636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_medication_local.html
Size

1KB
MD5

601fbf21cb68f72f9c04f46e8047c31f
SHA1

0ee7e08f3c0c86056bcfb9417cf37a2a62ac922e
SHA256

0bcfdeb14fb71a4bb5e13db233faa1792ac4b18f1c769634cf9791dda4f87db4
SHA512

739922a1171f3ee40cc6cf8b0f8d293962fa376bc02bb3f713976b0815fcc8ec44a2b25e92ec60eaef35dfc50c16331672560c4fc606eaf37d5e664257b5f6da

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51B279A1-66EF-11EE-89EB-F254FBA86A04} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a71400000000002000000000010660000000100002000000026014f6e83ec9ea03840dc56b00625529d15f3b2665650682f545822baf15d68000000000e80000000020000200000007056bf358a9c1d83ad1fbb58c0cbdd3844e382421445d0dd66a4c03684f4b55b2000000018f287af8f03969e6b0c3a4f8258469c08738424c1010eea58a7a1c4aec61b234000000091d40225ee06dee6aac53d050b5e0d7bcc17062036d93f25d205b4214291abda95bc4cb940ed22735ed982078497fff58d1c11dbf2a33e3dcb027d8ec765aeaa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050724"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000b446ee4ec01fa0a206335a3ce623a5953de5d7074b54823f45b14f427718a8e9000000000e8000000002000020000000269bd56ca94a660c2968b1fec46b1306b9ac215b30c407f320513d21464082c490000000b634e87325277558ebbd6556b2cfab26fda17970a1dfd953cc52b2cad4456b5616f987faa3db581f2c2b0e78cbd44f722d18925b90cabbd2b59a200b3968a745d01b03f193ba317bd1e75fedc5b3f40542396fa0712ec8a7c38ad1ccef71683b33879e52bbdd4b37d5c6f23a5a4394dec98c27538e623f3a161f331b9f18ed477998ddf7db3cff208b94f014d1fdf38e400000006a2b22d72e74b649ca57216615d1982fe02451b9a5420dc03960670bd5114775f69cb560745dd17239d647fe3fd409e14349aafb32bbd5ecfe2c53556e7838ae	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e97f26fcfad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1380	1996	iexplore.exe	28
PID 1996 wrote to memory of 1380	1996	iexplore.exe	28
PID 1996 wrote to memory of 1380	1996	iexplore.exe	28
PID 1996 wrote to memory of 1380	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_medication_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e956a45bd03a6b3924040ca3d9b8a40

SHA1
6ce2884ac35f3ba370529ba0742fa3bdf3b17628

SHA256
d9a13e340f70c1b780ad360acb3af532d4fb616ec23e3ee8f5bb14258b4339c0

SHA512
968ba9d8bf1e62c9be65dbe33b283f86d6a2834b882c35cc04d9932b969d1a6f34ef62e371bfbd2070de276c3efda3d034562e327955d495704e09b212ded4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30a8be7e759d2c25e053498f33f5d589

SHA1
f0db62fdc0cfabadaf5c024787ff9411a14dc8ff

SHA256
0695fd2155c1501e088c290b9ddc8abd1cefe6239820d94bf12a8f4fc6a14ac3

SHA512
1ed33d93d066563f109c333a1b848755e46aeb48da402624f5b4d4bb180843d24b489c67db20d2fd0c15ccbfbdee2e4c5a709b218c98255c4ef24749c1a23fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7413744f2ce5d6a23939591bdc7858a

SHA1
dc02d9cc560c9358fc34fd96b74f769bf276cc9b

SHA256
8fc3bb057d6e80625aafc4ce9758defca000dfb71964511a4fa5e959b6fa2924

SHA512
27ee19f51dc52cd7ef7e1344e67f621be157761f2b191130a1e14f23f24878e342e1505ff4e37690d6fc40737a3b05ad6d18b74a91023604dc16978548ba2601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff8a639e7408c4d866d32fefd6c5d3f4

SHA1
b2eb0ef8a38eb8c4a22ed2477cc89b0a816ed662

SHA256
242e08d9c4e8ac2392dc199a88ae8d858583a55a3e466f58138a6bcd31722822

SHA512
b99cf61658a8e8bb77010aff784fbdea4eb70d4ad9ea8d1b7cdb998ff23f030e3c0fd88e79f292db08575075fe5f582d70c8c64c2dcf739823073f164af6a535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c17e7b3f00939c3b5cb2efe25d4eb54

SHA1
4eda024a9a54bdbeb31872be5f18a4ad9c4d4114

SHA256
6d7fc67787815ccf08e719e7b657405e8558e5d10b0dc41acc30c4ba72dbf7ce

SHA512
4edef1c29391afa0a597e469cd57ddbb78bac7e442be20c4d198f777b55375d7d8e0c1f5351013f1fde7c67f4be37d8fa05b52fa745ec8f4afd26ddc25b52694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de4907f9a3cbfaca7d45239ea7d3925c

SHA1
fb81da443a74a8d195f16ec40b85b35ec7589f41

SHA256
220d49e6740400d43b839dc9ae52a669e41fe1b9cffeaa0efc57caba5e2c4dc0

SHA512
a3f060134259b41a39c678f0b0098ef4e5b288d200fd52dbf2d2f258c5cd410f2f221242bcbd1ac41af66690693c269b92edbd2fd453c62fefa5d8e04537f848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702561175f3b523899632056b45ac24a

SHA1
9b291f628799669a47629a03a703f943466662de

SHA256
ed35bb3e19dd7803be8cef6ebf51cd560a031c422141f74ff23b477f982b0d7e

SHA512
f03f523eb4dfbde738599e772b3cc23aaa191cf466f77616834464aed6693fffaf8380d4c4ffc6c1035a8894c9a07d050f3bf2d7769bd2e062a09c1acb76a398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7900f65bd0b2079f8b565e18a5f5184e

SHA1
9b9ed705d5c342f6619f4b3a3ae97a45e7980ce6

SHA256
6a1f40297407f66cfb73b66ef7caed99f08fa914afae4a155206eec92ab538f2

SHA512
6b341843362d098d22c93c20f90ff0c2066f6ecd7e7b995c5c4eb1268b94492da3acd2ec79e8a61d31307710203f2750f49c2f7f035ce73d44c32d643ea42fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735f299d3964c74423965b730705539e

SHA1
ec249d5fb944845d52bb7b8668e24fea3cc821d3

SHA256
0a78396f70bbe32075faaef3fbc0ec997d6312866c2cdb8596e87cf250ddaf3e

SHA512
0bd81a6d3078d4f33854d80f36712d3cbea4eeaa881ed72ddd0bad523341b4ce92aec3fc1b934ce5dbad9e4fbca6ea6d4d9f9487edf9f3aec8aced91fe337645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
815537fe89288c6a0945479e88ccf27d

SHA1
2d65bf2017096b735884773e298c31fd9669c2f0

SHA256
6261eb4fdc9d4e08adb256eb0c7519300d632a59b5e5de58b4f0d1a3190e4825

SHA512
e69d47e4684295f366ac274a76c51ab76064b2f4e50846e51bc0687b186b3734270e8d89175e629435ff4bf78536fb73e4e6d9f34801ae0f89475c96225a0328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B6C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BCC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit