e6694167042f0178eb81c5635ce4e746cbea6c6761fb65ea0f3d1e26c08a94f9

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch11.html
Size

43KB
MD5

30a0b38605a103e867e194ac0cf50868
SHA1

16171137c1f237b08965cfbfe43968beece7901b
SHA256

700f49474ef052d360e78e1cd7d34916ce6a4607dd284ff4e6c604065228132e
SHA512

6371ddcab93a39b958e02c8d0c46392aefe4644ef3c1f4969102f966c8d8e3db5573b3e1e425c111c74ddcac6d5e7a5b5ead49315de0a86a913dfe6b2e6efb24
SSDEEP

384:nyvOB+EYz2ZK1siN8835lKD3pjyFM4JaECCDHyETRpDET1RdkUFdIaGBvJp58:n0OcM4683mDgJxTRapko6e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F68CF11-7D8E-11EE-8E05-6267A9FE412E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405537880"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000c46a7440b9c032397198060afd63d0eff6acb89f6f47d2b1f9131cc4a0601d22000000000e80000000020000200000000cc5d5ccd7622f448a7af9106b6fd6e163d9f8d869c652578e0c9f9ce1aa021020000000cb4420dcef17cb9433c56df0782ee794eb666d437b417028442f96488c07222f400000006066537a58238808ceaf374d6abe5e6795631a9a14467f8f357c01d148abb5efd5ad28bdeb9d5e5f9cfe7ebc0ef2b0870ca04abb6543cad3d8b43ae45064216f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601a26049b11da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000004e9b21acc1fa3f6a2fa39108f232dbd335f4bf7f5614c7a90bd9d8d06ac7a779000000000e8000000002000020000000f192a98cce1330525de64c58ffdcbaee6d85f6f2fd13d8e50fa2d498719e5268900000007ca9f4cfad73e55092f65445ea8cc9ceaaff113c7966a632d55fa3384096fec1d6b27db97398b7f3bdd1667a96d0041de162b67256d166f7d782e0b2bec255e8afeb8b1f179dd61c8e1810914e3c348659ef6bdac0bf3e2f67d0cc89540c97803377ac4dbf0f555355d2d8e9a394e926ccd70a42cb8510562cb8082dc33c7b08bafc8c7d900c6130805b314cfbaf179b400000006d07f338bcc9eff9c70ed2918055b359279701f579703362293a97a2c1603396caf7513a11069ddee6a320a510ddc3646988b736711cf573a830c119b45705cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2944	1796	iexplore.exe	28
PID 1796 wrote to memory of 2944	1796	iexplore.exe	28
PID 1796 wrote to memory of 2944	1796	iexplore.exe	28
PID 1796 wrote to memory of 2944	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch11.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3c1deb24bc75db568eb0e01826c7e3

SHA1
42160e33a7c5e3161ba0bbdf5628768cf06ab134

SHA256
7aeb4be2cf331974a1b198aaf9da8eb774b7fc9412e71d13fa3d2f54189f3286

SHA512
adeebfb5ff01b91ad8bb6626665f3a0302c9e2e0b51eb498d40c0fb369a084a9cd2ee96ff5736a22943cc059220d06d69b703caa0edc8a9dbded61688a06464f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3922d41a87984ff5c901e7416f55e4d3

SHA1
3d1b12e00ad68bf39572b1f8297041a223f5c3eb

SHA256
51500d67f873749bb5385903055b4d3139d09033ec43ec3cae61cd3687c84e3c

SHA512
7be5b7d23649adfb5e16274de93a23477d2f93f213d9608a2f7d22349982cd07f5ee648cfd5b81fb4a2a19543c334fb74aa58d7f5c0baf6742a413b9e321a795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1baf7b7eed0a5b4677d17ab5669dba

SHA1
fa836728eee5c91681e1b49ee7674f402692c33a

SHA256
4d70ced646e0a0e62bd88442469411890ba4e3953a64619fe5c9ce64f4e16471

SHA512
6a74e33901796a1fc08a399fd18ebba20390e99e4b643dac92f314c2853be2335564117f2726c73676f43a0dae2a8d784c88700b6750f2300a7858dda23ada49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bdc5ebba6df3e2d007224aba02be059

SHA1
f49229db76ad0b53600cc4debfde1e2d9af9f2c1

SHA256
f662d5d7e86cff5df394cbc680efbe4496904d485fc75cecd5efee1a6c5476b2

SHA512
9fd80a829a9915f2b24cb327e13194ca72eb88cbb39569fb0a54aaaec1b21ea4b0ebe42b3970e8c1edca2374017896ff4bc8473ab1c44f9343a9291000fa8610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7b395062aecaf68836838138df6fb6

SHA1
0288120531757c3c42d067ef93468d207e6d75f9

SHA256
be34cc59c39d140188380c3a84c97dce5b94b36c933cb635443bd623b90b3e73

SHA512
42ab48a815ccdc79834ba7f7b519c6f4b5947404634aa49d2fcb25ba883f6dcb39b7fec03419577382b8f80d8beb6f502400c279814eb8e418e483daa1e63144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8d1ad4c68bb4414a121ca3666537ba5

SHA1
43cbe905ffbd5e500e78ff7ded5082af28ef3f9d

SHA256
4e6f66b1ca0ed73a4b2003c0e428e9a03b1a6ed3838fa0f9aae16e7e01f6c687

SHA512
e847da218aa1fc34617e8f348f8dd2ace6ab5f4ee15e1fd9f1b76d2588d37f6777add85b6871d0a99ffe281dc7d81b24be34073a958deb1468fed43538af3809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e487d083c08da18ec5e360d3d374c5f2

SHA1
977a5e43e17cc811855f3370dd9cd43963097bab

SHA256
cd19f69628ba19cfa535417a63ad7d941abb2a15715d110db7aa1f87308b9e5d

SHA512
74fa46ed5b2607ea4f4db26c4d7a67968022253b46f99bf59524cac93bed874ae60b6c847b1ffef1e25a8e9058c1f3a9e370b92c43e6a41b44c3fe33178a84b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06ee142491b82ada92c9e0e9b88afa7

SHA1
24e85ccefd5587a38e5cb0a3493b3085abd01803

SHA256
54b0bd7e1a3f189ce9fb680b0edd14d95bbbd875c275d600c63fcb0d44eceeee

SHA512
cd70871bc0918508803f0fd9c34b36b7ac345af9a8844ac9ede9b5228d712615829e41f1ded092319ee7e1fe914bdff9ec80b291b580bd092bb28e8a41f485a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
470f0b7962af500224eba527dc08dcc8

SHA1
96874b467a5855a6188f0646d5eaf87364fa0e3c

SHA256
f4e503fafd159efe278974a7634ee2dd11160b09a8ba170b482861627ac19f34

SHA512
4c79e0496c6763a332f83047486c19346ae370515cf7ee952141d1b449156f7b0c825f1a0357a2b212cbda2d661681ba19ab49284db2e6a08ab0402d319b7bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1067866f078e7a95ea9916dd12a75660

SHA1
67babebbcb0873bce9fedbdd4943419576e60e1e

SHA256
1f467a3c12ba3940ab2f362ff348e011db2c1910ca87a8cd017b27346e37ca18

SHA512
6278fbbd8fbdb6ddb517bb4aa681d9755e6eae893684a76f0846a3b4fda152d6e01f8f089914c01097f15affe0ff2af83996c77ef91855bfefe040f69e08136e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11245e7028c5ed2b672d5b8ebe41f4c7

SHA1
7958f577f28616786fd3f4babc40376e3b0ed046

SHA256
e48611ae690ba222fc2b7dff5882a08aa27c430f116e6004c372f2a22b8157ef

SHA512
f50d6207c2ad0bac0a5867046e1721862b1b5fb0030a3df5192d46268870ec4331fb695eb4cc93bfcc8738b51cdbb9d8c1a7d41a9efcdfc5eaaf5f9ffd1c3454

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B3B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BCB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit