636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_glucose_entry_local.html
Size

1KB
MD5

3189fa9ee5e017a8594ea3bfd6b979c9
SHA1

36abf30ffc1fa35bafe1151234e3a9196320452c
SHA256

b34900c40fe1d76a24c116b4c2c1dff4b983a3ca6c355c1d3c94c7a088f7f2f3
SHA512

2a0ec7f8d35f40cdb7120b70d74064ce4272fc75499d5fe74fd839e25b4d9bc979a826c69311b49fe2b3647355bfd86d583e879637645e58d4c11c1d3c848119

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050722"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000d300be0470061d44101a61deb918def2c2230ec57c27eaf0d5ebdc6757aa81b5000000000e80000000020000200000001b5c4717fefea75720e848621c5da77ba37ebcb43659df982c28ad26fe15d47e200000002c45d49e1b43e1d1be92400e16cfc5f1a1795cd0b078eebf1d15b89d1efd36b040000000501a76be64ab726132b2c9e5d739aea72617fcd209b13c8a16aee033b32d3dab9d49d1c09b299b3e138838350768ac73843166196e695f9f540a7910e66d6601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{507EFAE1-66EF-11EE-9FE5-CE1068F0F1D9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef0000000002000000000010660000000100002000000027458eed445a12332de0a3531d15e41aea746d621f9b96c18fc4786f7ed20d7e000000000e8000000002000020000000d53d7338eef0d5ae064746f0df50beffb21c6ecff85805b0c384be1a230fdd0c900000003c38a9657ced6293fa7617e4b8057f8db559fb0b8f9bba0d5f1e1980e26821b98e3a932530d124cc0e35c2de502bbd709e71258bf4e9b9f7fe227dd4aab338c5a3437ce26756eabaede33d99ded36776b8cb61d14d13a761457f834f1f176d498e8c117e2eda8d58e292a77802c3b30a34fb7d1099c79a3ce9c585aa8b5fc83874cd9b6dd006828f8ee9c845346b394140000000f7c561d30e7c1400de7874818d73474fb904ce7e04a10fd9ced489151926767d278a2aae52beb982eb9004033360c8f964e1a023aac35fc5c5781f853a8c74f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00697625fcfad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3056	3028	iexplore.exe	28
PID 3028 wrote to memory of 3056	3028	iexplore.exe	28
PID 3028 wrote to memory of 3056	3028	iexplore.exe	28
PID 3028 wrote to memory of 3056	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_glucose_entry_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
239867b3ce2372160e86e3c4d49f0812

SHA1
ae0e933b27363255046423bc23fee13e453402cd

SHA256
47a3215e18dce5fa4988e56bf280fc0d339df6bc2caa572be76545c3e3a6603b

SHA512
68558de7b15734744ad49e7a21d6896ccce3b47e0dc6f7b34e2bc0bacc80a5c31b5d62cd7a24840c22bf4d8cefc11dc62e82f68d19ae52f1d303ef99a8975cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6de8347c69d548b9b8833f6b459070

SHA1
cbbb0d68d57251ac5a9dca77d1c30a599bddb283

SHA256
7b93d3525c2d2163a8502ab6ff6448e86c548613f780f9d322e8d41e6f7ae38a

SHA512
651e04c7fb7fc94d9ce2902e2938a60f007e3c41c158260fce3879db4b57ab0d7edd4b56e0143b62307a1ad315caa8c2b969412973e404abd42e689a8372e81a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a532660b255bc6fc852597493a0fe8dc

SHA1
b0ec068fb649a8994a64e323e6e211a2352cb0c7

SHA256
96673d228f7cf87316363ea6e9f78965c76bf481f6fa2983b3506ab8621b3a96

SHA512
2507260b781f5ae8b37896c8bd0310497e05793b0f9b1af0377986f1288952422e13496858c722f1b7257a701a16e3233091463177095e68a8921965e6d9b263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8303850a011d3542773396647dc1ad7e

SHA1
c2f922080960d0ac19e3e3374caf1f3491144451

SHA256
f938e09c45c8a956504c7ff7da08dc366cb8458110fc2eb18c09c8b844115a5c

SHA512
4ea968f2f39f9b16d58d9f943901070c412308f60c85d1d56fe57034d439a4016a38d35feaebd617479a58fa32f1885c56766a144b4593e3c7c3918bd160eea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f001b8c4d613c45dc44e1eafb506a275

SHA1
06c6d6c9b949c4e590a05abec4d939fec9d9a426

SHA256
115157eedf99d59d01f87b7c77a0ebfcfdb870362a113625b4d8d7c06f347daa

SHA512
8d4b2cba23431fdb98c572a93eea0b0460c894fbf813382a90d9cca814df6c73f900c952f76858e56158e0b6d8e47d19ca3260265d7d044da6c6f72e71d48a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d88ba4484e5a66795d8ecd1adc70101

SHA1
1fc26a6376a43ca8d300032bd0b25523b5d041a2

SHA256
fb6c071faf9a3a4409a25e52bb8b995debf6b69e7789845474983f9f28201f5f

SHA512
bcca5f31261f5400df78675d8dad86e5a6396fcfb07bcf09d050b68dcbe5aaa4fbdb279a32921f0077e627a574f1f669f9339e75fe79556e704e6eb09468bf75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2df08105a224820140930c8e2260e58

SHA1
7d1cbedd1e8b5485939dbca9dfbba049c469ad69

SHA256
c5aeb315b12cc7e72c2efbf8783e6078d5b0727e867ab3f81f938f3d25a79886

SHA512
6881a97493dd1f810ab165bf9e1d97f85cb93f07ceb8fdd74cdadde2bdefb4205b1a0617180d3951615a426e7fc32250c2924504cb8efe5762a55a9605724e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cfedb5413c86cf5c8a8317219818a1e

SHA1
a96765c271f89230354c20b9c6f5bee2b002eb27

SHA256
e7fe0a0fdb1ddfe9e910de1ff5b09d3e50cc0297ed66bfb13e59d2cfb5043726

SHA512
ac99562ebd2c7e097d0e33d28a28375e6df100894a6604d8ddd63070aa5a55cc38894718a386618578b463cf6228f745b766487b237d44a1ec4b6b6ca0e07420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e63bd04ca425af58c3903f2cfb12e418

SHA1
4493439ce63eeb26a84afbde79186d9a5beba588

SHA256
7f24ff79bbf248383a7662726c2204674f7679a96c13dd061d8d3d7a1be9a377

SHA512
ce7feeecc9dd9ccbbd8b218ee5dfa187b590cebd74dc616507ac3415746f9f683278bcfc503a34df162c2bda39f7e496b3771343be7be085777c2a0841fb65ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d7ccb9c7cb6d59a69eb69948fc8acb2

SHA1
b156555b5cc64ca7d7303132cfb2c0f2edef410a

SHA256
437bebcfb930824989d80c5c331e921b21cb6bf2b2cdf2ddaaeeade08f11285d

SHA512
7bcbead460baf9cf1c8cf9970e4184f3029b0f80cdfc4fd053246b88e753b2801607f31e0732bcd4460d59f907eac2578dd8a20b9dfa059d5e6774a45092d233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8467d34040898bc8dad16ff9a155926

SHA1
63074f2b73248c790f7132e2491b03c09d93b505

SHA256
7ccd8ba07f0eaceac056bc5f52cb98535a5bf86df031264c0211c796bfd9bce6

SHA512
4ca4960535eafd7d66428d4c1492d4536df34b39634bdad60314973fdefe324d91014d18d9fd35e991a8095f4abd3fdf07bf4f9ee6f350a9292f69a4c6990f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b74c520e7f39a9666b05454b6c8d67b3

SHA1
c71494e950dafcb5e4ddd97d8da84c656fc129cc

SHA256
290355d9db455d30e5d73117f326287d9bc5adb3021b27c5ef229916f09acc86

SHA512
27c2b983369cfbc095640722f81d06540777556f4cdf14e6a5231b2c7e0f476337d774bbccc341b8baa74124758e952bd796a4de622c26335ac242e38da1fe16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f2ebf1722e94c146784046ebce68b0

SHA1
9d8e518888f6b9fea3b1399c883c13dfe30c2ad8

SHA256
2e3fae520cf3f98db4b41f48a61ebfc4692ee66d918df47ed9c9d4cfb47ed99d

SHA512
20ca684638e90bd42d6ff2f911fdfa19acdcb5e0c12a551783b025a227431f307f2e5b373b28fb6d0ba0a842bfd1c05b5969ee5bd3cba0a8e89b7c96053d5a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7407f4b2f974fafb7f033a5292a4ce

SHA1
c022059e7521629973f0cdcdf22ceb046187006f

SHA256
8dc3912dc4168b6dfec3d30ddc445931234d4a12c89cb6dee19b787272ebc803

SHA512
b0ef8729f72d0415e0d5af34c2ae82ec548868386074c83ab5de4f6c864ad526caf878e46ca1c911216be14c0a2599b8b7ae7d672d0e4d98cb9903fad35f109a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1498039215fb8ec14c25c33f35e3ffcb

SHA1
669f2df85f6a82b0fae41186b2b454fab4a6e336

SHA256
b1e473e6f6950c5abfe6201e3727c8f2da53d18d931433b06e81c0c58364d222

SHA512
cca8ed0d9185dcb6a046ad6b4ba9194f9c244163f0333c28d9d018e09b43a569c29b815d9dc11bdf70fcdb93cd957347f5ffd030954e825cd23e0bd23cb0ba91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292696d1f0a499718b2e8f4e2aacada2

SHA1
071f3d559d980af1294dade533e7043ae6e9ecbf

SHA256
4a285b82291c2f72691ef38818a17feedb8061aac99d3e8fcb474d218bcf8220

SHA512
27eeac1bf46b38b010a366394da0801be0fba1a6c242753623cb42016557e4036668abd1b867de18a441ebb642179628d14eabc0c98bcd12a32be3db367cf91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bd4f66830dfe3d55904df90449c34d2

SHA1
445cff567e2dc651a085d00797bbf9f066528456

SHA256
e8623e30477a69a4236b9ce093d85bbcd2e1b2860729c119f2005a39c51b0a1a

SHA512
b583fa59be0efab58350ffee23fabbc10d8a9effe2656155b969720eb500f52227f26e66abe4bd4a8643e543ac93598a9f998189a74338bee74e288a0351aa6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab560F.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56AE.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit