e9a0a2d8c40370547dbde0e4e80e0134be9e61d5d5a2c6079940b2e6ff6d090e

Analysis

max time kernel
121s
max time network
151s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.html
Size

26KB
MD5

b2c1f394f06feb6114de2270add928d7
SHA1

e1d05bb53e969de9fb6b3509fc3268f643b544df
SHA256

25b285907884500f4d1c5aff05405462ba2cb92c3abaf42d406fe0a13a53ca97
SHA512

0058020b49b3d826ca6c9f011aa4c903e95a90ba0063afd7e01059a081f9b19ac6fb77bc30a4cf223b80586f6c0adecf15148c4290323f94c470d6b63ac1196c
SSDEEP

192:nyvOH6HpNSpAt+IGWG9jj/r+jDQYeP9upe5EQ0CalfqLwHFVn6DNgA7ma1UDHaHB:nyvOaJYI+IfGtViej0zI4DHa3R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1B21230-7D79-11EE-98F4-DA2779F8C99B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405529190"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000009491b8d61b28a9df9ad41187659c49384895d77d26e3072b1dd3182f81efcdec000000000e80000000020000200000004e41335b4ba721ee33f58c5ebc7f0ea63e3732fa194f65341e3e36c3bd66a91f20000000aefae71c94c1cc25c5a095c9b620adf0470afaaecc7d4ae05d0875bae7a4d46840000000b4652c204eb06bbdada88fb299857d97c6e332ff600dfd79404c79aaf5b4f528862f2f213c3260c369e6ff6142e13104ae0700f9f3fb8c7e4116b1d29b3630ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f017b1c88611da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000000343014b13044d08aa083e67e1f1c04d58d3b6dc4f95fe19cd28de93795ae98b000000000e8000000002000020000000719692086975760ee098443a6836f1fd0c86447325c6ee00b720aeb3d1b5780890000000e455161dc378180f04194e9262febd78805b668de5bd47098ccab8a5e7d2fbe50be758de356d1fe880621d4f5dcdb05e967daa02a20c80787cc515378832daf27715c7c07361d1149ace600636c27bbbf6e51a600a61349ea55b99bcd07404251c49c39d9a56e13537b0242a8e00af53fb300ab14816a68b5edaa2559d66279907c05a1cf20914ea4c52406c287f5d8f40000000437cf6870d3b28d86de13e26cfa9990ff7e8259751a26a539639dad784c0acb649b8e0b87f6d8d78d370ee0a854d9e062f39025e6e33e4268f03d7a4729aa3e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2772	2444	iexplore.exe	30
PID 2444 wrote to memory of 2772	2444	iexplore.exe	30
PID 2444 wrote to memory of 2772	2444	iexplore.exe	30
PID 2444 wrote to memory of 2772	2444	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2050089486ee064516ceeea885448916

SHA1
ce75519099f908f149820d850803fae37c4a5749

SHA256
608aa37b0d1e6127c6e9ed2833692b9e3040d70fac925f6f8cda75a9ca877cd1

SHA512
59bd0ab46eaf05b20180b9fca648e64e968e35fa62414a4a759083c6fd3f7a3db7512cb7411214ec2d34c51ef2289ba0780768c28f5c6a8f63088ed53490b2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07c33c97dfe08b9081bedd0d4ad425f

SHA1
0c5ad993bd3fb4042cc6c32836affa13aa2f8157

SHA256
b0d1af3854f9424e238b72044dd3f985c304917518614f92a42efc059e5d10bb

SHA512
8dd3c2b284a4a433a8425aaa370878ac24a935c318e8678d2f21b6ba994c055c1bbda874eb075edf87a18336690af31ffbc3171c8d827e35bfe2d6a0b6614f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d496e4f8949f4cdb3dfa7e5eb0f19614

SHA1
394360b131ca1c4644b602f9492f01fb31c0333c

SHA256
6d30cec849c1e1125a46fc8aeccc265afaaf58a269d1d85df11cfd1f06fc51ff

SHA512
186deac62413fd23323db5b853e0e65d3fd1e2b1e6bb450cdb2fbe667957ab48804a1c3392cac631a37513dc0b1de3c4352802c353b3cde5d9be2a8d486a0320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd9878c6d47a423822da6f7a62e6168

SHA1
065057f4be7f8e73b068210d347e77c8cae25bac

SHA256
37dd803fcd42f564d5565dba34ee7fe258186fbbd0899a80b77ac40377db1f61

SHA512
7d5da2d10de83fa12b8a5723bb3d0c29c1b95d3d3fb152b4cff0f5e16829ec409ad032af69858b9b66f0b89923ea8f4c925c5e0d75321f16dd7d4fecdc67cebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab058d2020a36773453e35da4566a90c

SHA1
ef08d492457a7b1f4b2c4b413fe3fff28a787c36

SHA256
24a4348916978bcb6e95851306d82607dabff8367b54fdee4ebba704e5a5e41b

SHA512
f02439c5ed19bb525b4887219ab8d0eea8f6aae271b0f88e93a548f897afc1da5af05c9d5d41202efbebea32230735fb6d277f9d8363c4d618c367d794b78f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a9253bf053898b239d5ac2ee06df9dc

SHA1
cb5df9899e6e09a217674075ce1e81c26f8a514f

SHA256
8188aebf62bcff44073f6e9e8ddbdc12fb8ab3d0c8fa88bb4532ce7fd6757178

SHA512
202827297f018274b6955e8724478402f48378b50c33a606a32eb27e8d8800403e6f7b05300d530dd1d7f4d83714ea00c3d18d5f3eb732a366bd11eb8df52ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ec231381ab32a9a214ca66c7aa3d36

SHA1
a0287f5028f43862c7a97ca6d885cfe7fec8a7d6

SHA256
3f14243926489be7218a67729c76634777b1643bb27ea8892fdd028b97ecd3f1

SHA512
076bfd39d1a91caeea6856971201c71bee4790ac80ffcfbc2b863f1ef582f3220916aefed382b49122883eb7d5687337d902ae7b7b66755f9c4a0f56dfb12846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4908a844c7ab462c6eba2ed23201418f

SHA1
48ce7f448699c25a0814a4fe2a1a08c526f0ca1e

SHA256
a53157bea6b457a955f7ff7c8b03efadef49899bb216bbdeadd119666c970f95

SHA512
4df2bd0cb4ce3e8819a73655cc0674718e2d715f19c3b9ecc4edf14b53d8976ce42207a26abbbd92d0df3847dfb86da9af0de319ae13361fb42bf08228d3e0b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27f37c17567236a12798d0711e4c5ad9

SHA1
d116983d6481b4e2d4a033679ae6be93a631f1e5

SHA256
0def4368ec64cac4f268c448d208c620f71a0590e8a439e24c3427b6e262fdf8

SHA512
16ceb60ae6d6dfa54c8d38829759855cbbfc3c82dc799498eb1876f61a3cd19f79a0a322b82cb2782154c6bb5e29dcd9186de836c281c7eeffae4cf1bbd73c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7cda907621316931ce330eeef0614b

SHA1
ec715e6d3c61f8f4d9ba759a0744247df3e0adbc

SHA256
259189fabafcc0353460ce1b83d85fc46fff982c71b66a1e18aedcb911b4ad5b

SHA512
dfdfeaa79b330de5ee8142aa78cdeb5bdd46ea91cf142e5d5ab68884cafaee0abac876c61abb56471c72464726e5825d355382d21b0f9e824d01dad8be4fbee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab451E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar460B.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit