bfb16d1190106657d4f1c190c313a91a9563028c5f0b8b10f198f802f9bb3f8b

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
26-10-2023 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aboutCompat.html
Size

1KB
MD5

c4c061b20041a0aed2607935b632d57e
SHA1

43ca40859dc435fc1061c7a5a9700b0634951536
SHA256

e2fddef0e9477e6c24dc3be592f69c1dfbcc0a1f5e4e738a034a8e58ad2b86f4
SHA512

ca8ea99ad72e3043f41b6c55db20a8976fddc1cddac4c2501da0ce096c02393c8b031d1df3dbd26e5b82c8d742d30adce1c7c8e1463a88dbee67ef62171c8e72

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000dcbdbdf402975f1aa3bfab8dfd6a25ee8943d4250abc6130b3e35c987ddf7aee000000000e8000000002000020000000e83bcf524b649dbbfd629b36a0b5988fa075a7a1fc0e644a7cf63f57a6449df790000000b5b75e9121101e9a35b2b1a34067eccae2ae8c5263f8d49ccdad51b7a180606645ea7d0c09211aad1f8b8b79c6b9b9eda187630797e54ee7a4a56a8206b62ab89545ce3f5309fedb90d471eca474aae124697857e85baefa00cd1391a2f7abd5adcf992614f8f3a5955f9713411d83007f4ffcdb1a09ff7e19676d960c35fe73d75545056d55ecb461be5b77d9a0faf54000000007d15d1e295e0ac542a2417f1be25350ec8ca4f482720e7a708734992b765a981494906b579866c5210bbc7fffdd18b781120263ce356317944bfed9d8c7bd0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D48E7091-744B-11EE-8968-CE951E2947DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404519822"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000dd6df886948ff20fc66119c8b0aaee82454541f49478dd6f7b4d1cf925ffaa75000000000e8000000002000020000000f1be31ce9e9fee0d958227a1eae0050d4b5f857d0c831aa900ee8333b5fd80912000000049c124be27b543a477e847eb29b07602d59b690e0858585d0106fd117346647f4000000053f0099443711526fceff2d8254fa4d0ef4c21323945e769732ffad73e8ee03a491122b9bd738749b0603bed33a797044f455bec9f40ba6da3caded4c9a0deca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0502ea95808da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1380	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1380	iexplore.exe
1380	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2052	1380	iexplore.exe	28
PID 1380 wrote to memory of 2052	1380	iexplore.exe	28
PID 1380 wrote to memory of 2052	1380	iexplore.exe	28
PID 1380 wrote to memory of 2052	1380	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aboutCompat.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8e8157e691cd487c9e6cf8cf8744e4

SHA1
890bf7f0ed04dd85256b400600f9c78299244e14

SHA256
0b6cd3beb2943c528f0e358572f51293175b2947f50474a04a0a7253cad82962

SHA512
5352f0fb2534c1a94dce42794a10ea000d12b9f718112e6a9a9a3e0564c4a62067bc591c3929db71d45992aa766dfff5cd0585611c1472293581cf890757d0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c92d8eda7df6de6778642e4e8e5599ab

SHA1
87ee65f5d8985965593cb8c107711e5c205e3ca6

SHA256
f795bf700569cf10a31a037142de39dfa50fc687402c47f8c765a0c958887394

SHA512
a1a38b40be0246d947b58a4fb4bba97b193938892b6e0769939c65c2595fad73b0523f9eee5e3bae3aed1e1ea1917ba72f64f7a8c744312293c99dfdac6e4e70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f92501ddc711fcba13f36d941f4271f

SHA1
93598e53d4acf7ad7c615a9b59d84277681f59f4

SHA256
3b9eb950dfb7c1e3d099926c53de945d2ec1b234858aa1243ffce0aa7500a89f

SHA512
76d9fa666a8524056cb0ee6045555b2741d3d31e575e18ba416f5ae10068a9dd903e35c742d3894f708cfc500df37b1dc34b2882c264a6256535f364d13d98bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4759289e1f680f56b84a530cd1fcee20

SHA1
ae2a317a241259b6ff6d92fbd9dda7c1ca0c8736

SHA256
67205f1990b6e3c394ce428ecfa4fdec009674f3416b902c4e960fef97734429

SHA512
f1d4cf4ad82dbff53d7083097925b1b602ea1b800010f7148ec702865bc384d3e7b4ed29eb3327d5e292c5985cb039a119dc956d326150dd7089f4e93f3b3b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
625e3a3b0971938ee304a23643de2bd3

SHA1
b2c250d2e47d7e55bb6d11a6ebc1cf7b6334c509

SHA256
e95afdcb5c08d92aed45dc5ed278ac90e621c557239dee8251ec34788474629a

SHA512
64b51eded3181c84b7a44ecab49168ce8d66eb35aeff47e6985307c0c98490e5e9783591d22f87cf0c494c6252b33f49af8d2f27f9cfb74605b00ea2352cc127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f76b6a3652299b1590fba854fa8ee8b

SHA1
26a316671981a3df352a1f3d2ba96c94d24a1ecd

SHA256
d18da9c0f329ac6f7aeca39c8330ac45454011db61d01cb2c181f3e100ea82d0

SHA512
d5eea1f6df95285135ad70aa325bc0c566d5de7078a0c13f212258d7e36d5c3ee49c669d76a1e4286c97b77c5a22def685e49b55ee420c1d5fba21737e026580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67ba6e66563845758ef69f6fdf6fabd0

SHA1
5351e68cb705035425e10c4e3a145c2f1b54a02d

SHA256
747d6a980cf4f168713d414d1d29bcae3fc6fbb697724823198d7bb2f927aecb

SHA512
021036bbb27ee26f8acb909c58846337f68331c3db33712918f3328ee45a557b77e6fb7b050ebd7cf0beb4bf814c01eb9104d0f26822b6f76fb762e1b3822acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a61a0233a716202fbeb27f44291b9fda

SHA1
add64f842df3240f4f78b9400e77b39fcc0e4845

SHA256
7b949e883fc5eca64737166019938fc930051f212e9b9fa64308b98619edaf7c

SHA512
a06140b1d58b8ca6c295d8a7aecde5f70ad94e366627a3b459da0a3d8bb1d7d0706e29dc1df4093e7a6c59edfa3fb071606d5912ef8681fa4fee49e05ea9a0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a126f5d7a4b441cf4f7bab64f0a0c407

SHA1
75100af2b3361bcd2914036e93d5f845aa73eeb5

SHA256
8f199c146d3e7651999da7e4aa0df732f41cd7303ae31676ce51526321d30da0

SHA512
68e12ba56968238947dac595189a88a6abc101bce6508ae5760800eb64926105ab3b2adc5b6daf9174079be2f3ea82832db231420d011f08af029978412e07c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ced08df07cae3d5cf23de63a8cffde2

SHA1
f351a8914aa31e4b5ff18dad38384e45e50e498c

SHA256
a7b6adb8f16730af8fc256c5fdb9f1cd5f1e2ad9f430996adcf40c0137c0706d

SHA512
029bd14c4a582643390cc11497d9e91c826eca571d8d707ec7e4d8adf478d18a16f5b797b4c0d68945d353c04316066e743c7a981cd37127d31e2b30fced808f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5096ae976b3132ff68bce4a0c8efe6

SHA1
724396f70a04f48ee8e7a108d216a2db9dada294

SHA256
46363f2139987c75f1afd9c37c0cac9fddd86baf3d8c945d94b4d19db19cabf9

SHA512
a2606530578e4388d3bc27f38a50ec32222ebff87ea63cca34585bb12bc73b92a663df183dd48d8d0edba502495ca841e03beb5b590d0564c36db09a78d3e28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6089f6fa2398770c80728489ad6ad87b

SHA1
ea25d8175128ce3aad374db3be05d62d4ccc2dcf

SHA256
5ce7155b09ca089a115ac873dc87e092554b69012b748fb10eb05dbbd76df733

SHA512
5091cfa8f395bd8792e508ba99d4a7a61c231b77f001e6f45ee415eed3ceb60bc3d1443c842f5155af3ba6b39c28a3ef02f702ca22168e1c709a9f9dd1fcda5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87be256b1efc10b92b14ade1be4acafb

SHA1
1b8cce64a6309abce5fad8d24b32bb63bab234c6

SHA256
2571395561577e567a972c652be3e6348cc1482954a4a9709768a1e00d1678b4

SHA512
a88e225f056cf3636b116c049442f0fa0bd931e9efc1b2ef6cdd8202b82b0097edff1665f3d316729af86f5f683cc93227638404e6cf900c4362a8279fa5f028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42c915b1c1b229438923bbc16e01c20

SHA1
6b1ab48a0f53bc1e2806a05cba723509acda6c69

SHA256
bf5896df1694bdf1bf3aebe3549c65fe9d895884d843cfa13d463081b1a06536

SHA512
1357cc84f3f603279c3a0c2ec007e2e29e9920e4af1f75492439edb702ca56391460037046d7cee4db04c43e884a76e28e4318f6eb7a140e4c7d4b6f9f23807b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c82d64a9ba0d8e5a3fd71ebeb43952

SHA1
92a7c0645b82da3c33f0c47d7fce327ada95b99c

SHA256
237ffba18329bd494600d79ca55e923676f27d7cbb8b57dc923c00bf7ddf0b96

SHA512
2937d438a511533fe538900122121bad1a6f27e42d417ce6e5e11fc96c0a48a707164cf097991cb2bc85b8597aa4ed689aacd2701436581a02b8e01bba01943d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3527016dcfbc848dceb629605b4532d5

SHA1
ea35442863bb9aecf693bd53c46c44a167d6d773

SHA256
ced430fd5e8b8d26de3ecf5996e8270f25d7f2217667dd38ff6d6c4182dd3349

SHA512
d2856fd42deadc009b0074a72449967d4d20eeffe820675aa632107d9a51467a6a1f15d4c1e1f5432ecc56a3f8f4dd034541d963c94507df9b39cc435f009c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcb8f6f4dfa8dee511d497ca11d6447b

SHA1
aa07b91cec36464ee31139b58e8405427cdc0d69

SHA256
d5d5b3589703ad42a90d9c64904ed99a5f6177b01b569761e3758cd13a67e9ac

SHA512
dfa85335c74e24244d5fcc3e4c3f92fbe23ba37996164a3873066563585e98c2f9314b2faaec25b06ce48bdbae825abc6858cd4a473ee6290447b5ff5759cb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab719A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7297.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit