e9a0a2d8c40370547dbde0e4e80e0134be9e61d5d5a2c6079940b2e6ff6d090e

Analysis

max time kernel
165s
max time network
200s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch08.html
Size

6KB
MD5

d39029b9046f1801ca1a3b2fbe534081
SHA1

946f8dacca6d608d13d31a2f0b9f4fe16f67e9ef
SHA256

d31c209d303cc61e1c500dc6cb08d14c47beb2643aea91d1e5af5cf6e762d174
SHA512

ad9a31714ca977162e4cf17510580b81129da9277ad954e206a596e4d05f0ee861fc93035474ff8311111ef1e8e59fe7b566f9a80cb15a415c75586c74ca0623
SSDEEP

96:nBAvOHev4PpeVoIlNaLga+AK3f0ejiCHJUDDegXVehYeq63NedL3n21eVgonFPmB:nyvOHpglNSieSGgNcXFmWGivNW3R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00F03381-7D7A-11EE-A91A-7277A2B39E8A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405529235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac0000000002000000000010660000000100002000000033858bdfcba2747e8596aa37485488caca9804380336c8955f401041cf42b2ef000000000e80000000020000200000001887616976e27bce978f227237660221b0dd2726ff5aa6480b594a1e57898a1b2000000091d78ce03dd50a945b2dc190a3a88cfbd5d0b275f29f1007cbf4254428454c9d4000000095e2935741cf33186f409ec6b851f731890f65f536519bb87035caa6ec454227c7a6cdac54e4586c4f06c76d4c070736c359f5ecb1373fc0aaa197071c8bce0e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501807d68611da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000b41141d06d4ba8cfa2f337800f180c924188e9f18c3d2f21bcaff540d7bd4480000000000e800000000200002000000019fb8574f5b099a9766b70347f6bc3ceeead6f54af13b9222114270a4f1740da9000000011784d1dba8ab0ea34c43bba145f4f39557ce49f7f40ce63859baa74b3bd7366166f19a072f7f9bb9bd0119453a5d9db91aec62178b77ba24b6b761676317f59cb424e0aa63f09bd17a3df0ad1251692d6bbb590a85ab7cdba8881e63ebd28b64cf2fea2f61b859463a0046b6b8a1300d0d88d9b9286fe2b4a2d7f80004c09ba9ce393589e2d9755e6a7ca867039be79400000000f6da98d90db79c7162b0acbaa5f9b00989560cfd9469a8307ff440844cb1473a91a05c2cd8427835249662ff89076af40d2823221cc53028f3b71b78dd960bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2704	2688	iexplore.exe	30
PID 2688 wrote to memory of 2704	2688	iexplore.exe	30
PID 2688 wrote to memory of 2704	2688	iexplore.exe	30
PID 2688 wrote to memory of 2704	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b01d8c7370e198d948c945b73f72eaf

SHA1
f239817f6e69d659a47cd091a39041fd67a96ab3

SHA256
f2446082782ff9b23401217f357450445c5415848388d17124c33d7c5a5f6ece

SHA512
68bd1428df1970fd68412f51d60f18489b1038782e841ddd6c32bfa8b55758dc1e1639c457b97570ca923afa93265f737df61a1eb10bdf50bdb1be76ac4bf5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dc304ff930462e18fd6979c5b1ff645

SHA1
903eeeaecf3f8a4334311abd3108ecaf409acb36

SHA256
43e2589ba569fb16244bb718e0e5696e8cf094efeb7b8e61d8adaad5f0a168dd

SHA512
453db0d83481a0b5f9af1ecb5080b90cc3eb9ac543fc5d04b5a3d1088501eeb7e20fb7f0aee393b6fa874b7559316d9724499b6b2a630edba8fd7ca7423b4aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18099c2359e549b337833deed3b7d3f

SHA1
97690269bdd9ca2f07003ea4c5525ad85910f7bc

SHA256
b505218ed3a9d7957d010aa76e893947e8651472a75899207ace6568983180f2

SHA512
2761ae50f55a9441ff9ea0161b9d773821fa822426f87e51b6290646ccc6f3212b2846efcdec94e4bd54bdf07c91ce29f5ec5beafb912928770fad5e6ca566a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca854cffcd04334b319e8222526e3f59

SHA1
bc5522c240800a7750c2a348779415ce7e5fec15

SHA256
080a9c6035d731cd5e73596e070c3d85af14b1238e0ca6172ba21f105def32e0

SHA512
f76bf91caf36306038d93e7a1fa3f4dc8f2d7c991ad5690899d30f891151b51068140d3df9a89db03fb899c5bf943dbcbeb9da680f911ba481d96941ebf9291a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d91e478ce57b6a891f032457603d771

SHA1
c2ed77409685b7e997fbca92eb6b5ff53f31c173

SHA256
843295f6f0f89e576d11bdb3cc418165266ff097cd394f3c050be912d06e9d6d

SHA512
f6ce17bdfa2a09a4b455ed6e81646e36423c5e4a1f175465d161ccf234e52c830979d8d4b8ceed47ca33c225dc09fa57b2ba7a35f6a3a0ceb3c2c521439181b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd91c5da13bd56548a0f3887362f07cc

SHA1
9bd8e8307bda0cac4cf69250a9978b92633e5773

SHA256
a1a6d96962f654b5ca593eef9497eee0e4613d0c938e7d9dc71791ca5a20ccdd

SHA512
1fed2c8e632cde415fdc41407590478579e36d076433a0893655c3b90569f98cce026c339bdc7915cb51be80a7c3d0e746af3741ffee9f431cec325d1793e4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99dcc80fd367f168c6005f28ea1b258

SHA1
d0062849717ea2fefe631d7ac9d478c2cc96a9b4

SHA256
1ca548e0f8ad58e5ab5754b63421033de1591588a515915136c486d832e672f9

SHA512
245e4173c60ccfa9aeaeba036dc7557a0d97084c947718ad1ae294d458db6c468535d8ddeef3c2981d148ff890c4eb3e8f3bf1552ecf61131dcd00b87db569fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af383fcd7ae161738b7ee5c0641a97a

SHA1
3c9be30e488ba9edb0d62e94463ccd6da2e41b01

SHA256
2915465b79a1d3ff63c3e633c04e715e666cf070c0659915f6bc367dd357f855

SHA512
581c64d8f7d2822bfa6155147362a9cebaf456d7b5473bdabcfb0444293f997317c4d49d20edc8ed7d16654c1d62307e12affeea95e718d419a8d1011e1e626d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd1cd75b86e64ccdbb37f5adace9cd8d

SHA1
ab97a46a3a18ff4c4910158061362b2f800d83f7

SHA256
297278838a0ea54d7935c6f89a32788a7dcc63227645daf9560e1fced976c037

SHA512
fea5863798c1616f61ffe7a25ab350de357d14cd8e3bba52c01d8a50ffa21417b92da2bc2ae5f0507039879f7f0d9ec7202fdacf80fb0b213525a05d04385f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd46d1b86e98d890967909bf0b5c6db9

SHA1
e992cb2e73f180613a5d5b8ed25e495dff028264

SHA256
50bfb30790280d289a3f583a6ecff3f126cffad4a292219e23b9ad4afc17c91a

SHA512
ef06dab7fd212f5ac2bc0d8d7abf693df0fa701ec8dca04802e88a072af55c16aa008158f1b4f6af8975c1ea4c7f5d9b02688710844821b0d82afcdcd437c90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dcf41d5f0134bff1c32f6fa6d97c09e

SHA1
c1cfdb81d9370c07f964dfd75dfe7c4b3b3023aa

SHA256
6a719375d84cb275a3e1ae20879f165fcfcf010c5ddbb6c01898fdea9d1e9a45

SHA512
c5ee7d75abb39721e65e6512076b58862c7642bed6bb5922d3789c3f168d343682eff09488ea5af85f976cdea7ace24e48f52ffbcacd11b0bdd6f0071b990f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e80ffdda2fd61d1dde4162a45ebaf08

SHA1
b5f96b9e4b60556ee517d930a8b1dcc0a3de1fd1

SHA256
09d99735eb57c60f8830d9ae299a90a6530636d040e9190fa9c8e349c4a85935

SHA512
e040e563a35f4f277cc46c32f92c6121ce8a3786e8f0214b89abf4bb2d6c42b68d572e3d7ef5580de3799ae71434529a00f26e09b03c05197d5326a90998ca96

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCE6.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA0.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit