e9a0a2d8c40370547dbde0e4e80e0134be9e61d5d5a2c6079940b2e6ff6d090e

Analysis

max time kernel
132s
max time network
151s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch12.html
Size

20KB
MD5

4fa9d6818edab84c6fc62498e560f3e4
SHA1

8d9764bfb50b941e891ccef8409022e0fa97f35b
SHA256

1805f0a86ea9a79045f9db504abc66f6368c6b043bd214468a4bf9ea9c67d924
SHA512

2b51a8e4610ede2f03bbaaa833841c97b216c20a6fc8d300e9722750fc640a1b2b2105572b509eb155dc698e37ccd5b4f7646ac51c8f6e599866608063884229
SSDEEP

384:nyvOMbY/iAQJWovWwX7eQQbKcPOvcqcgyQdv1fYSG+wUMu/kHQmR:n0OkAkWqWwX7UEcqcrQdvJYSXMu/kHVR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000b8c68930d4cd9f5f60b4e02da2eaff48e6ca5f01d480cb1794ffa8d390ff4c13000000000e8000000002000020000000d385288d712118f76cf93106bdf1484a3a512714fc718c2b21d266b5cefc04099000000095ce947f4ce5ce97fff6522505c9ad497efe364bbfcf0f74d4448f20c960dff430c6e653b00f4823ec01eac9cbeb4c2a6ae220048c56405e2f7d6d9361d91a3803ddbbcfaa59193ff2723e3df9b65544f4940b46008473ee5b5ac230ce71d19849e5d464e9b1ccb32f8aa0ab22d92ca84f4bae4469157b12c29694e6c3bca8b1ae363acfee4a35b47124f76cf3ed3d3740000000a348d7cb5fdaac7538479504b9a2b6a47372ab3aa7f5e3257e06ef24e00252988662b036ada083c62998a6e975c7b351d8303704b50ecf9d2ed9a0c6c8653de4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e7171840000000002000000000010660000000100002000000046315cf49520d5206e391b00319e94461ff4c04a92e5006ce2a8c6900091101c000000000e8000000002000020000000966ec416f77b7ba40cf4a1ed0bc20536d7af8403659d3b851203a737e5d0433720000000111d03a2a293c68d6d78725916d1f49f9fabd2370e9086285d6c749ca1b8a8c14000000094febd9d8070db1866126160754b8647b5e671ab218dc69b57632926301aa42d4363bf8ef68c2145d7b33efa7b0ae91a3c06a9e506d42903e00a58237cad9f96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e083c5cb8611da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405529196"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF28CF40-7D79-11EE-8F6E-4E210DC4A102} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2556	2164	iexplore.exe	30
PID 2164 wrote to memory of 2556	2164	iexplore.exe	30
PID 2164 wrote to memory of 2556	2164	iexplore.exe	30
PID 2164 wrote to memory of 2556	2164	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch12.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cca59ab2f979a51be9702fda53a87cd

SHA1
64de0cd8e604acbe060583e309d8c656b338d688

SHA256
4fcf68dfbce0567732e5c7328a5a27c9d337780446a8d7fa1024802100bb08da

SHA512
fdd19617d66224c2bacf81abb3caab93c95caf3e25d85d19f9a31a7181f1ff0d4ca802c1fe304bdaad1cb488617b0bbaf9f79eb4abfe2084a5d9bc08b15818a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c74ed4578a9cce4150530eac1ecc29ef

SHA1
3b420d09bb2d6806f83cdfe21ca4ecb8de2be412

SHA256
a0155bcae249e34920c1eeeb5ee7597eba7ad3e65f27318962fd1084e6fade20

SHA512
9493685b7da55feded5e2a549fb8a6719dd9c102d1afb90b8b4e75c8834da226da581ff490bd7180a6611eee974019e14067f3c7dd9229a256f187c515bbaca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa1804c472dc3b28d8f11e41e82a9ec

SHA1
09bec48204b4b6532e14c701737e0e02d54279ab

SHA256
6baa333f77b2a8d8ce4d4cda014a24a5917832098706bc1a9abfdfdce4922529

SHA512
2c8b9b0947523f5b2d2c637a0172b234c897c9a8b3671425a04a5795e551d44c30a00dcb393af5a5e7bbdb23a98be285ac547e74811b1c9bc7fa0c4bee75ff0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80f7a270f13286605144a719ac94c3d

SHA1
c70f039498d3528a7730ead6735e657dfdd590cf

SHA256
cd95befbb5fc23091cd8748b2cca2bd6fae84f16d7295f5cdf593bbeaddc7afc

SHA512
3557b2d9f28d17e38777d6859b8876592bef0cacbf26da35ec31f649f9e524a89640a7366dc37dbd0af1cc33aef9c7103e15e0f6d4f2aa52d594f1c367749f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a3d4082090b435aff4c412c4360d85f

SHA1
e1e5ebba88f3749ea1a553d1bb36e52cfb93ed1e

SHA256
e5b40d0eb228d8ca0f0ee368c086123d36b4da469ed62dc87eebf34aeae4736d

SHA512
0f896e9f0bf1fbb46372bb3c6d1aaaa905961015a209d2550961a8ca50e413a4e09198da780a330d642142685b294991552527c951c91e848c6f8e1ead14631a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1e8532c712a186ff167becb0639ccb3

SHA1
2da53ac6265b34e5209945ca176e9555acfae05e

SHA256
8f381d2976dd9a6f1dc2566118d7a8d5b3cbd2fa6c5a2d8f0c3371fc6bcb421d

SHA512
508521eba455a7dbff4fc1c6a1dd6ee0e0b08622c71c69d81d3181d075c6e9e2250699ab9fb43c17785803e0555e41aa6e42cc44367a37c833deac6bedd9f016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f2303c771077a7c46d26d1c306c0d5d

SHA1
6e40d77c05d363d5a4de8f55f30699630839604e

SHA256
aed2b538da654b9ce19ea2179f591c86a6d072b73e1f970bd651490b1a681530

SHA512
81234988e968083df11cbb5daddca87e5a301f8115a36c6c04a248e1a1d57c2b17a77425f2434defc61025632f9854c604bd8235a4e70d88e13470808abedbd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d7adceeafea2f7d52db6310397937d

SHA1
988dcfd4d38c38d3598ae6d3fce7d7525458aeb1

SHA256
9c18f3a7e153bcae05de35ddc37fe52ded303a1ce30646c1cff73348e4e5e012

SHA512
749b81c43d3d691e7ede4ec8f31d86e3504c5bf755534945f9de9b9cb6f544c16f674b197a9311dd07e1e49bbee0db98864c3033e1f614527410ceefbb39a908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e889002d730e8908f0a3446caa4312

SHA1
54ce2113a00bd365ec28a110092386e18b77ac2f

SHA256
741fe22480df5d1c5a9636a1d286735c86189745e0e536791e93971240edb08e

SHA512
056a1485962641d7444b6e913364e847c46e98740e9e4ea8fab10c8965b190f1f5c0286dbb3a2062c3d51f29467249340e90e8adbe59f8706b8744dd176eaa13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2cd443c722c7df06477bb61ee04d2bb

SHA1
b3ad52f422984b6f4f18babcfaaca60dd46ddbd5

SHA256
4fb363508dd9bdd24872f6d390d4158a7844e1030bc1e6c26cae2c9650d17864

SHA512
4d5618d5d661f53da5842d9e5ff6daa62c0786e36e2955463b2db5fb17aab2bb78cdcfb0dca39de4d8e8437c9a4d0cc1e397d24f79b0447ee5e121b1007511e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB187.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB199.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit