1aaa3b9ac49370a52a183cabc00f52c56df9e3dc03e3c33808e945ad0e7650eb

Analysis

max time kernel
121s
max time network
198s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch06.html
Size

535KB
MD5

a0ac26c69c42357cebeca366322a7c6d
SHA1

cb5e4935127871216b0817eccd5e816fda52fd5e
SHA256

83b96f50189057f3fe195d435d675c8296a4986dc7c719574009d99b6a5d4b6b
SHA512

4a84b0fbba6ac3bab859dae8a418f0250a2a598e834b7e3b1e3dedeae7d6b20fafb1675b7ba595dde1ee2ce23327c377f842d30e4552861afbe0c9dd7fff216f
SSDEEP

3072:Z0mz9I3iaHEEvAkHh/K9MAfN9q+Sb1emg/5SWo7VJJVp4SVGCMt5RPL65o:Z0w+HElkHRoJ5S3VGj5RPao

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd669200000000020000000000106600000001000020000000c3bffc64911f6a110f7d94060e14b842674af2680071295745f43fffaa72f39f000000000e80000000020000200000007701f2f3ca0e2df1123dc8e94fd3363c03a689dbb397cdd833960184cb71030520000000696edd3e7c8ab3f5e22137c70685ef0133ac32250eb30f0b180296d20b57bc3640000000c2771114dac8a85e130f085ea235d0b82197585f51bcbb9b0920292363713710df324e4ba2769107287b9ec03ffa160989db22ac1b77293e55c2a6fd9105d944	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd66920000000002000000000010660000000100002000000052682d6fcda860ab3da82c680b89f3c05e21f3cefb031f41e4a498e54be4f217000000000e8000000002000020000000ca705f70ced9ed26b48062a1181e5c26b8f9009dfad51d83866a1e6523e5ba3c900000002bc38b084fbe4d197e5fe261518c25985c27f86e58b93bb86b85e61bb23e2dfa160c40b04a68b89b4918aff02c47330fb0808998476626581fb6840de0a71e8fd690bcbc8ada3d379b3bf02a5ba4a69300b41f81a41d9eceadecf1d879663d556b3d89afa6a4d7efdf7842c36dc38a4e4b799e4585185121ff74cc4620fa3f260cb1ba11a15741e286c5c1c30bfb7c4440000000728c84763f7df7f2f3875adf53ea299401983c35bec35e77b9361684b1f9c0fe7d865264030598a87bdab6c9a90de8ed2de5f756f6635efcc325b51b92f50f5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F8A7711-7DA3-11EE-AF62-6A9D9D199239} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405546850"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a389e6af11da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 860	2260	iexplore.exe	30
PID 2260 wrote to memory of 860	2260	iexplore.exe	30
PID 2260 wrote to memory of 860	2260	iexplore.exe	30
PID 2260 wrote to memory of 860	2260	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
100cea21e9d2f7bd7185c6a9af95e6c9

SHA1
c170d4a62e37030a8dad403cc813528bbc25078a

SHA256
273f323778be4c756cbf5fa9f81e66e458adbd7cdd1a13202c5a9163a3033d2d

SHA512
1a0109cb6ca454ff98a0ddbb75f24e52d40bb3ba962f074e4b8281631dd5c96bbd37cac47e7886cc19db4ff2a2c181fb5cf4c0e710e8b5d68f3e2188afd4f6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b0b880210fcc769afd72abd77a98dd

SHA1
eb0683c0423d29bc2ff8fefc5924280f4b02093a

SHA256
e8bfdea23cf1dfbcda9322505ecbfd79c48d67322cedef086500020ed542fff7

SHA512
68b28eca97964094ff0c53cd38ae7cad4f88027bbe61536dd91b1724d20c723ba79e9b53c3717ed04064f5018c8d2b98ffe9d1c50a99513b46227c069f213318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd0a94770e0d830617e9cdf771963088

SHA1
c3a6cdce27572cfa6201fd882ff166fc496bbbd8

SHA256
858abbfb9853bd15e4e10f35225828da75719c423d861e44c1db75af5b7b77ae

SHA512
2ec49a4ee9828ca8d2cd18b0e46044a688f9c5de15f144bc135667ef0deae77fbd924c6ab037648c631640fc3bf6671747b682943117dbc3100e6dd53ac4dc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341cb9b4d73b434cad254d2c8617e8db

SHA1
a2c793432cf69f9d22a49311f2074c2b8b4f8b30

SHA256
f6de4475840809a9c9474b34373de1588ed609f43bc295496dba5769f4d35fe0

SHA512
3bb16b3ca3f9d8f5cf36437e2347fbf9bf940cf289b9c7954f7674ccd04c0f0feae83e46ae8ae6b5a78e2bd9cee95a993d35d87716aa7a9cdefc68a93eba656c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd92537f5179b858afc2507848b4496

SHA1
7b785d045657c86ea80824ced5d12e65481fff9b

SHA256
4df7c9f40aa594ee948a879875ef45e7127873f38f567ed0668147eaae7a0767

SHA512
c25abde5e06618d8bd13e2cd890a9b037731bff3ec8fe30d900a483efba573b4266bad7dc7ecc7bfec3d50ab97d00f422ebcc6b6e148213adba6d6542cae8402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
041af053c0fee56390b624d24c837486

SHA1
baeb0c71c87991e1cb1e2545c26740c672588550

SHA256
33e1c3359d0a44bed90af2c4f9ca3f302a4649334f571f6e38c05cb05fa3dcc6

SHA512
3de3f7219449d65c88fe11688adedd034de32a89fe889a5c74547462e263cd99c636239f94e92e090945f4f62f9ed000c833d0bfc8f8642d52af20ab18295b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aa91f7571e9bf35e2ffd1db7549f889

SHA1
a4e573e657d7cd9f36815d380d2bccf89eae6038

SHA256
d6b7e91565b7e2efa02ca351f005a22d144a33ba699d0e60982436bc6817b001

SHA512
2d309fd39d73786703b17e040dc17b71e6ca3f67bb946b43dba92b9c47ec1f8cef1d2b7b5a3f1d445c494439333f702517bcb3cf5f0743096368b6beea2a2016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65dfcddc68ffb1c91cf56842222f50ff

SHA1
7b8c41ec7ef692eaae897faa900a8916f899762e

SHA256
cd3e8ba71d63110b0fc70b29ca081c8c81e8e710d813e320cd0a64affed877f2

SHA512
5319bc87ce50154c5b9582c403c7e8677f79ed441ce4d16117f9220972967abdc6246e3b9b319a1a4e39a5da87162f4002299fe563ebf5c8f8593dab0aad55cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
837b92f93bcba42b292bcad7ae511487

SHA1
5f870f70602bb502a14078e8fb6a16f48acb6175

SHA256
8ff0ec3a7e58388d01a092ed5597b12c9824aba329e136cf0dd508514ede5243

SHA512
9424ed742fb05800307c062c967feab3be97b866f9208b3ee2ba7b747c9b605576768f72da7bb4728a34464fad6d7d2735e770c149381cba66dc01e3fc7e7e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627e58a95b8ad5994216cc8fbd618186

SHA1
5982df3d299e524d82694b5b9231d772b1bf4729

SHA256
cb8c9fdb143d5eb5dcd7b47c723464014c28bb96b3a530ec51c5ba9d29ed9f11

SHA512
529018782147b3dccd0ab6cbe8dd5230334404ecf4a659abb3dd520727a85de01f389588b0f6431e6611b1e1aebaaab306c3d519ba05a11d8dc3608e115a8a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D6E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar610A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit