846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
134s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
submitted
26-09-2023 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_labels_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401904528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000018fbbd74acf007a246e486680e0f806670989ff72fda69048c1883c0394cba6d000000000e8000000002000020000000afd32daaa71f3b9059170e79a06ac9c1c0f098e6bc258ea6a4de7269fa551ce820000000306fe116be240e40b2847020195ddf300b530a81908b8227837952042dc37cd940000000d49e25905aa519aba6d2bb2e36583b46221000439d934a27292d412cdfa47299a46060a28a697180bda66f8c80eef994f28c6433bb0c856a3808a3dde9cabca5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000024978401c8c5a14a1bf79a1e0926432bd85b29c1f17801b7c5171b93132e788000000000e80000000020000200000002c9bd2218514281fc4ad29d21ee9cc00c048051451ddd584e8219e76f6a6767990000000e25dc9961e4bf38599c0370d5fb7bf1d9711b5d7dc3f28573693953433d48bfa134e91775a708b13b15ac5ad6ecd80365c0ff90470d253d614a919025e20b6168c02fd7663191ab3bc1f2a052ff974d2b68e897e5048a783f019626d247fe65c9df16c0068228348879ba7fef835497aca10b6fb6158878c5bd9367b53d5538d1f189c9a0683d60dee16183ab8034e2040000000d45ca149b156452d90cc5f8111577cfc585471bac58280ffa38752c82595b4eb71442cf23c8d6cf8d8127c473e3e19be2f0e9b28d91466a81e33bf534c7cd23c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0B95361-5C82-11EE-A690-7A253D57155B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b5cd778ff0d901	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2276 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2276 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2276 iexplore.exe
2276 iexplore.exe
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE
3040 IEXPLORE.EXE

pid	process
2276	iexplore.exe

pid	process
2276	iexplore.exe

pid	process
2276	iexplore.exe
2276	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2276 wrote to memory of 3040	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 3040	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 3040	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 3040	2276	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_labels_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d216667e6667b1ff8e40cb712f87c81e

SHA1
b4933fdb8a7fcc512d769558345c33978654bebd

SHA256
404fa0f8c57e0e4b38eb254b2ab731567749937da7d84059c159d602e168a26a

SHA512
2cd7f1eb6b3d9318b5cc0ecf794237032b7e78a46b7f8a92ae8b41d2ebce3e433e0125cf0cef770cf475a55a7a2631fa35b3165095d7a22bfc30dc9f236353ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298eb55626327d04348aeb90f077d20c

SHA1
2f494be6f8bd716bb579f87acdd5e75b39dd0a48

SHA256
bcd1c8181efa257d5773dc4e41b5fc90975fb53629345a9f5b523ffe10b7af81

SHA512
d0adfcc8cad156b1b307cecded8fd97833df8f482dfdb011cefbb870084220ab4ad6d0fcc0e4da3bed25b318016b2888f02b562a5c9907fef4f241fb5257f52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79c2e8e3f3927a5381010c1e10ab31fc

SHA1
08180dbb166590fe01e7030438ab99fefcf13d10

SHA256
8f8a7ce13e83a3fe23046577c15c5837b16cf3a3ad316c98842b179acb98570d

SHA512
12dbde52eaefe680cbf6577035a7b302e396106ae22f0edbf92756c58c25ed6aff0ef4b717b3d9a3dcca307270d1aa455919babfa665f42cf048608337162491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e064ec553f0991a7fdc7088f54d8a5

SHA1
7d04e44c49dab46298d2d4450560358ae81cf1fb

SHA256
1d0e2b457663079fe400b3f91b60fe02259a8c995a027a0c7db801288ddc4493

SHA512
57868ad516c8d047c9cc7ec1322a13068de39a2bb41697027d79834bdc80bef9b70712b7b9f057e13e289fe27e5481b724a607cde8785ff2365881ffed5f4e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244753f2c57a9889cda30c761fbd0cb2

SHA1
12f2b11442bf2af0ae0bd5da8ca8206faf165aa6

SHA256
d2ebe05703da89424ffdc0f78f86f84301a15986fce5c9d64696b7dfcd2f5fe2

SHA512
10deb03a25c7e88104a9e056276a09a95296df6629610e37aff45291b6e0587ba7b2119b15cae4600063bc5d33cccdd2d7b2880f26e2a454728db0bd4e4bc9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68a91b4bdcbc2e08e3ebe6f90ce1d0c3

SHA1
f573a3abe0668b733cd9c35ead15341879f56d1d

SHA256
02f9c70ba61c29299fe24074943eabfed43843e916e5d851729a8a329a19cb0d

SHA512
e7cc95ae617a8416426ccae20e0e6a4c2f56c3465f9b4d9ad0afca86045ccf8a1669d481d719774138762142d976c403c353bdf365cd38b734f9f1266d01bb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f2bcaa3b3ae76dab39f3428373518fc

SHA1
f9bc476bd40e4424d7882e7ebf8b4e2a2b026f69

SHA256
4c614a588dcc5d46da94262e47ca8bb14978f9f279808d93d5459e02c2d98861

SHA512
4d73d3b4ae279083487417a7a529bce60959f855656673d477d3c78bba75272c5b96ef5cb39a1cfa69b72ddddb597542f0b352ec6a8c038792e0c4e8496c8158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0cb5c37f2772452c8afdcbab657941

SHA1
a8b44a115597622fd6669f92cef62835e3cd36b4

SHA256
90bd10ed8291bddcdab17988094830da244974c58f66b830a3c7985be9048594

SHA512
1c2c8b1b0b370fa10a30ade79cf70418ae0e580677ce3d0651a2c2a1aa0600f5d91a9c91e2ccb455c3527b798d0ea67bb3cbb000177eb1d1483af26edc81abe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814816ec9c2da5893371cf99e6c5829a

SHA1
de2f77a714cafbb9cda29d979849271ea0e51134

SHA256
247a7cb7131049eb0bd5053869955131158e2339f9db9c370190d3ca04dd4760

SHA512
b8e986d7c2cc0dd9e2107cbb98798447eef9974b6de5d1bdde982218420f8e384b500fa3bfc611ca2ed650b3d0ef41cbf926d054e8045e9f460cd4570bcb2e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ddf346f1c930d08f2f1e38b434b55d

SHA1
93cb535d801d163a8bb10381825635899a9dda87

SHA256
7fb855673ab45a03ba0b6ea321bf524c19b7839ef44a800fc1b0b54dbea1b5cd

SHA512
8dd36762504bbf8fa7006ca94af32b89515cd9280e26bbd66cb382e766a5d555e405c9735698a1cde4c6e37a33339db227006c55105f9db2c6110e5928d95e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC801.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC854.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit