3272b29090b0fc96acade796540f84b7d284c665cfbbe186b7e50646d065d242

Analysis

max time kernel
118s
max time network
193s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

localappchat.html
Size

2KB
MD5

5e6a280dcfc9be1daf48983ad4316a42
SHA1

eac5cf38fc0580237d522f54ab7b970dc9e9fa30
SHA256

036336385be7e60aab69d26087194b7719b6b04cecc8b43b27ebab52ec95d596
SHA512

39e99d183c020e08cd1d017215b1a1950866482994f1b045ffe70cc9995bd02fb7d407d7b9d769157a6258da6f9db4155b0f76056f21405b72530f49e5172ea1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000816ed6542a3c3032dc80a8976b349b37973a14e308217abc72d9fb7b5bad3ae1000000000e8000000002000020000000bd1d4a07a3a9741c8d5b5a4bc77e85a1ce21e24cbe4468b959716fa9c300257a20000000bd928ca4b03d3b5ec02da4c906007a4d160c3a69543a2a772f9b8e2aa6ace01640000000499f2bb4320dc6d08ecf410e811d3fb10bc4b7080b4dcbcb8948e5e814d06ba317022bbf1ec59635c637ced1775d236c08c7ef8dfe7ff73d27bb303e87f839ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7ECD53E1-6598-11EE-964A-C6004B6B9118} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005bd856a5f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000c2dc2adeb76c5a898256e1d9f5628b9e9de5dbcd588510890513a5c539d20d3f000000000e80000000020000200000004a660e1a20f9604bfb21fa88686944ec2f3e575a1a4baf629b7d74c8a4973d86900000003b8892f4d2456a1fa29b37f1186175863f1a9178e66593216dd37ece75ce17076332d6422141554c270d852832b4217e2c86ec65b53525c51604ee829a5942c4101e3e83a8219025cf0d0e950c399762a5dba3594e45ce421580c4da24f75b9e9000051edcd215ac0b684e71fc9007ecd66d9ab3e26979ffe6cdc633c6dd87a2ac259594e6cfeb8d57096b6baf57bb34400000005592d5729cf973735d36891784d3bec3fdf349feff9a32b2932abb205994af9ca21f6ab5c782efbe720c731bfa5dfdbc67bd27a7c07f723bfdd2b3975aa2ed80	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402903482"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2644	2752	iexplore.exe	30
PID 2752 wrote to memory of 2644	2752	iexplore.exe	30
PID 2752 wrote to memory of 2644	2752	iexplore.exe	30
PID 2752 wrote to memory of 2644	2752	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\localappchat.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef82e7dfb515515d4af0f27cd159bdd7

SHA1
abf0cf280f9e1a7c89a93b1aa966251f052f92f2

SHA256
c6c20cc1b34c57a7f9ac745bd6f74b34735d641b81d7e8e7b3f60f3a9e0eed8f

SHA512
81e05ac98a0d5a93ebb393a9464a7ed0a573238330f2fec1d929b6c3655b06324716ab07d0f954e52ed7652cc57c99c96d9418bce87713c99624aa519bf9c969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67eb6eb93ee902f211343631320cae17

SHA1
9486da9906a6e56e643ecd52dbc25295f7f30d74

SHA256
1276c2f9d3bfb54a707c265025821b6aefeb81194765ac4c25a7c72ead184d97

SHA512
d623a59fc87606375f818d17e8df7dd6cb84b2364b731ddae97c2730f722c40d61b370c5f53c665875fa6a58caed4b24dc5db6156098ba81810a2909af79f2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d8d189dc5c88bbca015ab27c9f1bb8b

SHA1
57ee18c46b44ea66699a2880c6bb2e0c7aca4399

SHA256
57179d0ff35d3ab3f226b536347fea2a7f75512e036f99c9cb37cc398b368899

SHA512
63771735b055cf10fe2b0829cf67a0c053bdee8d2acccbee23ec75e94ebf729290404e8b377e8c09e62fcae3ab2d5d120c2e1fd839060750edc871020d240793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b659755e5e857643cb2744fcd18977b

SHA1
44ad4b2310461046e28e0de153b36e766c041d9f

SHA256
f1e07b02f057f1714171e33884cec71338a2dac8b071e05a46c5ca71ad178c36

SHA512
4f6dbede89c5e45bd936f8bc87e2e17570358f16ab83c689be686bc7d3cf17eb4c8aa15caa3aa7d062bcf5ff27ff40d43a12e47bb812ae008dabe0b98ba4a721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5220f129e4a1a001ac63cf4a97217b9e

SHA1
8be81342b8092f5cb2ab29a8a4257e7a010b57b9

SHA256
412e5ed56ae6476a715cf057be962a031b6fc397f7d54f777346eaf2861ff36a

SHA512
d4b0ba0e38aed169db7b72beaca72f3d27f3906414904cb04509ed4f71e0f74e71331705834fee597f93e28e6a31759d812ac9957b22536ce7bb24a08b504554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9003be157ec8ce3e0a721b99c4a529f

SHA1
d2aa4d46c9af27c866725d9a2c4a21aa93afbac5

SHA256
433604cb6f4d8481718c3f02bf3df83f08cfe372f26636b09044800ed17b2c79

SHA512
7d6ec3faeee81c6d42298d36fd49f426143e8579a70202e6d96852c8053f82e1ef1ae2cd32db0e288037b3a835b9a5b61e63adc61b23be739013f0065944c8b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17b56901b3e95a2d0059c76f9e19446

SHA1
3691028c988b7a252f89b062c388eb3c03c3381f

SHA256
e612c1e61779bb75ba7655ad79d4ec1e66282e25bab7a2a3f0cf08f6259d4522

SHA512
4721670b43e2fdd9eac1527bada86e43736f3620d34ad7663194c351d208d9877fbb700925317b797120d5a157043ce546fd95f73e729e3be1807606857d892c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d5a63cf448aee89d23fe5107185058a

SHA1
c500a3f81b19383169a63919332f83a6a4a33a49

SHA256
089d3d9cf6070e5e45472ee62155c4a47131e9c16ad285e32965adbeeb02b99a

SHA512
7bb18a1791324cebe13fd53b8e80d2bedd5d9ea367a908d4aaf02c62a3df434b88c66e5adfca418f0100c4d488e465311baf27c70d5faa54887db10d3d4cb69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27f11fbba3490f6d7aaa02ae80e27d3

SHA1
8c4ef28ff10479ec76ebdb62026a2db02d143a15

SHA256
96c85a02cc8cc1df9c34a9565121fb14c7ba2edae4495d3b6f55cdee50f4ef75

SHA512
4b9889bfd245fd379a592897b888d776cdb06d78f42dbd4fc2b20582e46fb9421941eeb858b16b1f3138815facf9fc64ed32c7f66fab5f33fc110f6683764ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45814bd0f67bdf133385499981d96346

SHA1
05b6dc6065e36ad84e07e557b0af41dc6dd9e2c0

SHA256
931b8fadba28f3ff2433b8a8170f92b895647e05367a5d252a3d1f620e283472

SHA512
7789b634f0696a6a57d00be5cdefa943782694edb529c4601eb9aa3537e0c0973198c0dc8eca1e12e662026fe46cd9f2767e3ce75adf635b5c461ec34dd86d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e7d9730d51e7a6cbad61a4521c9d26

SHA1
a35eb42fa3566bef3555ecd06c0f5c4699a1402a

SHA256
882a8e8901e2a86c7bf218ed3177ec36b7f9f8c0f55aef267812e08d97f3c4f8

SHA512
65aec7c5ff6b64a7d49a6aa60a81bbe1ac45c0d2af9acb18471b4fb5f19ce1cdac08750ec2bff0f3c2b45fff37ddf9774d88fbb758fefe24ba67e21aafa21ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960295ecaed350ff4854ad2a9ebd40da

SHA1
a7a83cf6cdd82fba148e107d29ebcd93cbaedb7c

SHA256
9070010dee04d0afd7c1262fc8952170121ad9c5d3a648c72b94c2e5bc5075d3

SHA512
51a9d63662fbba26f6e74e52ecda66947617e9285f7c50cbb9d9c2509e29c1142dcd864615f144a7d0a98c82f10874f77c909b7266103416ff97607b803eb6a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
102278b6b17124be8ec5fa1711ad7e04

SHA1
1f5108ed79d50b7c87fb07735ab1a6fff95c23f5

SHA256
db750774271a71c4ff1e29575e238bb28d3b3bfcaaf1facbea9a40696ba237b6

SHA512
2e505847901a89dab1a53fb58aa4bdfa2b1bd5474f69b3c4bbe79ea7bc7648a07d26577e3a9e72c419a290fb6ec5b4326b01204a363e3c31713e95dd3fc39898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
269409c9e380508abfef86c2cb4b1bd6

SHA1
ca7e1a5ea43b9ca56f7a57340c708de792f4223f

SHA256
0ed4d22335447586dd8d535f1715c0d00eb59fde1d17e25fccca216db85aedef

SHA512
e3fa6ce8775e2e9ad9e938c8ad317376fd90211236891bdbcafacf144fbff05a80a3c728488e574f3e0d524921653fba5e32556a7a84efe0fbe94e1359079acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63C5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6407.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit