e9a0a2d8c40370547dbde0e4e80e0134be9e61d5d5a2c6079940b2e6ff6d090e

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch07.html
Size

11KB
MD5

05da624a31b19d3476ef87ca74effe5f
SHA1

d123b06987f0dcaa1644d61fb0cc697b62a358ce
SHA256

c838b911a08611d5eaea547c6102c327790076ca930695baf83e10846c2bc680
SHA512

6b1b20dd599ae35bb5db052fe5fa2e9c05948890dd524a586efceeb4c953c32ed351545411930cbc29dfbe8f0c3713d5a09505a7135bb00b5c724682ae215534
SSDEEP

192:nyvOHbiFNSMu3e9LfOThsorqgk9hONDkrK9V/QPxWP+YCBF3R:nyvO7qYkUhsooAFDPq1R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4962890-7D79-11EE-9877-62F381BBBBA9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000001687b27232b593aa613c856da4406f52765ef4e02051414e6f6b59efc35f41c9000000000e8000000002000020000000d99cf07adfbf74aeef76c91820f9ede2d5986c6bbe9d69a0c675649abf76307a900000004ed84812f5f30a99b1d54bebe287f011860226a1dd84e2872dabdf1be8b03cd24a3cdeaca5df579783354652cb7ef732466b5599d3c228294c0ed708de381672306a90ea7035593f7843a493acfe9e33730811e465d69c006e3fb743bcc299a23100a37c5e5c16c36e06a4aae67bd09abbdef370e97da332a008900961152e292218f1d9f32722166f739e2ee8c6b821400000009a0064e0bb4647a2798e61855b880e29f0f7b66de6680b731f8d0f3325e336a024d86f0f83939164cbedf6f019deea2684e04c21539e287f5e5931e9f45594ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000046259793a89028587844c1a3aff8f199fe764f2bdc5e75d56785aeadedad9db0000000000e8000000002000020000000fc2aae5f6508f1145920de1a7b92ff6f54a68fc9d6e5894dfe3786a883e2499f200000000ecc46fcbef4975cd8959b8a1f5d31c3fed634dd5d2922c665e96541091ca947400000008bc656707143309c3d58ed082243fb646847a778a7f6ff1b090a256f7847bb472eff61571635145f3cfccb02088c01850aed0ba391de0a931212b24872f9d197	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300a9a998611da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405529112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2116	2868	iexplore.exe	29
PID 2868 wrote to memory of 2116	2868	iexplore.exe	29
PID 2868 wrote to memory of 2116	2868	iexplore.exe	29
PID 2868 wrote to memory of 2116	2868	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch07.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
101119ecd749352c70251c6f2e3abbc2

SHA1
bc53c30794c9edb8a0e3f76e6587b365b6bba975

SHA256
d30e9ba61bb5fdf32ebcc5b0f6b0cb2d212e20939c054c7f260970667828d404

SHA512
44f1a0461a4523e167edb278cff4001d71100f9427f2d451146d2862fd1f266d8e4041818fbaf0caf61ca7c8184f9c5c4d63b138fa8e813f0196b586125d7c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeb61944e24426161f26e7890e92cf83

SHA1
be11df0a5853ccf8ff6396d131df2f850932bcd6

SHA256
35ebbdd80174c2855cbe2155e08627abdd9bbce73c7f2b78b7a0b85d6028aca8

SHA512
ab2e525c9e7d93e3d01d47803632caf603450f28d60f5eefd0307c70c3af7789b530447e91a119cfa0faef6f0f6f3b23097d71c2d8d9cd24a5bc1d63c71389ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbe0b0164df243fb8ebc9911ca8527db

SHA1
e260f56f0994e9ea05b840def430284a35639f60

SHA256
19743eada047ff93b0c2b8be402cd275c6cd1ec4df4ab8b6d335d9ee7c1b69c5

SHA512
4f8c24abf89d0a07fb2b54909c725839cbb275122b355a51dfa7f118b434cc2fd7a095d5d22c7d1370e7838e0a68500e17434e02900550868e0cbefe5733aeca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc318b7f391fc9c14612882a53c5a66f

SHA1
1bbf9f580ab132b3010d850a209323ec5bb2246d

SHA256
ca9965207439f37a55ae7ab013d3038a46537ff4613c3c2a94f0dd7ecc27c86a

SHA512
aeddc7375bd24cc34b16bdadd346e68aa35da90c399fbc4522357988b419c84b3450adc83bdaca07c57a3440cdcca67596fd8b9adb86fdc96671043ab4a9cf0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce998a1487df7d1bb960f3fdd1c238d7

SHA1
e3e24fa28177e232c684cafa188f7db2c749f86e

SHA256
ded46064e653d93d3ac2ba17cd2261a72166c4a9e0b89a5bcb818db7559c6ae0

SHA512
0b00361f000732cd8010409d1b5fcf58f341e25074dd36b3194b1ee59aa4e03e9d34efbf3e54bdfb21fc4566c47527a08157af4233d5765899bd1a1a1ee2f3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdde65b8af6e6cd357fc2b3111319bc3

SHA1
d7e416278342df7b9611172a9644dc75aee83cfd

SHA256
ce93ec98d641dcb9852f8a7a6e6bba5f7f61ed21df2dda3a5b2200d0dadd82c8

SHA512
3f56a0631e8829e8c1676319d5a2fdf7f936e3e475d44bd955705ca2dc5a1cd18fb5c3f192648625f846836af9ff5f2166a6a6dd5dad6ffdecbef674017de90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50e19210a87a29950aa87a50a518f1be

SHA1
da2dabf3bc05ee87275aa478a22ff953304c98f9

SHA256
478a4d0da54f138903a9b0653826487d8547f5cb712e92db73675d28620294c5

SHA512
0f31d11cc8f54d5d6dd7ac234548eb0575ccb9487125e6119ad5383db5b1c7de865782642dd25bef1d8f9e05e35119c0a74300db5f4cdcda5b153d276acb695f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db362a08807243568635995fa4acbe60

SHA1
98a63c59ee991d2c33145f1e98158f3d5035d126

SHA256
2fc4a69145f3e19db34da9111d20e6a270a098fab1c11ff85e797969a096bfab

SHA512
4cd2dcd303fda30f2cce7e28c8f3fc288b50299e0616beec1dde842e38035471168a1b8c306c05210e9903f286a921eba7a8331ddb1b9bcf89cbfb7ba3db1d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3fedd9afb1ea79ea9b40dfd649220e3

SHA1
fc081abd7d1960ce696503f703d389fa71cc3a49

SHA256
a8034f9cffee279259b775fb35e8364b906e7b319aac7b55623a15ab2501c5ed

SHA512
dfc3c2440e2fd09aa59d357db98d1a437cf86bb4013e49550bf6c8cbc91df3d455cdd66f65e82a584d51eb5a9e2826849e07f79edd5a39a61e45607431334b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d2a173804bb48020d8e158feec9177

SHA1
3fcf007d4b739761c10004eabab094bf1f7fe07f

SHA256
dc462bcbca630d58d92f956fe4e0b989cd2b1530cddf233555e6d524066d084b

SHA512
aed2ce49c929a36f392f82b050ff3d7e44ddd9f67653d0fe97c6fd0a19d41db9802d089849d7fb1379acf50fa0d4d4b39c67fc7effafe4a19da1528add75509a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51EA.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar521C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit