f289b4cf6ce9e3be9df1136a91c06a5eadcf2fdd7a5fb440330c1e3657b39780

Resubmissions

27-09-2023 04:24

230927-e1rdpsff41 10

27-09-2023 02:17

230927-cq4vyage88 10

Analysis

max time kernel
134s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
submitted
27-09-2023 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_medication_local.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000008425ae0adb5e1801394fe441f1a37f11ab708c4d683fee587a6cd512b50896fc000000000e8000000002000020000000940b015f0e9f701120745b55fde248949dc4b422aa7807ec23df9275a1b875362000000079d2d5cdb0719ad7904edea85a3dff41190c7546af151a0de204561588c3570a4000000017d4da64f3447663606019ad5312ebedaadcf86a4d3ad48a037cd18fe8eb1b21caf68910d3f5927bc56bc508bc43e859eaf621b2fb3eb05be0a48cb4518c97bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000000440a64e8638d46b437663485fc5666f9f6721c4c3344b50333b9838d8157d85000000000e800000000200002000000055fc5db4918b40844d653cde3c6cf152623a4c03399674296fb2c4154984bba79000000030346f3ee311120016c4c03c0f2fbf6a3fa5abc60b901e55b9043356af465d0da8029afc7db1814862047edbad3dfed263815a87d4f42969ef2b9776afdb29590b23684111b9104789cb94f81c5b9134067c0c0109a049ddb929cd39918df55b91dcfa707f40c7aef2a1c79515d190fcc433f6b9aa655a318579b53a213515718d15f693d825ff210b5acfbf5b2a44224000000063d3103b5b903be1dc389d8a6fa0d9d42a5cab4374912b8cac522d9d34223dd034b98f87dc5b8ab2555a6c18cc67f5d5cf7b51112e98c16b624659d7d6eb3d0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106ebfe4e8f0d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FC1CE01-5CDC-11EE-A287-4E9D0FD57FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401942962"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2300 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2300 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2300 iexplore.exe
2300 iexplore.exe
2068 IEXPLORE.EXE
2068 IEXPLORE.EXE
2068 IEXPLORE.EXE
2068 IEXPLORE.EXE

pid	process
2300	iexplore.exe

pid	process
2300	iexplore.exe

pid	process
2300	iexplore.exe
2300	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2300 wrote to memory of 2068	2300	iexplore.exe	IEXPLORE.EXE
PID 2300 wrote to memory of 2068	2300	iexplore.exe	IEXPLORE.EXE
PID 2300 wrote to memory of 2068	2300	iexplore.exe	IEXPLORE.EXE
PID 2300 wrote to memory of 2068	2300	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_medication_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
647bf3f78a368079e3c51459320f5443

SHA1
b24e92783f7437ede0342577a8702775a90a79b6

SHA256
72cf0cef4251e4454098ce53305df608391b57e191384e09144b36d43e57ae3d

SHA512
1710f8626be8c47dfce0e137560cdf7390151e7e7018b2f55d8148c3a41a907189020203d097848ade1395ea4c46166723809b83c730c02be4293f2a592e72b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb99bc3337f1077664256828651db044

SHA1
e71013690c1eda38b85b16d0065f881c8a31b0f6

SHA256
8141ff6e0e4356b9c582a1716cf288be38390a2577b5fd0a8f8811163c5c57a3

SHA512
697054157131def44d112b7d8b64f6207b65067a1b7a923ef4934867bdcef0215b5370e2175b519829e6e6e54db04d5d34fc28a08a3d059733c1760f960a86c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40fc8318db3a84294b8a9b18cce28272

SHA1
ab1496aa516b1ce50547e8baad03df82cfef44ba

SHA256
ca46595b70c6b1ea41e8af819106e7ad141a9a8213c9bd533134fc942de31ba7

SHA512
3e44cd6a1b1e76f1c0598c866b344f201cbb3db0199ad4ef1bbbad52612f5cc9e0f59f7e69a833737f9ce0ddb397e452efd287705fc0cf0ec4a89b7afee1777c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d4dc76d20e62027de2086a12ae17fb8

SHA1
e865a9076f03a1a9a5c68fc08536e180c38fce91

SHA256
69d3c19d02ef49d232b425d64cac5d72d38e3c6f6f735f771856e23e40069182

SHA512
0b9bdb82c9bdaf2e379fa574501144b49779cc083c95abc8f2039787dcb8d54b9f10ccebbb5383f928309623ca8a316b8db8c1a0a4b07e9c89698212943a03f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f35fcf26dea36c779ae3977ff0de937

SHA1
e3e003b539203f7c0e56540ccb83105571d6c08b

SHA256
902a18c4472cf0081b3c2b02011f8095c97e0aaf4776aa5101031d3517a6632a

SHA512
c3dde7e3bc2e467423248646f17e32b81e37890fcbb370600793d884d7173bed7af39c5575881e8435a0352c47e9256bfa05664469f195ea04a988068851a136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e770853e3cd357fa1607277ec0940b

SHA1
3ba7b637f36d69a2ceb357da50e1b7c0a6815233

SHA256
bc79b96868c861d18d22823791653a8635fc39420fd2e54f8e973ffeef444ff8

SHA512
3e661979a6a5f2bcdc7d101c759c93de263b3a27c343e7faac02acfecb924c946199823ad5d836374d831f98b5c1ea3e9f71fd919c3b26f2eb4d5d6b4aff301b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90835de8a83f250f139bd7efb54daec7

SHA1
add862bfefa9a2fe6ea63e2db8a744a199a1f769

SHA256
77e01c39a94fdb6d7730f99bae0af4b64e0869a2c25d3265d5f823c89e068d7c

SHA512
7cbbf29bd06b372475a73cfe9354705eb4a15c4b70701f88350cb4423765731bb6ce13983d0679588c43ff33b6e415f717067326d7abdf8853087a8da5846e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8212dfb7bc94f0338422e221bcb4dd6

SHA1
9c53086ad6250245fe613bb05c722cf749d55921

SHA256
ecf0f31b6afd02cee9204ff21ac1c57776ab3be81378016c72dfc11dcf12b55b

SHA512
79b2e9312a74b57b2fb7669566de25ea5b8c2d5838c332eae89c6f99a40ea244d3036536eee89931a0f168318c443dee4152c3afb289964ce0ca4e094eddd5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d69ac4cee0c2ff4da0c6b62065db3050

SHA1
beb93d0acaf4b38f4761c99bf8dab050e58ab086

SHA256
895dead307001b07824dfebd18d9e7e2713a78656584939a12e9997799463715

SHA512
7be5c7a7a34b4e5b9eff72aca06c8f0be132570a24f496e600d910fcdb2b540981bd7dfa1fe2e7da97876e098f6e5d93dc60e9244fcd5ff42b2c7593f5722eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c2f456fc0873bb55a89c3e36b924d4

SHA1
397c44bee47f7d4058d6b16f350fa841bf03e03d

SHA256
15bf414c6cb5242601ed8d85740f7d42fc04f53e23c2be9d8328f6677b1867c6

SHA512
47b860c34858e0eca4e8c35dffcf1a6de6bf03820f22b8f7f735763ffea04a4a84d99577e618a412eb3900ad5b58afef076cc57c1706ddc32113f9dab1d12f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69AE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A2E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit