bae99f263ec3d3d6a62194d49a412249b0c025ee5058db87115701cbe31940a9

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

superidoldexoneyobinikekienda mas miku.html
Size

62KB
MD5

684aae4d6e03770f8a27b1fb462d3854
SHA1

8866655316a5c998229dbc2d82b5f2514b4cb326
SHA256

f81d2da1b9820f65c7ad7bc04de46570d0ccf5a0f22102cb56555265d4ed2ae5
SHA512

838e4bec50aca104d4679a53de9d1c67c017e1c596d36935dfe37f30b9a709142db6bdcbe985100fd5360cdfd121c34113e82d82c94654ab956bb113cfc1ca41
SSDEEP

1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++j:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8Q5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97614961-67AB-11EE-AE69-EEDB236BE57B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000005b6e7443eb4aaf5067caabae9ed11db165778a2164834d83989dff6aa42744a7000000000e8000000002000020000000ca1abe6d9eae196f2db87c556c9886ca17e82133a486cf90e110d896fd5fe50790000000172725af1e1136a681acb6910fe848e61da03af1263a4dd5d76609607b53bf05831b4be3b5f73ca6b76341f4029b698f84335ec0558c9a67a359215243605f6dfab89a3277b7895333260a0468678ba03646fa9409dc4687a57f3e2c7bec252c7002b45358673c31dbf9e92866231c9866556f96b7d899efed173bf60b810c98cad5edc8f0dbcdf2b812d5b24148c2aa400000002605b253dd2e3d3620ac4bae35c6fad56aa566c711045c6f3516e07048156d87a3b36891145a0eb125b1b58a7cd717be71d9cb2f165a6f7f1a05c31b6aa43d09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0043e6fb8fbd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000d5450b92b9092775414d3eddda9a77b490f56660687ac2b0a9d526cf8eb22b16000000000e8000000002000020000000aefd399e87945d7a879860e181c088ad20ae3ac7529a6213696fc6e755ddaab520000000c9a579c25443b583738e88de1bcc9ea5882bffb3fe46a9624c441597c983c898400000004f206f86d38582bc3fa167da83511b17af3be6f7796a9490bfc63b2846f519d3aef2701b5fb3ccfe0c9cd9e0dae816cf3878f9c43c3915773c378d5931acbdbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\superidoldexoneyobinikekienda mas miku.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba7e4aa1979dc80e62a84f5401d53f25

SHA1
4b42b66dc677f05b2cea3a0892678d041463297e

SHA256
e60db9e200394a7dc3365913acba4567d3e1ef1defa97c7ad0fb0265b830b3ae

SHA512
ddeb55912b7e0dc8940cf2a7dacbf0a73d6ef42bcf634e8e589176971c38789bab6f21261a6289227d6b584356aae821387498530829914e686dad96d9bd6390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f081996275276897e853d9953d03c750

SHA1
6d5a8eef8b063c58d589490d59ca5e7f65b23287

SHA256
8aebef037bb292fa3e4005cd0b8d11df1b10e1184300c40b315726c7144e9031

SHA512
9c51f01d4253f7e17694a40ebb7de3a91fe518a9be26b6a39795652ebda4f5e26d3c1171163fba8a1d55620137baf378a4840265c892bb44c452fbe703402d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9c9c7e6afbed3480e7af4b2a879b26

SHA1
cfc5637f3580296d9008c4c078d44ae2ddc0f8cc

SHA256
765bb86946b74341aabcbdcda88b7148b6a0ba847fc4a6901b34c698f1b269ca

SHA512
9c80014aa33d12c4855a54f6742a4253523dca0e0214227eb47149799e1a9793535cc5d483015d665221b74e484e9ae58e0868ea151104429e3f5cf63e5bcb6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22959b98bc98ca6a58dc55050244b76c

SHA1
1d09922a6b8dc06348d16beeefbc218875ab6106

SHA256
a4dda52ea7b87bb7e1e5f36ca40bfe90ec3f831eac7432a615c4a159c046d028

SHA512
99bd842bb6fa1df90b0b3e8bc94bb493677ddfa5cfb6cb7ec66fc054a7f4a8f8f81616e924ae9f1e3ca8f671c2235c2e5d4a3817e339f45c7cd6661d37c5ae5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
295edb8583586aa4521797d5cc9280c1

SHA1
682440358c4666daab3a74716253b4de9d8f71a4

SHA256
d28e31405abaecb53eaa24a80542703bb577c43019ca44ef4fa79fd2875ac9c8

SHA512
d3ab83b6be92c80abb144dc784747155a48d7195efea193d47e596ecd303259ad32555650c4a5ba4a58e796d62a9fd44cb4662bd6cdfef31984200effc8b83b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40710bba7da698331d6c860e9620fb5

SHA1
862929440e0ef15e4a62f501e5e4cdf9eaae1f32

SHA256
c165360fc44f3c650fc19d961d096e6de9426bea249149bb47ec336cf627f25f

SHA512
6d244705389a60604d41fed7646e0d879338a0d17fa0d1b8cd54a8f86df3e1f0d84909fa63501c6ed7da2af3c68c58057821337ee44056d2f3ae9a9fdba4fc18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b626ac4a6c2648bb4466b593cde1530

SHA1
a14293d12c6f7dbb6116afdbe8abfef780c79eb5

SHA256
1878fcd42bf93f9b148edd42f5a5d24c17d23bbb7246a2f1569cee03476103cc

SHA512
9504741e96259e692ddd40223e83c16caf57d193bd2baedf54b0ad29f1e35f7ef8b8432a8551e979a0bbedb0c4b91db5743341d09069a399575cf63d6f56e917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3de05d8449b5ce8bea1da40e58f361

SHA1
4d47a5b16eaa86a13b292d3cfa707479c1789020

SHA256
c5b0a927b9fe53902514648839b792d7d5f35bbf082bd14d2fda23f190e56507

SHA512
2fe34a5c7a2dbc2d778a65ae66e7b30c94e6e6ea8348e3e08acfba41bb1a6ac72c064a1cddb7c211473b0d717acb7e2f1902caec72eaa13e93d5661eb11f4f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd260688cdf0339dedf08a8f20b439e9

SHA1
02ce2b8be2a6b86ff27e7d05536b2d08917e1644

SHA256
685b5215f5fc715e8c2dbc3a43c5fc92e8cab93eff01c5088a59476d61304ade

SHA512
0649b0876d40e46ca23618274c1fcf640de158c429fd7ad36b7b9e29ae604d99d027f79be014e4a6b346a3c7d6f04b73c26e8c442ddb82cb9dc84bfa7dbc7b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cdde877ae0fdd1e8c737d904e1ee602

SHA1
b66e6d42a35a32b82d9013ad177495d2f7f4b3fb

SHA256
f7cc3e6b1820429563af97b8c43d5fdf5285b7b6a103dade5256fc94e84af2e3

SHA512
b9b9c49c36231597b6a79d2e59f7e55fb80eea1cf286caa1d87bf41cf120b483855abaf5b2996fb3a0bc96e85b1927ba7a7fdd5b29c2829051feb6befb6a0ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA48B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA569.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit