636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_tracker_local.html
Size

1KB
MD5

829e307fee543203f205da867683e4d8
SHA1

c93c4c81b6bf30ec3e4fe7c0da4a550ba29e5fd6
SHA256

61a79942092e1d3685ca18930e82cc56697e81e432a185a0298fde79fcfe396b
SHA512

61007e65a212858c355c9cff799fea23cf0032f5cefb31a3a45080463e707e34da0dc14cd51b6a099ebcec9c1b718aa2a749550864c04c2e25f3a7e02f6c6753

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf812000000000200000000001066000000010000200000003449e31b6eeaa3a09b510c1ef8478d77b1a2a318cf06f72d6b58d93bd14ab9c1000000000e8000000002000020000000ddeada6dc0da5b5c8174861e4a0dfe294a6ac48311de1c7b6951d5a37f5df73690000000d6bbbd048cbb15e47694ea29e42159a90e06435c815fea693edc820c3504e0c1b18c68adfd7d498da80685d51183655f1770aecf3d02bed0c6534eccb13ede25a57884f8863439212d864e5e6815df303f9ef6ce2900303ce7fd9e41880b7ce6a7b7a3752ba46e68d47d65390ac9c1c97298f88729e487dfa46e9efe209147e73bbdd29a4187a7b586a5d730b7c6808540000000d99e6d311a1236cee21cdcc23e309ee81286a9fb105f33d79d82d31bf59d5d782a79e429a0fb4f111d718092938945fb258b7288c010848430c4abeca1aa6c3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000b33e58bf817eb8a954b49dccabe1c4be019ca55c21ce3049ff00cce6a3c31d75000000000e8000000002000020000000483a748c204611f8d52accf99bce7105f29a0ac7703e86eac1a1a7d45796713b2000000057442dff37af8faae6063693867e4851fc27d84e2822c6f6f1942d65a70f528a4000000079af7647da0a531425577d3f2c7c81c070054c2b0ed0cd907430f5b5baaf45f2dfa17b6f2c64d2d3647f61d96d6534c8875d39ae599e59e8f5e725ad59d9a1b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406d1e2afcfad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{537EFC41-66EF-11EE-A4F3-F6205DB39F9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2072	iexplore.exe
2072	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2072 wrote to memory of 3040	2072	iexplore.exe	28
PID 2072 wrote to memory of 3040	2072	iexplore.exe	28
PID 2072 wrote to memory of 3040	2072	iexplore.exe	28
PID 2072 wrote to memory of 3040	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_tracker_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae9d3ca498c0f479e1cda5dd3d0b02ee

SHA1
dcbbd3ba9d67cac1e3da0bfa029763ee2651b987

SHA256
494b4cd9da06ece849710aacbdb751888095982cfbbb7816832d19df7d857f4d

SHA512
e7f49b99bd0c9575008c1c0bff9e405e5e06deb3de0507c7ca372bf8d0989fcbedcbd9ea1c16f14d23524377df4ee412d7d9565d73a6bd2121c483a4e8faf2f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bcf7cb3005f636f80c13038af07840d

SHA1
8568a1d36497bb06a1ad6daf50fa4f75cbf9ed1d

SHA256
1b972f792a237ef6b7cbe4ac149e011aaf3b7482056517501e20b15431b65d03

SHA512
c24e7d8597c28304a3df87c21b8fe84f9f2251dfd5884eacd2930ff2cc4a139b1bba75498a36922d505768f03eeb1e97f882f91a5232f0fa97ccea3752878105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd785d25601e5d5066a5399cc405e9e4

SHA1
6a0a255298bf8924ac8fed082b0bb8cf85ead026

SHA256
f6b6fe8f79a1b8128081660ca8ba35e507c5e8599d991c4c19e9059222cbb3cb

SHA512
c1e920573d675afd8bcaf4609ceb24a5094485fa7daec2af4ae352141c73131803d5736ffdbda1e71e37392f72c4041f3b1fee2e40091a056356e4e452006ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cfc945c76b8749a07eb1582e69ac079

SHA1
336bc39c42686dc68263ce7a7ba2885443083942

SHA256
93f5949537e6bdfeffc5ad8ccb2427cdec1282081467bdeb0aa4a76ef785c5c9

SHA512
3191b69f6b4ee373e9e0a2c0a96e07a04d10a939e145f46530ae0a6bf23930ff6eee3dc20bcb83fce5c20303b887de1db5eafa653db351986876b33238d6ecbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74fc09c347692c0979d4fdef79779f4b

SHA1
5f80e8db31d2d0fd0b3304997203535143c4a04b

SHA256
764c9795f291d8a414fb5bedc198dbe16525803c6e67292627c7c00a4616d5c6

SHA512
926a1f080c45bc421c466365a65cc850bb013da05cd3fadd276b0312ffa00aa64191d3203b11f000199b7f9e08a71fbb24e9cbc843585df5d8cdc4fddfe6e671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd785485a5ba7f8332ad5d0c9a849e0

SHA1
e12d1d8fa64a06e8821bc871ad4308375decc93d

SHA256
fbfe6ff439fcd6e7b4aa6c7c457d419bcf7374ef3db69693a3d39f2110067e27

SHA512
37f99ac98159ddbd6b3d99774a823630621e814ceeecd4279b5ef83c2955c5e030c431f2b404a32529db950ce5a381639f9ae51c9d497366a09ba60885993aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd2293decf69992483075154c243128

SHA1
0fe8c461c361f2bf07462e5fa3155f4ab9034b37

SHA256
f97259a0080787cdea898e669b63521076bf7bfc362134050e16b14346d6bcee

SHA512
4c13e390b9c7e1916123d814d82098bf81f6a0fd25b2aac931cb017f6b2f5925703b9c5a89e7b9e48d08bdf107ddd817e067171d4724fec8d615e81b993bd472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9159224dcd42e58439f6a84231d4c9a5

SHA1
faf9c0a86f169919935bd95e033ecde26a5935d3

SHA256
116158b456f40da440d2a94e16f3df727af76a82e94fa4215961e1613b8f1995

SHA512
e62cef4f177738a2efec31e665aa5d18739033a8b264cc2d432b4310d21a9280c6e296a924d4ed27d83c83cfc1e9f5b4b02fa9b7dadbc72d2f3c816ac2affc63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f614d269c28e33af985ba06a30ec3fe1

SHA1
f6dd1eccdf482c41ac08a49560b5420300de259f

SHA256
09ecc1e7c5d4a3c1dbff5697948c3eeeb011a846e66b10e41675892aa122944e

SHA512
7da1f53df1c05abe6095b828e919ecd1fa70362982fa5140c02a989d064f55ec5da7fa2220ef7f129b403e705a1a4948024c6416bf3755c7cf90a5dd159c8726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64bbd84319f84184315e9640e4d68757

SHA1
2ee05929dcfaf5a671327e8f64fffe58d1435ae6

SHA256
19c2a9ccaafadde6743b50f53354856128fb5e4fa3d529be282b62898aee4bcc

SHA512
4a0240dde44205f2cd02e7e20d5e12c9f5e3f794915f21dd9e5f994b1118c8a99608a58f5a0566a684cf5c31a335b86720980a5760f631bdfdb51ee954ec5eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC332.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE04.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit