b7e59768071d2e1fa278737c39770d2c712cc4c7c9a631c42ae06b7acd4f679a

Analysis

max time kernel
146s
max time network
186s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CCControlColourPickerSpriteSheet-hd.xml
Size

5KB
MD5

77ce7c2080d0f2ac65c42cfa4ef631c6
SHA1

9a6fb0127fb661d519cba5868b60835617859180
SHA256

980f92d2867c93f2b6f43bcb6aa05647e7545562055b51edd7eda38a3f6e5dc0
SHA512

255abd0ba5c467ecf79a2dd90fe6768ac0b32a7896ded83f6d79ccea46e20b1ce32224d977ac333df6f96df2fadd711374bc8d6307983a90550855422cb83f12
SSDEEP

96:/y+VHP5/QO5nNHQWI/QOj9kuH7I/QOj9ksHMCmI/QOj9kvHE/QOOiHc5/QORnHz1:aYb06E06D06d902VD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000086ac03f489d1f77ad04df62e43759b98a9e3380d392b8f21f74961628b335374000000000e80000000020000200000004190e69c8d79a00a5ad276013b200bc5da29bfbbba26fed19b87bf21ce16c2fc20000000f9b0b65528bca4cd5568e57e9397d5faa5b41c21ef0ef28825b0324e0b3edca24000000069d4bb8398d3b1ebcfa52b9d85fa131eec1d8c06fc850eeca7e8dfed27e635a22340ee6e10e09070a2b6e5990a3ec8a0b4eeb8c5c908f25bbbd4025ab05f82a5	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10D101C1-6575-11EE-B489-56C242017446} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d088c8ff81f9d901	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000eb785a8e01cdc3d572f0e5c81b03ce97d7f1e0cb7e571778d0dcd02f10e20fe1000000000e8000000002000020000000c77f8d32857f60557e545268ceacf2ed6275593329f35d1f34a48042035c1b3290000000fb9764d34e6246b67c8503dd899eb6760035320fe95b7a645f73f3bba95ecc2bf23485903ba94eb40937e7175b3aeff25f80185b504c9cbb685099640307caaed65a682563d9697b29437ded5ae1dc68a45cde2a9afcf71757bed86a55b793b98a1b35635838aa25a6aa2e1cc5955a5ff1d5f1cb07336340a4e52cf2186adc78b57c1d2d2950995bff1a7d0aa7b07863400000006b68d9a3f63b2f022f72ed0a34602566492a16221d9e6ac2f84f6b068439544d2b2eb9af17d162c28b21ce1c2e4bf0a134938009ec08d57609694a1f2c06b4dc	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402888288"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2704	2868	MSOXMLED.EXE	30
PID 2868 wrote to memory of 2704	2868	MSOXMLED.EXE	30
PID 2868 wrote to memory of 2704	2868	MSOXMLED.EXE	30
PID 2868 wrote to memory of 2704	2868	MSOXMLED.EXE	30
PID 2704 wrote to memory of 2664	2704	iexplore.exe	31
PID 2704 wrote to memory of 2664	2704	iexplore.exe	31
PID 2704 wrote to memory of 2664	2704	iexplore.exe	31
PID 2704 wrote to memory of 2664	2704	iexplore.exe	31
PID 2664 wrote to memory of 2548	2664	IEXPLORE.EXE	32
PID 2664 wrote to memory of 2548	2664	IEXPLORE.EXE	32
PID 2664 wrote to memory of 2548	2664	IEXPLORE.EXE	32
PID 2664 wrote to memory of 2548	2664	IEXPLORE.EXE	32

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CCControlColourPickerSpriteSheet-hd.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f0f7220ae26f35ce75a9dced1eb672

SHA1
c063476cd9236d8d609183cde8e19a0f971a833e

SHA256
aefd696c69c985fdf2bfd48b784666eaefc19a97365fa2065ac6ffc4781cf3da

SHA512
52b3ac32451e35529aeb6afaec1d7e0eeba186daaac661daab2e6bcb7e6bdef5b55f259dd1421966e3f3e83287018764377be5080b198e05f7faf5035ec61d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1311ec63f33c8c1b57e8d810eafeceb4

SHA1
165011e91f96e30bd61495835ae985cb6a4be71b

SHA256
3dbfc1cba5865eb4ff792ebb32fa9b930d8e76097f0be17a8f0ca2b446d21d92

SHA512
c7d12d49c1b4b81cf4e8972d28e33d4b49cf2c527c822bdd020141c46adbc14182d108a7bbf8e07ac2775a8d67df9176d80e4f3b5faa03203dcfffe4b2a86149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afdaa4ff69f3879a8190ff7db11261b

SHA1
5cbffc6d93eee19273456bc18374346bda65e7b7

SHA256
d5951edd8a8d3b1f121e40261ae77692123c8ae11e58b6ba885d7f1bf687e47e

SHA512
0b485d2d231964913bc6c901b0c88492a516efbb4e2710d67c10048ddb358f693d10a7c084a499438b0bf8efd255251d30eb11e3447851efb057ac78509a988f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6681710540f6ecdbcb1be555a8e007b

SHA1
7a1da79220b00c56c2798886da3b1c7cb2a1c78e

SHA256
af145c94fd101f6a5f759ebe329a0f61fe7e51e98f2bbb4c11ad1b8a0915d3ef

SHA512
b2735865e50b201ec2a62c515de028bbff90472f1eaa89aaec412b011bff5d1aef0dffe41bdb8e0c9ff5f68ef2c0fba10e7cce82bd95da856b195bef2f2cd1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1204deebd5bd1ea2af2651f64b64ed91

SHA1
7d75bae110f4a1d2bc45d9e7ae798739f011988b

SHA256
0579b3385da321662c5cee1ee9e51d6e72f6e4d8f690a23f57cc89aeea88b157

SHA512
72d31ca56ab7bd8083d01817c5a883b71ef8eb52daacf49e4fc7229f7c8e968174139e2cd7555a8c9b485b0353e92020478eb6f82cef2e0e730e5520b841d8fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c215c4a6adcdbfc1d6725b786f0b9c3

SHA1
c2886ed9a2b66f4b8fc6d6b4038a5b901fb445d1

SHA256
2c8742fe8fe739c5b1ad3ff1f1f267015b277ce20fc93af6b84074362392e918

SHA512
bcd8250f9aa9fe8f226c531d138bc86e15a7ffd3d288511500f33d1aaef9fde88015b43ad9e40de64b94007b27fdbfe02aaae2fdfbe4e5a3961857bd55c71bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9932953f8b96a9dbc36772bbc8b2be25

SHA1
e402eee98a3b8aaa2e89b90e15c09dc258715f8b

SHA256
413698102bda293adfd34f18ff26c9be760406d711bab0e3dc6fa273827dc8f3

SHA512
1982dfea747e2b8c69a21f83b362cd0e4bce3922d2b26340ff1c6244c32d8ae0449a7638a729195e45a4aa61170494d33f897ac717d30c66944007dd91c08c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b6cb0986895bb0d3476566389282025

SHA1
8a41316be0c10ea1a464d78aae5ea873845a1115

SHA256
11491bec3404e65d2b5360ad3efdc4a893832da2ccba6b02820a88a959e41380

SHA512
34c5fdb73917c61bdb38febea1cd0a5233220f72c86255b7fa10febed730739bb239c02daf5184145188301897d42308e778614bf18cb6d360dbfb174966fa84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ec3b3e4117d878c39350ce2ff64c6f

SHA1
db2c42e0478cb5bad723fa29627dbfa4f1759b60

SHA256
f5cee7c972135f5e3f025a3e4d13f8f972361d45adb9bc401136bea5fe5baa47

SHA512
87dd4a9ea60ea464964ed42638d074de8fc88ae223ade2a5fe95d5ae8cd5ed1810a85397f404207eda97830fbcf0b8066f3a3b8b3ad7686c47af8d422b08f3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ac8428fd34422610a8b5df47f03173f

SHA1
10e037f607c2a746a958bec31b2fd05701f91211

SHA256
b5c8942b13b040dd600a79a5bdb14b609ec8bd150788ceeb2378eb333025b63d

SHA512
de32d1c9fe06a59d37427515c1f926cf3804d8d2b133eb1913ee30f66963179a26dbc6dcb62da645fc7c23e7f5648bbb4b4bb2afaf5c8aa9d1442e040b22a703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a545b5bd058a909e0c8fc3b274333573

SHA1
cd57a0f878b4e75ca1f0e947229c9b955160a2fc

SHA256
eb898962051a208c3c20089bc282cfd68464b94359cdfa99d155772fcffb7ce6

SHA512
27b8249be7437d867ba0f8d31d247a6ea54fe9c7a7b801ae73fef4cf9ceebc97b161d89ea6f41160a05acb548ebd2d09edba3d91590e7e90b7cf2117387e3b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE11.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF7FC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit