38221c27321a72395ed70e3d0290fd22d4349b5c1317443bcf0b69ee5eef37bf

Analysis

max time kernel
118s
max time network
155s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app-comment-list.html
Size

1KB
MD5

36e8581c235b6f89fd79d95d123bd2fc
SHA1

eff2a1610936a10c1d4ac5e4744ff48558b9cdf2
SHA256

5ad5d8992f94c711da7d9ee357ec20feec8e38ffba7eecf5be37b1e84fd4954a
SHA512

acd3743e58d4e59070754903ab159f12ec0dde2f43925dffc1a73fff6f6c66f2dca7350102030c58e3f66aa1355e1087a71c206c496317ffe8faafba19ba8dea

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000007fb468665a88bc4324e78667318ce373921f0979b151238bb18612fd21901338000000000e8000000002000020000000e23101e669ccb8e3a6ebe87228ecefbbfc859f15cc0d9da03e728008cfa15a32200000003223d0379cbc0cfefcb4474a6ac03f7e52310ed73cfb7596b5928cb75b35b39f40000000f07494254e687dce4145b95b32eed3ab9e6376fe9211556878ac2ed97594cbaf41668e1d2fcdb5ac59ee81b168dc3fc45c423448be966bb399b1b59ea8d985fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8030ed609206da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404324706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000d6cdff583c59864432e7920bf526cc4a8da5a17727523e2df61770c382f73a7e000000000e80000000020000200000005460954603e8b0e2787623ca1f81c911fafa6b0cb7d051f419f7742fe07b07c190000000b2af6f843625f20a37e85f9ba902b95c5fca47e05e2fa7c76194c7ef2fd3e900a2edd3a11a021367a2bc14cd2ac7ac002c3a9e723a090a6c6565d8346abbf280ff4740e79e49d468a06089d755287cec8b20f118087497a6a141822b93c88fc6d134c9ecfffd08f73c7ae5ecf213bfd6539f5fd80159cb1e1220585a07eb9b80ce15db4ea3c5ce594bc05ec14e0a88da40000000695eeea17b4e99b7f42b96cae34e92202809ed94f9d296dd15a4c0363e9504b29688286b9d47cd70cadc68321bf000343902b4453938027736cd91ed16a28df3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B15D241-7285-11EE-AF8E-CE6C5FBC16FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2760	2216	iexplore.exe	28
PID 2216 wrote to memory of 2760	2216	iexplore.exe	28
PID 2216 wrote to memory of 2760	2216	iexplore.exe	28
PID 2216 wrote to memory of 2760	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\app-comment-list.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdbf2763fe6d145486f831be0727b992

SHA1
6f41f45669083745ce726b827701de630da29c59

SHA256
d6d5fde0c48300cf69236ec68f0001996f4fa1cb5d9ca4c122573f1c1c338aba

SHA512
1b444882120fb97b1cdbfbefcb1c182344e0b566b748ac8545ca4cd5171729aef6457bf540338d38242acff04c85a8629095bb5052687b6c0ba170e5ed1961e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f228be7e85b2910a41d2e5963cacdf2f

SHA1
7658349c8669b7290c49e4e6b241c331a7d33c71

SHA256
cc4c71dec59640dc8d8ca1d1a12edb93564e51bd194f7a00cfd8b9c5eee9a768

SHA512
7c06c0d575d6daf1962c8da0d7661b32fc9d6554db12c0705268bdb44dd38e49d6e60f55ea8faefeba0b8948766d668dad3b96006ffd642fd52415dcbc3e9682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
950c84f16a3e87a7f8cc4e86b3679ea2

SHA1
35a6c4cea5e5bd64c9999688d20ddf58d522831e

SHA256
26f6ee65cab36a9df1190cc2588ff7e2b7174b097850807cbf7eebe95eb6229c

SHA512
e662b2a6059c1d31bb4d2f79fb3b6ad51aee67c605e10fde819cc0d25a72473f5c2f95bf7f987e591395d7fab5cfccbb4dfad7d363a3faf12231aa6541f82bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7cb7a8723e60f5d5d72560efcc3d070

SHA1
8d30e2956af36bef550bce4aa2e7e213e3082849

SHA256
8af39564b24c5d42b8fa8ea6ef6f61b5b6be83f3dfaaec04f27d4a28401af9f2

SHA512
4d65de79a1a7f70793e7b03ad39453094a708ba335ffef9f6382e7479ad361518faad1c5f38a5074c88ad63d74b51350b2d3612a22f0dc5a1ce90e602f3124b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4173ed2d99627dbc0dfd6fdffd9a4207

SHA1
39fad331086b0806af1b5cd86f158e88c34d8edf

SHA256
3bdea498bd3f4a028d0faf999be36abc1bd68e8baece96091010ff5e03a614a5

SHA512
9ce6b1149b139f6fc7b1d7cecc36cbf1b10470a63ff4ce3702801842209e229ef22089e2b7e71270ee4e335595a5f2dd15ef95670f227ae591cfcc6de2e1f358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9e1ea7f936215ad6a3233595e57b85

SHA1
d9bfe936a552a165a0e99cb4c17b0ea6bd233800

SHA256
78a8a739abffb811fd53903a0fa769c8c785a7bee25129a9094fe2a0d49c0f93

SHA512
cbdb7e1c0f1ae43f3be120baeb82c73345223f923e6e1d5a5c25b193eeb4c31823ca0c7adb155b57c63c1a9e5fb8620d91293d8dcec3d5d5ff00b2ec487c8db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e50b4d0eb6afb04bd1b8318b5c9e8f1

SHA1
9f7c0ced8d46e4f22d2454928ab86c0616599986

SHA256
009bcdcff4ce0d94530644c3155ae41c510f20761355cba5b7b2ffbab791cd85

SHA512
49c90dbb56c6d1177f68aeb02e734b209d58dde6aacb5e7e3c4bc8c6873f07994e2bdc3182a2e7eb4788abfc2b6e4d62707e7867858264e1a766e56918273244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43aa6fc2b3103f81b3b414da161cca2

SHA1
aebc3ece03629852971735046a9ecd88d87b0923

SHA256
b7b7995bab47d2b9b23a2caf679f354f1f9292c19a0aa6bce84e24e7e9645f9f

SHA512
57e435b9cbe6e25c9dd045fac5651910665adbcbee6395c4422030df25a91ec5630158abf74e9ba492a22f8a8347de94ad25cdd542e1017593b4c4e007d1f12a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
399aaf9c42f3f190a1a6f94308f76c48

SHA1
5a103b716dc8117caed62ce51b055bab33a4fd23

SHA256
371e213c1eeed5be00af64989185e4349f2fd84f0cd398a55466fcea2135da69

SHA512
e99ef217e44f77d4b42b8833fce380a9ca682c449b486f182af762a4dfe3ce90c99afa77dcb75bc3da3cb77bb56307328b9ee50358c6dae7fb04b909f6d17876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301b1100a05dfde2c7ca36fa07bf1721

SHA1
32bec33b0bb2bbab3e38f166ef74d6f6fbfaa3ef

SHA256
3e109b36915371d68e1650140b4bbe921b612db122e11960d560e23acf38a9fb

SHA512
cf2d71a98fc761c53dddbaae6a1f43070ec40e5236e2ab505aba26ff887dab1e6a64d18d7603faec3016f2894066ebf270e21d7b348c1f7962a43130c227342f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1789.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17AC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit