846a04a5a04dad7129abe56d82b0578d4e2af6d6f73cfdf9de364c001d00c24d

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
submitted
26-09-2023 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_medication_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000048ced33d8c6507c6b4885dec8f7e51ff5b9360082cf21cf7a8334f7c30f19d89000000000e80000000020000200000002b5c91e75fd97fc591bce0eeac865946bfcb1cde2ca028a6e3f4b9a992851512900000003b15655b8172ad1e73bf04354386aa8c473d23b7539270e64a2029bfdcdb3dbba0e3fb16702388101c5e060c9459b666c022f0a478a5e41848ff8730de47ffe8ecbf7d77bbeb48b7c2380947c9d3f4f5e9853df4d3396d3a4206e32aeb1d4a4086668a75e40d3173841a0f1ec329336bb98a0f8a7d5892b6189dedd54058ceb3f1e110f919d0447141df2a1842742d7840000000a1cca3efbe3e507f1368c8285ac1b9c7b67ad442ccd23bced86b32d4977ca8c770e4aa88f30f8cd2fb2010312751f28d144c0a463c3c4e0ca8083a3f83f15fb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705ec6738ff0d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401904525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000b6e01e8c9b255cae3e63d9703e5226e08514cfad1d961baed8ef62ae94060f68000000000e8000000002000020000000546a3e752cde8991fb35139796cfc22d7a200f7c95ad58650b312b409facf30420000000bd4d790ead0493fe6c56e3edd6b4877b476a52b38091c773ccf7427606264b9840000000fd6b3df6f06b8b0e78dc6dced395200e9f7d9edb1c360a01bf44c0e918a92559ac5e80251883ef4db9cc5abce6372b044acad44c69026d91bdcc5e984b317492	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EE37251-5C82-11EE-BC85-F6205DB39F9E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2820 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2820 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2820 iexplore.exe
2820 iexplore.exe
544 IEXPLORE.EXE
544 IEXPLORE.EXE
544 IEXPLORE.EXE
544 IEXPLORE.EXE

pid	process
2820	iexplore.exe

pid	process
2820	iexplore.exe

pid	process
2820	iexplore.exe
2820	iexplore.exe
544	IEXPLORE.EXE
544	IEXPLORE.EXE
544	IEXPLORE.EXE
544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2820 wrote to memory of 544	2820	iexplore.exe	IEXPLORE.EXE
PID 2820 wrote to memory of 544	2820	iexplore.exe	IEXPLORE.EXE
PID 2820 wrote to memory of 544	2820	iexplore.exe	IEXPLORE.EXE
PID 2820 wrote to memory of 544	2820	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_medication_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1444edab46a92130d954e89eddd695

SHA1
d804697fe5dc2bbe9984f1a50e64b18aed321782

SHA256
c8e1fcef27b809f30ddd604b3fb695afb5c1439a814f0affc50c7e81d91d74e2

SHA512
acc01c782769713674d8ba88fb22e7c309833d1d282ff12d785adf3908d8f83028f4d4d9cdd8d3883e63cb1e9013dd038919bfa650e9a44ca72fcf29ba91a249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd7f19324e89b3d0ea0a6907e1e8c0e

SHA1
9168a7ec3e324e04c5faa2d7e48856d2b1549b22

SHA256
0cf06d9d096cfc8d7dadfdf3c4c4a1d07def826e49e5fbafa4b99f447d8bbaf0

SHA512
420bf762c3af8523e080daea63286d32f84aa42311307b72c6c72bc9a41e2ef0d57f8e2c734cd6f1746bb76dc5d74b6f95bf0b3456885e20a52f9a12b2121a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de5c7553e535629222977ffb125b0e5

SHA1
6ab5adb609a399c4d9c21f609dd9c2737ed2e99d

SHA256
a18b1141c230b5c56765e49f62b0331ff8a150396827959e8f46e6cffc9a5a4e

SHA512
5fa5c024581eec4b7799368965abdf704344275c52742312cc34ccd5891029f9995e582a59ba1daab2dc063d8effe1aadc148637e2414388038ca4b1f4d0fa9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa12dc87a387c8bc1e5679d1500034cb

SHA1
53984e37ced74859dbb499013acd434331a3d51f

SHA256
7f04bcce486364432f435cd25e343a2726c7f7fb7866a3ded170efa8fe08aa32

SHA512
258f3e936cc98ba7e0f2cbe277f00d961616328e8dc723132279e0eb5e6d0fd1aa8610bfecea688652f0c1c4d10b6045e93e1772ad9418cc8c1676ce4d1252bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eda071d4fe1ed583dc50b78e0ace25d3

SHA1
e4e658304d370f85674192386b3bc81a12c64a18

SHA256
cc11172e04b44cbe6b881fb0b66001e973b66646fa96d5e08abc62b3ea26630e

SHA512
f9e3dcf8e41f30d029a5870cdf00ba8bd087d39259f43b737f990b717f7578861f25e05bec99d643344544f0495cd6983a974a31150a71a4b71875dd7907a101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42113cfabeb1870117d1d4a3a362ae9f

SHA1
ebfc8c39952bebf07780880c900d77e02ce13c7e

SHA256
f64bab38baddf8eac5047f83d882034933625bff139bb23609b88e592a77b261

SHA512
fb991e0c8e8cfdd29871b474c8abf954e1ca1bb3a3f32bb421b0e28ee08c9c11b743d14b2361b41acc424fcc956b785116222eaf9619799bc0dadec9fe216d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d4a48c1e8cfc06e6127f78de2d44f85

SHA1
09225ba42673dfb15c1891ca17a23ec1ec9cde77

SHA256
3d460c1356d90816f8194e73c9b5cceedb408bed915ecde1f0aa052d3bd04112

SHA512
aefb2e5e7bf52cea19bb7b1f14b8b24764bf1853213bbe27ff0389e39fc2941bb445129b099246fc3279b6ea89a5ad7dddff6f04db90ed58c0cc67af0d5a7be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ef0935631ca7c0a5af5f348f706073

SHA1
6e5f4559ce4c14f7cd6f8aa743336301a9c88cd9

SHA256
f452d6394e84c2bfbeb28f12b1fab05d38ecfb11612b9a78e4870f8a512a5ef7

SHA512
875c833931129c31da881100d510e28e578b15f7b487b0da4e1f9aae941fe427b01b222d7795bfd3acd9e30571e4119b4401d8b295da80703a40ab53edccf22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e563e50c62f554f127366fcd5c704c

SHA1
9cef17589612893335545f30c33e28a9352dc2ea

SHA256
067909a7f0754b7894cadcc29f9d429528b69ea42281e21b8a93e0c3e990c5db

SHA512
24f7a1571fe684fa6214dbb414f3c6b1168538391fe516ee189c6fe89a97c9675bb02cd66e9f2723518def4969631eb55a3330575476ed8fe1c471ce7effaaa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5baafc33ba5102e85ea42f0b35c1687e

SHA1
6097563deb43cead46531c7aa6ce400552bb5217

SHA256
d330fe8d1f964d00f10b841d66f970425fa342b9cf81d05fe12b1f80242cadd5

SHA512
f66ec479e572c15d84e7786d19120afa62bc1f9e5dcf0449bb92db8db910dfed67deb0b21f1ee33a7cf804bd152534ed042a0d85be6528220c11c59638c970d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b8036984d6094e0b031ff59f74f6dd

SHA1
ca3454a47318f40ba7afcf4dc38426f50ff831a6

SHA256
c7c8aa5b76c8d45252a97d21f7bb5aef985c3ecf309abbf3ee10c1c424b3c52f

SHA512
07c505a02c9ad4d2e828865fdd5171f77928ba9f76dbfef6213b355776a1c457e22b519d7f1c1122b688a22be91106fbe8cf2dde629fc9ec274ab3c0cdef71a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F23.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F46.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit