1aaa3b9ac49370a52a183cabc00f52c56df9e3dc03e3c33808e945ad0e7650eb

Analysis

max time kernel
189s
max time network
186s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch01.html
Size

24KB
MD5

9dd8912adac6508b3e21d0b0695fdd14
SHA1

a1f51aa1a73540730b27797429a30da6893ba913
SHA256

6051d7396c7f17e0f9a2597838c63bd201a46befcf41b1459bdb4c61198a4634
SHA512

b7cf59d5df3463af78f28a5edbcb49eb647c32b97c529075195d08847277eeefac25131983b405a04401e55c58a816af5d3f3ac4c9028f025b9caf97ea7a1b21
SSDEEP

384:ZyvOXFYNRhwYbTYLztAD4OOZASl+X186ggGpZ8W:Z0O8WEYdZA1X1WpLJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405546676"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e90000000002000000000010660000000100002000000021d6523c1f5ea6fda1e268035092354bc58b635c41bafd4ed1ec7bf086dc0bd7000000000e80000000020000200000004af2efe2fa31acb11d6262816faad9fa1040a9d7e3f443a0bc4aec7ba2c8141a90000000db71b164f83c032e7e7db0a5e1a673dac9144e59af6a22477ba8f575f40d81656977b1aea7f12c927f627312de8354e9cad23ae3b999b68677b01084d5390e7d4ec9bbd7875842e420cb47c87c71c4db333bceed165ceb9aa8d5810cd04d5d18f87ac9c67b208c924e6d60625ff34d27de9198c747d6a847c1bb74ccb3c2096d6650cbdc86c8f47228b9a2fb391c6aed4000000035b5d8bc8b8fb181d2e258d4d607cc60cbf06fa935a237e1f060ffa6d2cf8be3f64659eb1abbd2429dface890f6a78f54609755decdafc7334a58257a3809f0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a4f07eaf11da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000006905525a4751872ef5f3339396477cfe7a09b5604d8fe63799adf03f6ef5ef4f000000000e8000000002000020000000df54bc75c88543840df5497f697c4417681e6833ee9de98cd610960b5674bf292000000034e6152ef01ce0c2779424c6fb7ac556beb797a9c7cbea819be36e3797406ae9400000008cb929e9ebbbf5b7d2bde9241c34fc297c41839e8fbb36c4da42ef543da6f6f7f902a447cd1833d4fe257630429577be4354658170d328209d57a105ab282184	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A93AA981-7DA2-11EE-888E-E6337F2BB1FD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2140	2732	iexplore.exe	30
PID 2732 wrote to memory of 2140	2732	iexplore.exe	30
PID 2732 wrote to memory of 2140	2732	iexplore.exe	30
PID 2732 wrote to memory of 2140	2732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch01.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea2ce5e825cce4abf225a3c626d1728

SHA1
0c3d54cf2cf3017a3e399de546862be3c04fba34

SHA256
f46542941451a64976f5cc34a5e22454481708db688b933b89826981d6e80a26

SHA512
1366502e9b9c2fab1b230a20d9373f06fe3ffc40090c411ae81b27abc90602f1fb477815d70807da85c5d7b1cf3f6dd67c9fe0734e80002cc791e4f9c8627a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30612ccf778e72fdcb72f0d63700e9d8

SHA1
dde8be869bd1f03b9669a6d103f70f7c3de57ea6

SHA256
714e28abf03f16a8ee7ec304725de7e596bb42d947ec8e774f44e4cbd94c3529

SHA512
3be8ec5a5b563747f06857ba1ea962a35cc190a59c5496574b23b7cbc316273f3d5654eebedf8321fde9fb1c23787822ce4aadb2846955bbf1f074a19ea1a6e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c387efebc586c918ae5215a9396106b

SHA1
a9a5a5b12617460c73dddba712f4b07962258dd3

SHA256
35917941674b5b4def84336f6bd9998af323285c394f9a8e10228a41242fba44

SHA512
c9bb8ae96f1354c95d14b60a7f22ef69652cd6ef54879f87ec901475fc17aa610c9d9081fc008f34ec3a45698347a40b178371ec76cd9678b361a35bf3ca8004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
973726447b17c03155d3ae3896782540

SHA1
26a0c45bc0729b92fae9a9315ad21d962ae77175

SHA256
0661e72256fa8416f008c66ac4485e76c6330e1dc539014c1036e77ec520361e

SHA512
520eae95a70eae778b0bc34056e67fcc70eb1c8ff45b2ed5a2754b6d25bba608e5e53067d5ea3dfc7724d0f1b7b8d18a1801fa33afc280738c4acdde9d133782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b95e5ebdeb703a77e060795d254591

SHA1
d5c22595b240109158aac3e9adf841c3f07bde88

SHA256
63ccbdc40b27f36147a2c31ce11d09d5de79f5606a6ef3b4c7ad48895e7302ba

SHA512
5ab19a0d1649b630b48089ca6f70562a2d69ea0705af92eb687dd834e015d7a93db27e61d572e4bb1eab0685e3087cfe758528e8ac8da3555d64616657a08d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90f11d2eb9b2a425a68063e3ec7f6c1e

SHA1
2fbff7856aaa9736df64506592df4c734436776f

SHA256
28f72b53c9d10e999b29323b96a049957ef0b6f0d7aa3ae17207a46a3c078926

SHA512
6e12320c955144079e9527efcfb87af02d717a4f4acfdff280496021fb9073e63b981b5b63fae4cab8d4c308ebbb2ae5248cf94eb859aa002538ccbbebbb4ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45e7a3e380291685ce92c738434a38c4

SHA1
fe7c6a7bcca7face9305683ae805424c28d017ba

SHA256
5b3f284388bbb2642d9381a056b9a3e36d701d124780e0e869af13f335af503b

SHA512
9191196c2091d50982ca8e0bc36fab9d859ad1093c8e96f601e5f9228f0f3a975222dc39717c7b882dadafb9f7195f73772d18b9fdce3911da5fcf251a1b110a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02c1263cfddc51f2576a3620954f1f4

SHA1
6d75309f8c263803318266992548ac786f195016

SHA256
30f6a267c5046788653d29e0c3406b0c68fc56b3bed15cd1b1bbe3dc8842c39f

SHA512
0ab6ed20f16f4fd514649ca24d4a2664802f1efe47a2278e76683ea3ef614998a2f5cbb09b5f290ee6d2b8d1bb02a3d50cd1bef8acb398dc9e881374e369b748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0344707f923fd8a4d7f7eba083876b24

SHA1
e479fd6911db7f909c8bfabd439a2d69f6309de9

SHA256
abdcea261c075fe59954d7f952561d86d985d19bcbc71f8e462aef728f3826cb

SHA512
895377f30acb84c58e34dc7d478d98d49c9b8a7b8cc85410887727bfbcf4f0e0f40194dd3ab7472e210b1a45501e094e1c023d1c745692b24049050cb8dcc23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C13.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CA2.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit