9177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KaM.html
Size

232B
MD5

7dfb9a4219d20c6babc4877451844e3c
SHA1

8b56a18d01c00f757df29faeb95b2711ecd3cd18
SHA256

9177a352dcbf8875ebb2e22e682760d47faa4d77398add153dd7084e7568c5bc
SHA512

7355451c27cd2fe7e03af772a8911fff879e64b04c8e002d4335ff890957a04e611e444131ddab6e171e0a21a72cbbe75f9b5cc338a72d2d24ec6d71d59998c9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FD26161-68A6-11EE-A354-7AA063A69366} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000f0ef0c42da691e36be38254af630cba0eb37ea2f7898b0455c5f7b9689892243000000000e80000000020000200000008536c3b16b6d4a58616d447926cc3d76d17e3c6ca7a80bf0338ad26c45d6748c90000000cce9a31ba7f71334267594b2f0006a3f92f07f3b3fb8b558a4bd65b9b95b4d745dbf2a685c1a304da75907df964b1f7df7292fe7c9d1fba7759059a17ecf141e889ca986d0de6512cb72531680db8a6743f2b07b6a7f0099b37e43aa735595deb8fcfb5be278b8d1fa38271e8d35d1775ec23df1031da5b9c7716fb7925237cc609ce55fc3b3f2dcd133575cd17d4772400000007dd1524f2987c9dbc4f8164e9b5346f15b126a20fc74d78c108431409143b63d2fb848ee134ed098879e2975e2450b8f4b14ed7fb129c02620cad33b3256b752	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000f5a686e26b0acdbb57fa345dd21385680ec9543eb08f96810df8564803a9f12f000000000e80000000020000200000006410ae24f7eb1d18ce36cf2a23d7bb986a5af8d81d051851c081a1a1196b83bb200000001d7981d12aac9b33e2adf5194f4869940cdee2d75e2684d9035c3a71a2a5ef5840000000e4c62f0cd393a992c87bd83cda85d1b29a8e1dd32ab356f5c4ac7a939f6d3cf14270389b6c0392938b25832ff12f5b4a4a089f7df38ee4e2d6993be37e26ed61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d050d514b3fcd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403239247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2284	1728	iexplore.exe	28
PID 1728 wrote to memory of 2284	1728	iexplore.exe	28
PID 1728 wrote to memory of 2284	1728	iexplore.exe	28
PID 1728 wrote to memory of 2284	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\KaM.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b73494f3cf23151593e5926b2d96a8

SHA1
0f4bcd286b9c9507dbe50967114e87c6e43c8bdf

SHA256
b18fdffe5ed15812aa6ba67e8e0ca729970ba012471a7a4f092fcb96b74218b2

SHA512
86caf75b4b32ce29a23f5105e1d37b56e5d6fb4bae1b655de5ab9171b99cda80b63a91cf64dca8dd23fecb75a566e6229f6a6dd392982e5dfa6e2609cc776942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1973b58dae3aba30f2a59cf2055562bc

SHA1
6fbcd3b952248bec754918ca38fa0c82b1cfd389

SHA256
8d7e895368db48003630f08a6034a008e5f7a07b9465fe73995929af73bba59a

SHA512
38be2c0d7b3872af41b6e07646b4241fd0ef7a59e0c2eccb567294436fa12f0dd4bf3b7f871224497a872f50f8ba2e436a0f4442a0db0773c0590132af23895c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9cf9888cbf8dfb9766d44f0b9a79361

SHA1
60ca4d6bc7645e39c8e8f593f3e8c778ef24def6

SHA256
9afc187acefc54784a20698d401b80120abee098c7efbbe14f1d05d7a8fd2df5

SHA512
957f8d3a5d1f91d746e79858d093128658ebeb64117d36b4cacef38a99b4b5a335a6494b46fa8437efd5e9b3e627e49dfd624f97bfff34747e2ee9a766f8349c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f5a6658be42f9a8feb26f11382ba89

SHA1
e77c92420b754a3e07a43405beacc67a18c0a94d

SHA256
c174b8ae0cd436c3e037a7fd9d821bed1a3dae158ca7946bda51c4fb665ef924

SHA512
ea86c75d4b8d8b20889a3bd99d35f4964c06ddd81bc6ce162c9881c218446bf0d7f4c0782e90ffd44a36c6fc9f6858454132ffcc0c2eb50a0a407a480d59e090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c075e302b03bb0aed54e97fb9a743c3f

SHA1
84a6da6bca26ebcbc91fa28bb9ede2468217551d

SHA256
c5e9e59b57c1c427a0262ee351a40d0a1f2367836d3259a2e51eb9b1bcfe2fde

SHA512
e4403ec1d558e64cd49adb523cfd9b9baf8c0e14652d63021e9acca62908a4b582630e6706a16b56e83884dba6714ad71d284d18f842e51eb684ec9cd2582f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f82cb2b016debffb92df9809bd792b

SHA1
0f1a865929312d50f030c5e2b8380a25b83f8c97

SHA256
8076be33876b6f417225a8f23196f952883637d117963125870d49873c4bf5fb

SHA512
cdd8d25f2585ae391d5637b08ed8a474d06340895661d52e4acbdeed0ae1c1af09fad5029e0d2cd592685c0eacbf288c255144fa98769dc094133d1ef5fca29d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa4c3b95d60396ebe335268969364f8f

SHA1
385be5c55ec6d3dc095da9d05eeb2fab55f5e732

SHA256
ca65976dff41fdba672f781f717e209cf098ac327af34f964b05f21171ff161e

SHA512
1a2aa05c2d8b5db58d079a8aa88e0e763dc146995ff1b88c62729e0a92156000b3ba56ebb73867704d0b1c6de779d3b344640c7d1c367e1266288b848ea3b785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ef8286ddc394a1588bf90cabb01656b

SHA1
a1d7f8f8cce791c525aabf8e4ecf6ee50db6a44f

SHA256
6a11fb58cd107d4229e70c1c4ccb54b1947c1ef8afd23ab9b2cc8cf680ff4774

SHA512
0d87e2fed6735f78c23ab56bf8e0809260e8da054da0fd02d06e2fb9e98f823f55d5f7102caf49c124c7da41e9bd0b232d4b2a075ffbffc554cba340ad5f71af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03cabec1e2d9e8bf85735599b50329e

SHA1
e8dd9858a8ad5f6f2425dbad6e3e7fdca58a8d10

SHA256
32a6c42388befaa75af10a5c8f281f3e7216ba7eb8b7604ed233faf9f80b6a4e

SHA512
f1b25aa26d36daa267ce420d7ad3ef83dfe90d6ff89aa60d3679449b39020ca334860bbb0c9b3b3d0176ee6426aa823747bc5edee859c767fbb787beb6496dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fd40453518733ce6bd363e8924baa1b

SHA1
16fe5662b411748b556f67baa73b2d57adc3f8a6

SHA256
80ade95eadd14f3dee1492ba14f6630332c6e3bcb70c68e63de8273feb1427a4

SHA512
8db9ddea7a910538271a30f162b2b12f012beecd4931c64d6c0536a9b9e28519df6852684718fa0898b887d40c27028ef0b54aae28bff4753199388b712d0478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6abea60de0326ec85836d589f4f9c9

SHA1
249a8cf8c1bc865bc731abf8e3978dfe9962feea

SHA256
f273621977548afd8d911c63b5f159dac1f2656a366007930ed516d98cb4c255

SHA512
997c9b0a716de6fabe323868c4f7972944ed3a9a7e1831465ede36a7565e2d76a3e2609d8fe945123ac8ff76010ba3f916df05384f817a6242537f5382b3fa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fa542727776a37b25544bf2f026c1ac

SHA1
f87663cfde6052ecf726c304123ddc919ca055e5

SHA256
8e6d34f46a41956b40c21ee4a273686d1f14ed7bda9db1334f1fda6dbdf85b3b

SHA512
d07678b531bedd59f43ef530d4416e92264960f5b69663bc69e559c43d3b28f1001425d40f35eacd8a1326c9cc62f8aa485487fdf1bc2da7ab3dd31f3b523129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472d71e4efe9401adb7befe06e987393

SHA1
333e6cf019f3005f2d0f8e29888d10ff7f233897

SHA256
db482d66f921b1577cc35f5f982f1131934c1d1a83f6be0521c22e2d0f6eeb0f

SHA512
fabeafc25abfbf8924b53b015b86494c04d42428f062e34b117d20b69b868367eb53ef91ff1b55ad224eebb4f4acfe631a42ed604450e8e6c77e25687b35995f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e174fece865ea22f3a7c9867197b133

SHA1
41357ee35b439b405e39d49c311c5448460c478c

SHA256
08bfa0892f722b5fbaee5be955a3dbea050aec2f3ceed2db64335c92ff3814ca

SHA512
59f7efbb85cd75e98110e5ef126e2daefea0c1064bf98ac1259cb54a6f5f7261f0a9619dda93aa308abff3f381eeb1ab3ebc0dd73b3fddddb89b89267f26506c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8981b40b3db892b6ac5cfc3e1253f7f5

SHA1
e3f82549a76ab01bd096d16f9532be2fd6828526

SHA256
fb18c8d62c1b28e21dbfadc70736330776415e38af4fa7892a1f805db313a777

SHA512
d6c28028dc281a77bbf94d365b719b9d27cede55e9326317a69e1392201597663edd8691998455fb3f0c56cb39c6fb2e11e572e88cd6b1b4e503b5fae0833a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30da4ec23699f26994c52f0ca811923d

SHA1
78042a91a46328804430eb12773492c64c35fc8d

SHA256
be4bb6962c34034953fc71c170f195392d3fa33373d6815d42997a209e9b68df

SHA512
ee8189318596c56b5658f827dde03328841991522b52d9a5d770033f2828ea05807d91e103d206d2cc213b16d61f1fcc5aebb20c1e63ecc6f85179ad428e40ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47681b10500497e92f180707dfbeec11

SHA1
8d976519cdcd73d759b05f33009cc988b8b98458

SHA256
12ba5c93edfb01bb267f13088111350397af9534dd00ef888b78605dc1ea3a6a

SHA512
4985b0332143163ec0d35465ad05edc89773c3b44256549cdcfa554ab8356dc6e96c151fd5b835b7b9e0a77f3a36b79922633bc4a7db67fe1ceccc1872bb024d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77E0.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C28.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit