636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_glucose_local.html
Size

1KB
MD5

bf57710afa315efd25ec6a7a691880ab
SHA1

0143d6261505b4e19173d67cac2727e82b5bfe3e
SHA256

6b7fdea002cd0b8ed8b38fcc500987c39c679a27a84aef2faf58c2e0772498ba
SHA512

fc2808557caed6ada3a82529ca756fb94ee88931de032cd314f01fa675a450719f02c7ade9feb2a0af8a64a3b2dc537cd1cc33e226173424f081a441315706c4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000c01ee6901a3ebcfd880566f28d01e2bea541d99f2f1c0b5d763252b839085f77000000000e80000000020000200000003be015aa38e1a098e9fd0cb21e2d792206ae772851c3b6fb339773b6812e54cc90000000f1cd08a9691af9dff1e8fb9ef0db7cdc05b3aa170f40c495172ac9cb9da935881845bca5e32f1d4a40e28752456e563df293ccd273a28ddd82bcb5cefb4c70c1979903e09fd82b9be41c2faa2a92f9159af3a73ef45f07fa8266783c3b7704079bfbb1eccb0d1fa34a12491f042a0baa7ae85dfe0794881dfe3bf203ec734884353603a479e036552f6c2b40cbff706b40000000537531bd3adba55d03fbe555660417e69df4f914b55ea925d16a10e742ee9a147058eee393aa3445436280fc3037c8d29b3b1104dfdb91b2347d89cca66eeeaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b57c26fcfad901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000deac221eb011ab0b8b14629548fc334998fbdb4a7ef7daf61c2ccad094028e3f000000000e80000000020000200000002a2d0411abd0db8a3719406753fe36579aef9f5498fc4833b2921c6f9ccef4e420000000ef23cd5e6679c18006479087cb18e5c82921c1863ecc59eb20c49671dad8373e400000008a8de45a6ad233493921b7d0e8325d8f44114855a9f64455dbd8d80e928deacfe38abab926522d9b7e150867f5f8042f4f4e789c6f3c0a78c49d6902cd707a26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51B0EB31-66EF-11EE-AB4A-6AEC76ABF58F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1596	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1596	iexplore.exe
1596	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2152	1596	iexplore.exe	28
PID 1596 wrote to memory of 2152	1596	iexplore.exe	28
PID 1596 wrote to memory of 2152	1596	iexplore.exe	28
PID 1596 wrote to memory of 2152	1596	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_glucose_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
649273ba26a815644583ae840ee2870e

SHA1
df23287721992076abc5fe4abfa42669bad5b7c8

SHA256
6940771468ae1e5b7f35fc1c32962d562d7b636db8495756242fdb8901c9ca84

SHA512
de461cb5d8d6c7e58f6f2d86a484ea4d118158c46f8b33aaf68972872f1a91531d570d8e307e7ffa123eb4dd4d7444c744a4db552c8a601c950e928c20b51bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef156902a6a2879a6ebf35edf1da6983

SHA1
442a7103b2c04637ff7faafe5015dacca6d44ad1

SHA256
af4a68c9cc27473f91d486365791067ec0e1a897edb528e4eb33d55aa7fc22ce

SHA512
95c9bf8aee8750807aad1ca434cf80fbcf548a2b8f09ebf84b11744d7c3569e2049a1eaedfbe1536173df7bdbded6d65afd6d36b92b2ff1d9be1e1da0a516c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
268f1cf27a963845f4a16239debd76d7

SHA1
aca93b1573a841aeaeb17b3f09a92ce8ea2ba90e

SHA256
e3bbf4b04311198cc2e0c4bb343bbc7b6073bd48e673b793d48742b65ffeee09

SHA512
9c241e9dfe9003360d0f184f18ed42233aebf533f4a20653f166f79c8c80a3fc237e2ceae3e75237ea89f2d65e050ca682e3ee5272090a4b5b87360ae17b03b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0860412f6483fde9b236087a92d29b0

SHA1
b6e903ae909da43a2ec41aac70afc85474d621c0

SHA256
ea69f828b6204fbb0e85f3d8f90139f1771df4e17405c4f1480cba55cb652e55

SHA512
2feb7efa8bb39bf46c26f87dd01d49ba0d6329058c3ad5fdd97104a257b613542546a3fb513b71b7c697b9db782a350db45b97f6478ebea3bf4445cc1019314d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca352a5925e936c1c38c20004611c07b

SHA1
37af3d8e292fc06db86a4af5a750acb00bcf55c8

SHA256
215e2c56cf3331b2cbc9d1fdc1ebefe047822ef3e900a38700f3e2969c869f21

SHA512
7c068c044205cc19b237478c993d4532db8c5a0bd1d0756f4bdf718ef01116fdc8503351fbce2a176ed952a8253722f8f981ac6a541fd74b9c7c1a1843c7ee8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66e4e7c6f597e4fbc30f61e716c96f76

SHA1
a11340da1564e295e71a8c6dbf8c405ad3bd4f36

SHA256
65b79bc69cefcc72861af0c92640cee64a35169f3044ec7991d670d2715531bb

SHA512
ad7001aa8d6110bd42bb7d0e46a0f858df4e61dbcfa0943a3c33d61b96cec5259a7982046f70908a6cd60c7e07f8c40c97d1aa1826185f64b7f5792ac527dd18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a5bd717fdc9e4db2c386c8ce29954ba

SHA1
29a8a0fa8026bd237834650175f845d3d5f9dee9

SHA256
096daf9eeb6f571a5d2724cb1738993db038a60b45fd53839a04f1d6c9470d1f

SHA512
da3dffe82e8e624051dea64b7270ae2c9a473a21bdef4ef2a848b9559115c85a2efe4a0a7bfade58906eb78ae47f12813ad7a35ae3d459bc0e02b6393c03d8c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b2f0736afc17c011a9c298a351718a

SHA1
a9d82aac03b99a4edf7507c3ad60dbc58d7cac89

SHA256
a6418cc34b1b12f1d5d9431a8810e13d8403b22c61e79046b7e5000404de0929

SHA512
11f7c245f1cc0ca6914fd6a96d9947b852dabb94a61853722e468fffbe843f9d825ec0beb3afd6503a88571a9fbf6293408e73beb68d5fd4640f9b934c53a725

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACF5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD55.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit