d5a45268d0171806513d79db5bee6bb7fac74ad018fc34825cb1221289c17988

Resubmissions

13-10-2023 19:00

231013-xn6a7sfe47 3

08-10-2023 01:12

231008-bkxzrsbe54 3

Analysis

max time kernel
843s
max time network
847s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STORE/Store/INFOSTORE/article5.htm
Size

5KB
MD5

ead8e5bbb35b34df259fc00d1ffd2007
SHA1

7c2151ea5707b4b6515847267ca3208d969ef30b
SHA256

a0ea7385ad1ff1f9a189cb75ddba9b1407a7439eddfe310790411e5e5ecdc236
SHA512

61d22d292e781afceb62a36301dfacce8d16c11cd7d993f1f184d3b31dacb166a0d0422ba29d240d14a067b7ec75d3a139b8a5cba2db0a787480500db52dbcd6
SSDEEP

96:lmfHYr7t7VAy0VAbuUZKiQLduVAyeF79QrcWgqqihXeEqmzVYJHzN7E2HAnkai0v:lw8d6y06SU4U6yu/kunmkBgLDz/hvbO2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D8988C1-69FB-11EE-BB58-5EF5C936A496} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9063f50208fed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c30000000002000000000010660000000100002000000024af7ff769a9246f71b111c3ce48ed9668bae380afeb8aee7034cc0053a31c8f000000000e8000000002000020000000b5bcb69aa17286a074fbc38670bcb6bd99cf05490474d249e47025e7aeb2a998900000001db83dfee802496476f92d4d1175ca7f9ff8543c14ff02952177e973d8c90a3c33cdfcf52ddff490a4718f8492d36e512a1c44315081ecf76bc6551672c3b852ae0e181beaa3b4c60fd39918f29e98399692a3869737cdc498df54f43a32dc07811c13ce30f9dcf3a7788deb253ddb5479dac5e08a649c201d7460df8fc6ec9a05759060a03966a9655870892896c55f4000000020c903deb4039c0a29b31672aa9c869800013ad623d9b794bb8692fde95112542de318f494ad1a2b694a67bd8691eba341ea25b3e44251f4e778f67a2674e9b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403385670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000836183e4b17063d7ce4c05e08966424f5109892a7a393b917c4e42b89579a166000000000e80000000020000200000002b5a2b8efd1e19ae398e18bc07dbb56f992314d2e5c7450c25516397ba1e9c6720000000847f3d6f7fed1bd8472984716a49c32d1a986eed599e9279e90a2a09efecd3cc40000000df61d6441edacbb71f3c75e01c3c71608b5c866bf65b573ae9f474b5b2f7e035b952edcf790d6d1ce164436152417f3f279bc1c4c5032332e04ab8eab28649af	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
796	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
796	iexplore.exe
796	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1972	796	iexplore.exe	28
PID 796 wrote to memory of 1972	796	iexplore.exe	28
PID 796 wrote to memory of 1972	796	iexplore.exe	28
PID 796 wrote to memory of 1972	796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\STORE\Store\INFOSTORE\article5.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e384abbe77829ad5bbf9adccdeb4cf1

SHA1
867185825ac96b721f935d179072d49e16c066f4

SHA256
7065e4735aabfd8efa0808a72fd946fa2be6c70654a2e82f5d6cbc38181a6ce9

SHA512
4e8995b0fcffd85f2862145a5b2ef7ba59f2e49bf2863e5b43d58092e125138f5aff59ac63c0fc7b025c5e73f621d17dae3d2a8477d601551965cd61daae99b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10d728db0d5b9c393f8428251b076bea

SHA1
850d49ede1a110b42d2aa1fa109747fa5519e5c2

SHA256
02cd0b44daaf55f50459166e4e3dae6e7f63ee33ed03e03fedda6166624b346e

SHA512
b6822cb37f11d59c281fe3cf5b8874db6a1ae382bd047054b6cc6409268beaf18928052ae2b87a73a9b8314704aac5b6105218b3aa80c66f5d3af16b51f8822d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cab7246bc070da8c182eeb307f1dddf7

SHA1
99a714176a885864df257f7213ee77df7bbe95e9

SHA256
c8b55db9c45ab305193e9c7c8cd1ce04bd71872786ca8661df6f7d62823bb17a

SHA512
f4e533e663fff5bc95e9359ce4d78a4f4f7fd91acffe7e98c8e5d9633ac6f8d36ef170d4b5675ecc8d3eb1c5284f05ce886274fc82b6c85f006247e6de1b5dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc337b67d12fdd2663cd3016c14bdf91

SHA1
704726e9b9df7dcff537463a192bcc8da80d506d

SHA256
8fd640bf752b09007c25bbf04842aac0cbd79c95e089cf53181a0864b33a042b

SHA512
fd0595a1edc42b4794830af66464142c3b3bdeaa04b50d85643447ed6c1a8de1f5ac717bd22026bfd9629461deca7575fa1ca116f12559d6ae860882fa2a8e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0334d9046d982980ba6298b8fffb0942

SHA1
1cefaa506b724f1a698613cc82626e1575512357

SHA256
655609e22bbbe4aee1ea50719cb98c8ba49ac9a5c3285039859d72b4cb2e391f

SHA512
d992c52967b0b04e530bc3fcad55766a9cbe6babcc7016819e49b4119178a4baa92353e742857cb6ee66f9df7397a936e16e78cd0d7af7615b834e4d45481c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e196eefeb1607fd4d88fabb2587cabf7

SHA1
158e59efc9587a973498e132a0f24b6f9edecb96

SHA256
fdeffeec192957bfea55dbe68ee69a2aafdd9a104c494a26d788a3f79ad84766

SHA512
73a4df904303d203c0448bbf7b70ab021e92eb19fed2c045675b4ea51ef5bead5892c560843bbe630608a5996ebb472ed1fd175cae2ceaf5ed57e31e480cd1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dba4f4e0ccdb6654fc4b7968217aebb

SHA1
f36c23cb67c018f67856fe247618cacebc4b337a

SHA256
aef98e134aab5e6b0614cf4afa53a4ae7a76f491562185c0a33c3ad6b08ee220

SHA512
5c8e5909914f208c657a476fbb5ccd99310643b9207876bad23ff4f1702744326862368ae881755d72dd1878a1877008ba45be8791477220ce430665d4360851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4684a40a1598bc5cce6892053bdd6316

SHA1
a8122af9281d8b0d5e30985be4237b2a856b864b

SHA256
7e282b7f1c0cf0e69bae4238c7b4d24113b27f4b6671c61c1d0ff6fa10467eaf

SHA512
c95a1000686d8e055395d6762d2dbf48667720e3c72328c8082787cbadaa002ec204c2eda5b70355e1d4df73cffdabb94c2c9f82365fd9c604629a404b53924a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d26c55cfa85f1e8fed4ac04ca406bbe

SHA1
3a072621aa4daae63235d623214566d644516a71

SHA256
af7e21c65d3e0a802241c38fd24972a9a877a8f860747dad1c224d9723de3f77

SHA512
c2594b926a0c13191c463cd5f79dca4cb68b7ba4cfa10881c90d885a531214d0aa2e6507be1f98467ab189df32f6b844eac1641372a63a8a9c7f476ec9ecc31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b026f1e4029ec141a7078a9a2a324f1

SHA1
6d17b9feb4a7914c5e03283d796615bad78fa0be

SHA256
4b88bd2784fdc7a00353f8048a6ed92473d80edd0b1325d04e9def9db439d994

SHA512
4dbb92617b18d838492b942d402596c8db96f335e42bb5e77d8e10926eed97ef9edef1e50b998d486ddb35643072c4b2652acfa8387f37b298279dd5e8e10e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724a372e9c1d4ef0f42fe19cf89043e7

SHA1
13e523c8d735e32eca370f6ae3cfde430fe66358

SHA256
138efe1e90875e8f4998d745828094119198260fe384724f9f555148962f2071

SHA512
b68cb5fe9f731aa94919f7fb35cdf960a3b6a836b28efc8841ab0ef63d911713d71db02a64c1f0a4878b3041fff189b5c1eff3996400d31093b34b8a4bb78bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7548802d3fbe1920b450a37ed9a2f80b

SHA1
eec9fb36a78987fe32ad1b85f447bdbf9cf394c1

SHA256
290b3c3cfab058398242f9f29b2e789b0641b178a5ac0259d3715679a2398dbe

SHA512
20facacce51e10149309e985f8e4d432cdb23244b2eae2c4bfe529c330aa2b9603204b65da558954ed1815a95324bbb6e9f364e554db8388e1d5e2b1088effda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4174f0e5990bbdf420b6d4268a20fa84

SHA1
992202e7eee809e1df5154fac7fab72c2e87e529

SHA256
9ec214c35e72d2771b283e460ac13f94195f95c4544dcf9f37f5081337decccd

SHA512
b85886d9dfc25b3bf27148746b3656104206804b764ac8bb534ca7fde1f3d3eb43ba68900100d003d65a7ca874ce1afa010314187a34e91f73c1ddf7ea6fb4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a139f5d6cdb19832e24307bda60ecc5

SHA1
b59700244673f03dc149bfafb99de264cd78d734

SHA256
50d70a41b888a4bd9d337f5a9a60f61787e79d8b2e0b76b6dcd769f53a7a59fc

SHA512
83266f3cc3dc96509dc7564108f9a0e24e8b32297f5fc06c6ae9f3aaf60a0082a5c2bfed18d8d8da4e221f33cbfe7e27350c507b7e0f10d77d6b579ace4c782d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17ca5b1b075f6d5630d24ad5dd5df08f

SHA1
b42cdd04be2505737700667ceacee1f7a692f9b3

SHA256
7723e315f0b458a6cca00eec0fb0debeeaa9648e3aca56ecc667badc605340c5

SHA512
570d8732225db212846fd131675342bde5fff29d65923cff5f6148023725a5365075ca384deaae2cbea533f8ee6f31696d7599d0b974cb1f695da94b71a28f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d274f9b01cf506f4131b5c499860a941

SHA1
8b2f491abc9277dace9da59a9bf4a0ad29353dd4

SHA256
035cf41b72aaa4cc71ac22368a4d95294c33b7609be19bc67f5c73642f394709

SHA512
4c1b1868a2fef305bd30535c57a4a7bc231238347ae00aad6eb0c32fe36fcbb798c7e6a121d7f9bb0db59c008b8c98af80571a385d6a7a8ecdefd8cabdd906e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab569B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar575A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit