bae99f263ec3d3d6a62194d49a412249b0c025ee5058db87115701cbe31940a9

Analysis

max time kernel
120s
max time network
159s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

soundtestcodes.html
Size

62KB
MD5

4559579b9721eb4ccb79743c731007ba
SHA1

9725b69f7b2719831b05e87fcb21e28898eac814
SHA256

7bca3fda9144612226eaadab5922176f1d920e59eab58e41fa9315d13b3d041d
SHA512

30ccbb695be43878e6ff71ce548a6d0e8e57d737c84c98448c182dc145a9f2810744a1b32c6840a46b4774944369fa3da815d0d463c4cf6785321d5560b33c74
SSDEEP

1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++9:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f3517cb8fbd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6EABBF1-67AB-11EE-B8E7-E6515181EC0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000a0c8c3783e2b939a4f06ba3568f1958f70aa0411812fa537163a3e7efd358fca000000000e8000000002000020000000356ba835ec0fbd7ab7c4e1675b4420f77abb773e771c827239f40d4e1c0e0f6520000000a8ed4f98df8934b2fa6afeec0c6a1254290d40b52c879538d1ad743b4ce5f84940000000a7e79697071dbbc37d0f7b6d332994f0ac726589f9697baf78d5cbc4e712276b0d12fadbeceb35d2c7c9b10aec602fd0a65f28c231db1699e260518334c35e91	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000d5e933774908d467c8f38aeea32d9795f5d088b2597cd4727aa0a6a4127b1c6d000000000e8000000002000020000000ea61a9b78991ad4d98ccecab9cad44f9cb4529f83876c243f5199633e987338290000000c04c132079579a7bcd05256d62e54d24205363638eda2e20cc87665478abe7c5db132a5826e16be048334dd5fc4391eebcc1bac00253b7a61543cb4b2f011bc80d7f1b9faa6eebf6e5bc44c3792ee88ab0b0aaeae4d5acc52b395ed3451e4bbaf9f958bab00f5f645fba65643f6f58e04b16e63a753d431b215cac64f84ff3ce8991e6d92a88e6b33fafd6df8283d8c2400000001855579259f3fbcbf9de524811c9f287402cd8a4b487c10d17c031f493daeb238414217d779edfff173a28ba391ffac65535c9554390c8b36120b9c392c84c4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2160	2380	iexplore.exe	30
PID 2380 wrote to memory of 2160	2380	iexplore.exe	30
PID 2380 wrote to memory of 2160	2380	iexplore.exe	30
PID 2380 wrote to memory of 2160	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\soundtestcodes.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
12d025f16395047c05ade1bf33823009

SHA1
a6f4b088ef16648c771dc04674714cf9e2212451

SHA256
1ac1fee91563d650cd2015ec228381b24b5b47d73634f900809fa53868045a0e

SHA512
7144f359cd548a4201bd1b88cf577f0056f1e21e05bc80aba4dec8b868f656e2827c8339b4dc0c1914163d2efceae43aabe87c2200067e7284f573089593ee34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e5a2fee6dc99115338b29b344754070

SHA1
2a7d931dd6eb3a9e7587544673e2271d134eed4f

SHA256
b87e901403ebf87f93924a4a52af489d10087e3d85b3f3180e334a17d3fc1c06

SHA512
cc0025557ef9a78d09a455b1490439eaacd7f625dc7a3de2b2dfa427132c1cfffe32e191669687a967a49d09476a6fea6363687602c4064308274d89c8ab0092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
52185a45306436162495637f33e76346

SHA1
be7e0f225836911a45df05973a5853d5a5e62779

SHA256
28f96e8678e31251b3930b5c2f2a0d98a783f478cbb291c8cc97ab30230511c3

SHA512
39c4f4f90303fc1314d7712184a6738d8d1332ab67097f2272d1bf01f67e135607199383484f9656e5f635265c2875fded18a3f2e76f4f12bdfc73bce136ffe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
167d019e6d85c3cf0038cb3208398d37

SHA1
b0f3b66ffa43de30f3eeec7692b2152524d8b03f

SHA256
6007cbdddd0fd355539c4316c92aab250abda2c2ed162b90ff7d8ff25f7bd745

SHA512
67b3a568625d09ae4f3307c1d32deb4c97d420c9f46096e4add4bc3638d38d521c85662c8b5c0de9e925d6b00e62bf0a2857a1154d8b04c71697cdf559e78738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
498a791ee99d939c3779c0b530635f9c

SHA1
b8e19db28fc190909d50dd04c47790d94af3256a

SHA256
f73066db6e484f522ecad5553b02b5d896fac3b17575760e3358421628af0f4c

SHA512
bc9443a167de601d68db821271e4a5504cff54231ebf89ce9f37fbe54abe00f59a91cbb578a1e73c1aaedf21b9babe73882949963680f448794d6b8b8d57e176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09ed3b58a7c33b9b573dc95d296de755

SHA1
49ece732709ebd3f11b80975aee2a39edea16b03

SHA256
47eaff46fca847fc7abbcb9ce9bafba4fd7c40b9c20768f36d501ac4b453b5cb

SHA512
0cf77a7fbf726e352f443b32c89d4c2fedf7948a2e35527ae79d9a7e5dd5f1b5829914e14d4b462fcb3035744b6187e6e4c7f0cf92e1418f7ee69de0cc8fb8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a8b37f5f2ac5782e00f847523491cc5c

SHA1
7763adc54e1693168b504a7d73502939039e63f9

SHA256
f4c76e77ccacaa669c3c26b7a901d91991f0b186f41729219290a0eca5175953

SHA512
b4a9dd9f6cb37c356e696b8abe892a4cfc4cf327d3cd26145654a2cfc7dc07393df0f4ac5502f3224e66210964c9c677eb3f5ea6fe3d9429b687cde2788707dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
020babbb185e60838c62e9157e9f6e7d

SHA1
4e553a84cf17e2f47ff076229637e5cad1064554

SHA256
cc5a773ab02dc2b00c6d95219e3cbe677b831c4008903448a323a55ce686f730

SHA512
8de23ac9dd24740c29137042aeddb865c41a2f0b2a799123c3218fb18a041e30a9d84bd7b5f336db14199e11f4b8e6ff54d5ecb1b9dcbf89c0dc35c4d9857836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f4f47bd9d6533c2c42c7226fa4ad1a31

SHA1
ef82fa8bfdf586db0e6170d3e400a8e2fa8801ab

SHA256
c4f00d8a9f73bb38f8af7141bdc0c747f14db3b60d1add38b4241ca9ede5146b

SHA512
0e6e7703b6914c8c9817d8674c782d1c3dc0005bb66b8aac745e65b579d6d1cb7e211ff43398e4266cab9b4778aa6943103c84ca4890eeec912ef17ced269fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ac15128081a8863934d3c21f1809c518

SHA1
f94a3c3a1e1dac0fe55cfb6830aef1d96989152c

SHA256
645e1ea23d0115bd26d65216ba1150d4fc6d1fb57b899bb876dd15230d2bce62

SHA512
02de9804171180d4f8cfbe1a9fb274e2ab2bbda246cef4522d34a3a9d04534554f7bbb802a8a701a11f6c3270a9cce42750d872a31c991b8f3726c9073012365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6a187c2cd0571e5cf5e9c92adfc24ed

SHA1
6628c99fb15c00c4095559550d5adefd33354e1f

SHA256
d6ab55022ff5171c1b306dfce4b0b8cc692118af8906e77121c5c7d410b69bdb

SHA512
f2a616299a07c4d6777311c502c52aace9e1f943e5214f3020f3ec96d6bfd3b66e46d5d7342fb6d1f63bede8fd69c00b603629a8b6d6bbb444bae4cc6304c7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2e3cc51837e22dcef5125c6d8525f56c

SHA1
1c98fe72c5480c763d2efa4fed7661c6cf2549b4

SHA256
e9a4d12e55ddc2b58c1ac80d1e9709c861cbd074ea491be6393742dae50a0944

SHA512
f89664922dbbaf99438d426e0b95faf0d73a7e92e0305040c9e43633ee6fd4bb6ad1f3106432e87967867a04059ae233c9288f44579cf2a8a6d98680b733593b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
19a060f340ff18878d4c7e068e38c15e

SHA1
bf7421c99309eaa148c6a2f9115a7a5f002751e8

SHA256
48f1f0cb085924dad13143e258a2cb3da4f8eda599fd96ae907dac0b371092fc

SHA512
352c4b59767d8a29d956fddc4fbff3e899fe402835e13fd26b6d5cc25df7614ad831c6908a8cd375d7ff990e1a22f2dbc1765a28a1eee254474e1f6f2f423f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4f3d38c32876ec96b4b86639b752c687

SHA1
0d4a95065b5d978dc2cab7bab49788f90c7a489f

SHA256
94785c548c04e1658df1e54aa3e207c1c0e42ee28bbfa944c388943602967ea5

SHA512
81d3c16d17e425889493957295330f60452ea40d2a4924acd83e30c296c5172167be664839a0d03d847b8c8b7d19750d334d6b781fe1341fae5c3c3467d3dadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ebdcd91f3bcb18712b961b8069eab2d5

SHA1
12123424667d32163b6ba13297598350bd3a3f5c

SHA256
fa940e749855f568cc6780465ebc26433b11490d03b14bf586ae133ff483a756

SHA512
b6973b105f732eb5c091c339de4fb1a755857f066bb819aff752410fe9c147f75fea5dff23857420f5c1dc6c2d3bd3254980dad4f30faaffc68196abec3fd6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8482b21caa3e8bd9e890357ed04a8b1e

SHA1
0e36fc0cbb8c7197efeae3dd88360f0c0d435ea6

SHA256
519bbd2905433d3c6261a551b1077a785002d6e3e420d2eeef49efc7a6b6a139

SHA512
a964776d4fff4186daac7bb4f7dd679a69b0ffee0904ca2b8473616f10117e40ee6c9643e85337899e00a742ccd1a1b7ea2d64bcfed110a81ffa70feb672d4d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eccd907df103d3e2cc565163bf2f4cc1

SHA1
4c367d275726ad2b1b402209e0db846330e0f57b

SHA256
5a264dfc7c2dfddd6d4f138fd1e57ab4440d104a01d7b4ec9a739b4abc2147cf

SHA512
cf60debb4294c4e06baac6a998385505ec15f5e8152df9f7802574eaca8782d2909cf3cd2a4fca8a1b08c0fa717f94243cfc0a269e8ea4ac6acfbfc26bb848f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1548.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1654.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit