bae99f263ec3d3d6a62194d49a412249b0c025ee5058db87115701cbe31940a9

Analysis

max time kernel
118s
max time network
179s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

du ai luke laike ai nidi yo poweee bruda.html
Size

62KB
MD5

3e64cfba51825bc76024ac60d78769c8
SHA1

3657731ee2bd2217b2ee4deb40d90d4fd5f3da2f
SHA256

abd52c86e72b4b56f3135f2416386c22432b0c92ebe66ec54e20c91afab12678
SHA512

df57a3a59279cc9ceabdb6bf7ef238c253ac286f227a1c152250f4fa9793865623db97822a9c712a7b2196bf7905686ec20efbb6526ef6bfed6af1f100c2852e
SSDEEP

1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++5:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000a966ab72d26750abfaa562fc408956615bcae84eb9cc00395f229afb21da85a6000000000e8000000002000020000000ee6452b044ed26f21a886f92335254e68770f568ce0d16daa557bf6b0166169f200000008e3ba4fcb2c7dda9d41e7e918826e777c74236e81f009273f1ce3716f501f591400000002d785eccf740ec60accb4cf25d0bdb152fdddfe67af1bef7390b7f7baf47d6fce8a065cd72d601981c5f74cd604d1485504b7ccd90be2ea1b54468060cc2b1e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000db51c070d60f4bc99184ff46ad10c727e40cbd487c008e5b234d9eddabb0778f000000000e8000000002000020000000a5f5fc72069ce4dc9e845463d6a120d7078daa600136f7fcc4ada7bd4c4761a3900000002666b80b494799423998dd1094cb51c42f731fd3f3f1cdb6f65b6226f6aa11acf14df6afa97179f0cd6715e534ea29874ac0f69dd03e9b8c033948f69dca9a686bd89c0f692c49d022ca675ebf92d1fd75f8ca4cbb1d33b2c5edf3530d1ea851c85f1d42799e8a3e27ca5fddfcf00e956c0033e205884fcba0e127cd10cdeb5a0d20eac47f3c623a6ab0c6e19e3ae6ed40000000de54a38fd51b66cfac0f634b0fac2af9ea94c4b34342c7a47d272ad2c2a83c4b072b88a3ea3759904dfee0eb0d8633c6f1453cc0be439537ad8be1a50f3494f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A101A461-67AB-11EE-AA35-F2498EDA0870} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ca1d79b8fbd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2628	1680	iexplore.exe	28
PID 1680 wrote to memory of 2628	1680	iexplore.exe	28
PID 1680 wrote to memory of 2628	1680	iexplore.exe	28
PID 1680 wrote to memory of 2628	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\du ai luke laike ai nidi yo poweee bruda.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
df3640dcaefff8acfab16b5fbb77f176

SHA1
fc842f991ae7d33fc26f7ab236d955d2f47a94ea

SHA256
429d0c57923fab978ef7d68d15797b9e6db2f4799971edc53ffb49badf1a0bbf

SHA512
07340bb4dcf92041d2d5b58c1081e9f90121c3bfb507faf245d33634295b331df9e1c4a7a658c423f1e494fd372c01e00ff68cc698248cdf28663042b13f0b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
185671c9395ed424f80402d0fb871430

SHA1
70329a05b7267fb8b0a152165ac0b81c9378f255

SHA256
15bbd4f99d217167df645a68bf1ae696b66adb2223ba91fc27e3083c9fed80d6

SHA512
23bd24b6bb15eae406036fda9414055915e60bd20091cfe5b3f6881f9e65ca89c374420bfe372a6a46ee21e23661bea06c9bf0e5606c4268b1b701068dbc9a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a94844d20e673c065d94263a4bd45c7a

SHA1
5648cfc67e40351f4517d1adf3ee3eeeabce8f80

SHA256
0378ec579bb37239444196c16838beb5d7ed2556bd704713765893d30501435d

SHA512
8641e344b93acef5170d579db158082ebd8fc874046638437827fd285bc73616fd631bcfa2e9ba4ed5bccefb9ca60f35b91c6bc754c31ffe0672a566a71cbc02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0571cb3497fe2556003b335384ff7e72

SHA1
239b4598c83b68cc3cfc0bfa8f133c9380fe1002

SHA256
8f991bf9805a971ee6c37c614751cdc8f0766660d19b44148bf90319b6e561ad

SHA512
90c68c34f76a186e1f3a1316956d425ec2583f708eb67924f552ad7c652c81a9c08c43d8303a7ac42a0e247b68c22cf7601bae9c9c2558334bbe0a51c9729dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e8edee1c0049a29cee917dea9114dcc9

SHA1
8b81f57c5bada3a29f39bf84af867cc96785c60c

SHA256
fbcd441b23546fa82c0506474c4db6c389d0c552d8856afb5013be6a64711f45

SHA512
5223a11748b4c6bdd9d06700f5ad45637805cd4931bbba2464ccfb0a1dae0a2c4982a1046a69d30f20f3794033796e39b99b4a1c231c8347fccdaa665f7f98a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b244c10545aee20a32d502cc5ef4df37

SHA1
4dde13e8e856955b89785ef962f6f5753def52dd

SHA256
f8f5210ee4f1a4f01f3f8f515bad49aa6b7a1f9450615f59e2f59a2ebcceca58

SHA512
c9465ced30facd8e2f0b2284dbca76fa0aa07570d2674899a1ae505c73f9d9157ab79f5b9d6988159a62740cd74261d035ff5c34ce73cf8516815aa8c68c1be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f022dffbb3b8309d8e892b9cb769d3bc

SHA1
0292824114f99ebaf6d76a751abfe022ff59309e

SHA256
ffc098ba785706a51a0e6c476718fb2e551fbc4ae746cbe5fa728d83fc9c286a

SHA512
6bf9313ecb05800767994a69501461e3402ed47bda5d99ec8dae2feddc2556c4d1a7032dd4cf907a67739092df44a68156a2b0742d0958b4918640e3a3a9d39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EF.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit