e9a0a2d8c40370547dbde0e4e80e0134be9e61d5d5a2c6079940b2e6ff6d090e

Analysis

max time kernel
115s
max time network
212s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch03.html
Size

28KB
MD5

6b5cfdc9e3eccf74da834bf28b380120
SHA1

2b24ccec136cba6803843e1e6ca458d9c1a787ff
SHA256

41e34b2f708c3c7746c9cfbf01ef431771a20493f176a9e360584e46d9361f67
SHA512

cdd64ce11526a3082db526c547d5b4bb292705190d7b8c7cf16a7b166751d5e9fbd6a4a9b3e05507653a619a006a9c64e1c4e7f144e30b009ceb8d5cd61f3675
SSDEEP

384:nyvOuAY4A/tRf+mDxTRHdx2O77zpe7nTq7+XRXUm7wpEROaMLR:n0OUt7xlHdx9707ZXRbRO3R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E59CB80-7D7A-11EE-A615-4A53D63183C6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000e7f8c9f614663bfa9b80984740ce3791173fd0df39b582a7529ab5a93da82c08000000000e800000000200002000000035b562f5ae37de5dd1009e8e9e21d345e4838d17b7076eb25236ecbb6c4f0c4820000000a9550f77f10805aaad3cbaa538b30002f722f72b0364838748795f46ccff7a9a4000000091297c8631198421e91ece1da33b92aa467ade569101efc7a666c8499cf8645f80048444502450ffa1e73cd1852d68c443d6ff35ee9db521f11b39f41ff76543	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405529237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ee00e38611da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e90000000002000000000010660000000100002000000050a1624e80ee10496fddc05a093b9f82d120713d5fc4a98ca90cabf484ed7c6e000000000e800000000200002000000012272e312d5accf0ea694b3dcf8cb9ba65f4798956a21cf3135d5a1349ff6f43900000003dba08ed6d511786d06919ff50085cfc7339e408dfb63d618b2bd5729bf3158855640d86599beba84121b04541e22aa0c9568f1414665474aa26f8f532d6e20af80d44ed75e2f68ca768b01a17f8e699acdcb3b266a3e0cbf693182bafec4aa08d87ec12db3eb58dc172d2aa9f5e8ed7cdcb13ff3297b95f7024c6c6bfc81672c8b5c8b5c183cbace002d05ef6bd843240000000bd984d471361a0b0662316eb0dd45934d1576a8221017a08cc7ab70b1a4a339f03fd0e2b232608181cf08ba03de060295eca49e233ea75f881e069c4236523fd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2544	2756	iexplore.exe	30
PID 2756 wrote to memory of 2544	2756	iexplore.exe	30
PID 2756 wrote to memory of 2544	2756	iexplore.exe	30
PID 2756 wrote to memory of 2544	2756	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch03.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b09b04b0cf861684ded734298b39da3

SHA1
430da65f4579001432c575ff537efdeeabc7a853

SHA256
4c1b9b849f7a4979e3a2bbb43bf2c3377c2ab04d900f716bb26e18538989e421

SHA512
9280edb4db8dc49f8c8881f3670caf39cf6240f1720a7b328e80ed0c358490154201b76bd75a2fac5d11d17b143dae7d8c475c0c3ea54d8275ddaa5b7f8eb939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1207fc81dd42c608933010236ba0da9

SHA1
a021b6ad1ccdf458b8d2fa143154e4f26a8c33c3

SHA256
37e6f4ea4bad96d111a9c6c1bf0cbc8ae137e7ef82edef67842ba8f3f0f9e6c8

SHA512
132873af30316aa1e935a5d77363789104be3012ede468ef0dbd4a7bfa4256bc65c9668014185abf21c3d480554b8f927acf912640f71eac81db1ebc85484c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b0ce6220b7370105035edfe0574801

SHA1
9cb770374d2acad6685852a64d4592f636867353

SHA256
056b0428d14a8a2be711d1bcd72adea421169d9634a2b9fbb807fff31a2cd038

SHA512
d70fbb7972eaf0c82a043b5d56b3937a5c7e67de44594fc2760847640680c7d3e578631e595244ffbd80ef86133d0ece3b0b9bc7ef8eedcee2808ad65fb536ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c2b2cec276a4defeada89e39e248cf8

SHA1
9a21726eade9d972b8b403cf9e65a712ac298c10

SHA256
c98c40c0068d0581c02073076d5e38722dde1cd688f10a9b0a80532e934d7d99

SHA512
6530484d0e3da50f667369f551be4688bb1bfaf0bd9937428cac85ad1b66f17c8a5310c1957413b721b5e1d1ba561c6ad11c5b91573ced455491dc7491cfc1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9766f97afd047a58b927c0769c0f9fec

SHA1
678599376c43509a45da6fdb7c65e4cce8873251

SHA256
75759bc1591a423da14cb4d31cd6605618aa3e8c27e1e0bbef40a96c1b2e8d68

SHA512
982272342451733e752f81bac004a36d8e69d9f00bbd8704f2f44273fe5da0537c5a0eda719dccc98db1ef285051cecab1d1df18c00b2c9e5099bd12b308d924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
145baf63bf9fa33113d2d958d4f67121

SHA1
c9e963bb03792949db0ef3fa266c5e37088450e3

SHA256
b6116dbe936d2b3429495a1458dca67e3ec0dfd727b10526486467560385275a

SHA512
7a245c692a61e6580dd5e87f96d3bd8b2e6b7d5de727ae53efae449855aad561812b28c03db98764dcb03aeeba5f26dbab318183805aecde8e892fe0c1a3f7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f415152931e92238ef77383a3a6ebd0

SHA1
73e0cbdb0959c4f8e6fc2f45fb3064eec2845531

SHA256
f48ad4d58b495b1eaad3410b2fecd257730361fb11a47169bd64d6c199102d43

SHA512
6e23fa2482b304b086a90c598c630026c655924a7de4ca0abba996bee15efca0fb65c49e9895fcfa85bcb573f3a514d94ace28457673f5c7236bf0b363390278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347ec496fc8e6c545fe2aab553f0c607

SHA1
aa9e9c87daa092401c61d73d89f4c095675e1f87

SHA256
818e6bc81d9b58221eb39934410b15a9b725318fb1b7dc996f5bf39972a6e453

SHA512
fd91ac1dc0d2a8d5780f775c4c24ff3b4d36ccca786b41de0c7833e2df8e0f7a8b7816c01d7355fc457bb30cc3f4561f1a956d7cfce70090337f4fece36067ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e6cd49581cb1771baa3f209acf246b9

SHA1
763fa8d61232ed146cc2f71c3602bc9f84b8d3d8

SHA256
922b9415d19dffe1f57895422a1337c46fbb7a01b9b8e03a17b2b5a5aa99457b

SHA512
32fc0b532a594b0358d2b10b1f3b01239936a7bc7a185f9b684c87a8189038255ef8d363ab32e8532692b78415d7c799f8fa431fe1c8e5d159847b19ddb8b4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd7404b9dcb50400a8997d388fd36a95

SHA1
705db20c3c3728cd07c350755ba1d588124d7eee

SHA256
a7506f8bd0029164d8498c6ad74c4a14ed237ab7396062f8cb4411d997f2672a

SHA512
2b4e4c35b244f07381a317d42fe6292325c2952ce0b7ad8ec783bc3d1d354b6845dd9b4090166ecfe0ebf588fedf0e8660bd8f29f324e5e64bc2cfb26ddb2331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9451b0299f24a78fd7515a3c93492868

SHA1
5e5786e7c83154fe91c76d4a3b7be53010318a51

SHA256
26c865a6c735f2a47f175bfb031a67e53e9260242ede95fb8174018fe665458a

SHA512
faa35c5f59f1a7cc3bff4dd32224e14ae1861972235440fdb1542eb53add45c266a91bc1912d8c884dc6c71532b85353c5109305c9f36908a4d72e1b2615bbf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8874.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8904.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit