636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
123s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_pressure_entry_local.html
Size

2KB
MD5

1cdeabe6877fd1045588c42a174a7e01
SHA1

376b5eec8b187c05c562e65dea56622501840f77
SHA256

2f1b3beb96e982fc3a873335c5117682f212f870d5fc4ee6e0e9c2f9e861f2db
SHA512

b3ff351f1ab2a406f8f1b01d6f8ce58052f5edc5307d84c331febe2c972fa3354ecaae2da9f97e278666692ff56a80d020d49c587b184307557b8adfcff234be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53D46F41-66EF-11EE-BA84-F2498EDA0870} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000846f70ae5a5163f60c922717b065d3732218b9ef238dd2cb1552ecf53adaf1f4000000000e80000000020000200000008363d586e61034ed8b2c6dfdcb6c1ad73c63a99ec64303131c063482c51ae2ce90000000879be6163842b14cb62a0b0defc1f0f3d2aae1a4b7db1f2c6b896e7d39a2cd84e643e34faa9a6e6632fe5299fa34bc3cf0db8805c60c2448fa456029b4e8509cde94c1712b7201e805409e51a354515a1a75edfeb35b1c2d5401c7d2032195086e7d26cea0d2478df682bc1b8a343a96906e84ddf0681cb1bff2cb06a91646276268a6ec5356ce32c07407f634895da940000000cfba2c0458e049f224301dc49bede3170c080f75fdee8d0dcbc0efc8bf9b5f0d766ba93f91cbd21f26c888a1e7f1fbb9b5c4ad392e49d8ed0e0acccc0202ff17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009c112afcfad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000dce4c3835a6b1f5e8d607705787ca99d0d956586bd5f8ae6db1e8456650956c7000000000e800000000200002000000060604b336a2f28b4de7520b95efc7b59cf5314d78def240bf81f74ca17136c0820000000e1e52dfac060157174f271a5f4c0087852c23ea15faafd06b14acb5f8c3f5069400000009428f1bd7ed4cdf16c1389497ce77da0b20efa23c781282aad72af40746c47f0be62808c95fcd3c76b334f1fd9413a008de717cfbdeee30a0c5b123cefe0ad70	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 576	2072	iexplore.exe	28
PID 2072 wrote to memory of 576	2072	iexplore.exe	28
PID 2072 wrote to memory of 576	2072	iexplore.exe	28
PID 2072 wrote to memory of 576	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_pressure_entry_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70df132cf3e140ce791a094ef486bb81

SHA1
d50fccaca339ab4d405cf8e90f4934d25bc63453

SHA256
0cd12b28d42e8a54c90fbc840d434cfff3fcd6499e2da29b4d4dc2009063ea7d

SHA512
6747fd8b2bf392ea6c24374ab75bf8fa9823cc96008792256939203af7acf1d7c46e4c2b3cfc0802ab4ab71cc414862ad627b161a691db40e91ba8a04642a31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef98b1c3fa4ac013b07e1f9e6c290a6b

SHA1
47b3d79a55d8c0cfe964000cc2df4ae7851a04bd

SHA256
b087db3361571011ac4d63610babd86be2ad89fe7eb34786d1368d45dae17570

SHA512
d6db0dff90e5fa8b8477f3fae5dc95510f29504e939170d8af9189a44a20925c5a20c131e6227df6ce37f2cd7794fb7ff787a94e75502b42439a2f7f447b2902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad1ac71fafc2e5b49a2b240dae9e753

SHA1
9a92f0b093f0633b18d89c399f142a12c9891a91

SHA256
c79cf20a4f1da62214b3535807a128bf492918235ddbeb7b8a71794129ee08cc

SHA512
523e42bf97dd0a01f319ec168770be22dbc7b13f3cdf0d33c702c6e75453eec8d6c74dd1bafa3d05cf5ae67edce68b0fff8b0953aeab25ae658c875f2a41a26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af47602ae8a817cb22a792be8a484518

SHA1
b5e4680f1a7fc41535b95a364e2fad32f0543c56

SHA256
0cde9d72f9981a9c311a97b17fcac03a4961866b2f2986258f5453f17b39c389

SHA512
2e067de36a05d042764b794d0ce503978d0e6ec90f3163e3a07f2e029b3634c5f32d790feae3cd00182cbe136564150a2f6395730f82fab8a9373191d7c35487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a9b99f947db5f8ec75f2518e775bf92

SHA1
337ca490f7361b3761071eab937663f0f4bc2b75

SHA256
ae6b64a0e5dfa9a02bd1b476941a63c2c6c1a418bbf176a12d8623a86f5785e1

SHA512
8d00cceafa134ea16c53764dfae4387d81396d7dd69c87b58e66a4bc46570f1492fbbf436bf08f428e14b68ca05836052ee5a2a8e22d7df672c8d5ef4a8138db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58703ee2e8f83563efab60c70d78eddb

SHA1
9be0374d36136283162e169595702315ad38858c

SHA256
6b287c586cfdd977ae5ad6aac89b622d7cbe01c2e7e5e880be9f0699e5cab3fb

SHA512
2e083891caf7acc05321f814aea7e1faacdb7fee2978cd7798c9936f227842be00f71d4ce78b7343fc9b0c8ff6391103fb058050be7f77c635d35227e86e0682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
910d599d4f176f41a9a25cbb9b97f57d

SHA1
d359635c02788a1babac9963b7b38f569f7ebd16

SHA256
18ac242e4b315f730a8bacd72533ae2fa83a989522aa29fa248d09ea28a21051

SHA512
2faab77c3f2a72b54dcd6797ed7c066dc3ff8da8e84f5c957bf6138cb2156958038954c05fe261b71b0a286180170712492a7a0136a6d564a5b0ef95c98f9310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16dfe65c88c6135e8738611bcff3b26

SHA1
2f6f9d7ac41ca12775b7e582c9b92cc617a0ba7c

SHA256
d21be952872f64f0d37c6f0198f268e8e97b57927e41a334456464fbb5d2d6be

SHA512
195dedd6230a5976d480f3cb58d93a9c74d8add59d2ec4c295d0ebbdf3879ff5127194c4962c99177b5413109eb8abc7516be88f4901c9280b84ca9aa453f402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
373ea7950638ccbfd249cf114392784f

SHA1
80b363a61840a767a638f473c4e64994daa2417d

SHA256
84f95074cac2b0a7055775652e0664026121dae74b9f899e1f5dd461e1789a41

SHA512
1e2cd82a070bcdd130084d90e8de1a552a68a9782e5ea0e40046ff355008285b022309d31612d17ce9a9955dd7f63dc0978a9c681424ee2ce0576ac9475b5cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e57c3144f6b2433fdc30f89f265ddb7

SHA1
05132a3a0c664b18ca2d2a453398caae1fb1e07b

SHA256
b58668070fb5c1cc79c6df38439d81219e23cab04f85efc684baa202f8576677

SHA512
487f9722abef3741b6724d38f315073f25a704481661cafb269f235d244684ce41525e32a699d0d26487ecedf771ef6ad1e914868ce1a138e13671f6dbf05ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE458.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE527.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit