e67e0feb

SHA256
717164eabefed6fed687e8edfef050293aabb9d7cdc53a96faedf625960ca0b5

SHA512
b088e0d64d256ec30852a0fc5ad29d4bf5c7b90b4bf953b724c25afdca94b8edc698a90fb6fc5f2c957f75adfb842936672c7993ae445c0b6affdef6d9bc65b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0eb4ab2af2fda7add6d280f88f82b6c

SHA1
2f765e5315c9ec6d29cfa3fec85c9c3b6bb1e77d

SHA256
08c030a3bd40f7b014653afd63cac9df50c95a0018f09e293b1f5b9ed066380a

SHA512
163ce664222f760e1c13bf0a4ae22a82993d112db0a1d03dbcbac2d6bdc2bab5ba249fd1a1f8dd96f5452c665240cabdff82a2055fa87fd892dbbb2598892490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ba7c5e833c5723d270d94363d27b33

SHA1
ff17f73f85eec1d7acd09654e36eb73799caa306

SHA256
2a025dcbfba5b0196214031d40d6b98e296d0c41a529797f2298e00de1e71267

SHA512
7c28d0bc7ba115b707378a252c6c51cda866f9430b3f5bed4b08d442d21349b5b6568a3fc99b0226f521a87d3c9d776ad84c5f422abefff1490240de61f6fd81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b44e8feaab7f716d784d2f42fe0786

SHA1
c5a5f473ca7e8ab2f5ad1d0ddbcfd33a95b1b28c

SHA256
77a76ef7aedea12e2d46775c04cd02de69d329a84ca2bdb0e45a7398bef68781

SHA512
5b4378f8de28eea32607fe1531516c267fa555a1d1481fa96a6190d1d3c371af059c4d29b157b8a8cd6dcf935d5014a2b2043aa874ee66743f10c076bcadd904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f71472bea6db7849ff60d010b878b881

SHA1
eea5f762dc2d0067a924fc82bbc42dd4579ff948

SHA256
a1bf586fa1bef90f7d68977226848dd3cc1e134eb85566e2c757649a2c88b07f

SHA512
fef0defd24fa691f068a8a489ea83c9506e19169d9580b4795f01a079adb512f10f23505525a6909319642ff0ab519ae7c234d6892622e44b9c86ef0c99302fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
168a20a33723028b120403afdcf1e278

SHA1
bd27d72831e8438d4c26127f3698f4ca0eb5b29a

SHA256
e1b3dbac626829bfc5739a640f43eee6af5dd6dacb39492e2eb93b60430fe57a

SHA512
c1d9a899783df237e0861c27d82b3b42f66a7c16bf55096843eebcf91d51ef53d8f725450cdfcbb393c3b9c9f077658831eba790b611ea43ccde380295e88350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9af00f1b10df8a8c8d505621528f0b7

SHA1
78a398a66754047818225130217f5f87b5d015f4

SHA256
ca865d45616288c2e0048f76c91b1c0cc3ce89762e98d77330a7ddc3ec09b45a

SHA512
60bc185e0a537050fac9226a896d973dc8dbffeda957961b117ba3726d115c5d118ac1c2d8842540705ec6ae0627f3009fb4f79b5d625c032b16f12b6818bcd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b77366ffbe6e1068a030f0a60952821

SHA1
cda6e093d67dc947f444ace4eb2e5dae2164871f

SHA256
c849b981ac2c42bdd1ce2f8e7919149b858dae4e52883e0d7343b60cd3cd2e0b

SHA512
349db82d413f54785dc16aea9329f2f7d53509c2aa7c297619fcf1030760eba51845ece17bceaa2fcc5b8e95239079e1dd8aa7cbafb2b4bf3598d72057a9ccc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eacddf9de4008540819f18e79a595fad

SHA1
38fd6c68e19b6a832376c929b5e91a39549adb2a

SHA256
95ced2a685ec9b227bafb507793c9afb9feb14a7b03490ab093aef3393c02d93

SHA512
19875c084b9fc64f91a438ee8903375076b1f022ee99bb10d173d017d6309095647503abc9ba59af6a5912f305d07ce22988619279d0bc5985ae40b13484aac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8497cd3b2ee63fe9b770bcefe860ae

SHA1
f3979e98dce2f22505f66b04184c5009529c4c75

SHA256
b20c96309aff4c74660ce22ab8fcc4c889070dd7b79c29b043f614f189d49ec2

SHA512
72f71f16a11196abe850c3cd35f4d2f005cc00a4a4671e1780660892e07b85eadd050619b6da695cfdf411b40c3f9596e03277a431c5d7acb0b00d5189a0590f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
851408db3efa549781ef5205c3598941

SHA1
e0f7ff5fb65e18607814709a0497ac2e7dcf4aad

SHA256
4e6f03156a3e4fd4350b5d3845497f9b4b119044eea811748748c395cebe9759

SHA512
621391957e6d7fe9bb62640704de8e20e5f7c7f9bff991089390ac7691cd17a532d7d445566968ecfe22edf88538f50f0668cb7e5ca02d283f7ba5c6923c1e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55d918a0c0c5d316c00182cc0ba6403

SHA1
6ea1edc50f753d4de10a3407fb6d0b42b7e6efc6

SHA256
7e91e95d78ba6e39f6607c3d80b4828e066de9dbdae052c92ed6aafbfbb4f0a0

SHA512
2bff9eeb9b52484cbdbcc30788e0cf5c472eb4b639ce444217b9c8db7454cea91b45fdccfad42dea43430a91a4198e53aa3fe68e3ecac54077800dce78a9454d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f327859d674de0360e2e791ca9956f

SHA1
a862e9fc7c62612ddd46852cc519fa264e3397ea

SHA256
21b414193f52e682bfa0ab57c60e06b9a01df0c57aa122cb1219baebdaffaca0

SHA512
81b351e18531a409d59e0f1069620e42a30953d720f5e90c1704b8283c2e226225a916beade69572155025005ac339cafc395fac1a77a06ce069b222d399a65a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289f3386c76df3049ce20b3d4a6ccc4d

SHA1
d0cdf8b76d300b838126b6ef1b2b727b93649746

SHA256
f6d3cb357ba81013b541507103bc5d4b241a3a433827bec4e7b87adb077f054c

SHA512
f8109e7f636f513f29049c2c24893ab880939a83d2c9d5dc3ffa1059d805a91caf3821a93b62784167a368a6b91517110d6bb51451d73270c96e0e4d642ea2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
151e148143f37d44ef7fc5fb5b4e96a0

SHA1
d237a98652ecab6acd71e1297360cfca3254b7ee

SHA256
ea6c34610d38728311d71cdb27f756dbee4471b821ae90e58aa6f9045509e542

SHA512
eb684ecf8231451a66867c7970bc4e10806f3b2c65fb53fc1460dd037a0061eb555cc520ddf16d364adf95aabe848d433987314dbda06cf25de2373ab96562bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8f84dbe74f5d308b68d6cf4d55b3df

SHA1
263961c60046ad2deed89be5b333ec958c6e72ab

SHA256
939b827db6315335a2ad97dd561c8d927021bfcb2d0f1712859275c67448e70c

SHA512
78daf7efcac2767e5a6a04e007339e2df22a4c830957489659f489d5bcfaf19b722327ba362b6b98982e9deaced098cae1c3d388cb590626817d9947cc2aefd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC748.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC799.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit