b27d592b12389a816a1e787bfa6abe0c37330f283a5188a0fe24a4498569aa8f

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch04.html
Size

110KB
MD5

aeab2418c6ce572ca353c47c76a1828e
SHA1

c61d73e2751eb9c2f750fb1940edfcba29df74ea
SHA256

e4b2233205be4928ab553d92cc5dde5b3879b1c59cc1cae00e408b44214beca7
SHA512

0c25ce2b19551493a9640127e7da4a957e66227951692508053c0f3bcc766f2ea67215232af75e7c0ab86f1dc46b832ed177dcdbf89d738bba71c1ae2355106b
SSDEEP

1536:n0Oix7m6CcPq46eYcHJrc3hqvW3M53HW72WvIoW9ctyiJ:n037m6CU+3WG7XvIl9MyK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50da6b75bb11da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000d1285b773f69be660d36835a692f16ddca568e6de7298649489197286318e325000000000e8000000002000020000000dcd10c3c3c4845000aeda031141ead2591dfc764480bbca0b4e40fe0fb5169bc900000005bd0ce50263890a0b53448eed8d67a7bce0c6f6cf40c0f0855e20802fad83f69136171c81fa9123368d6de64fffd84b506f236f7bb603a1f58450021898310e4c5d9d377afec90503b423b7e196e9ccd811071adf36c42a0b7c3a7645338376fa037bf955e3d246e95e2fc27e2635031fb10fd9e4c765209debc407adf865817efbf56a64b62d25b8e74d3fbaad376664000000087cc3308f19e97de5096cb0a613ab4a63ea8c1d51b403684d075ca680e9702a05f9dd57531a1669002059bae86721dbf8ef0acdb0c305e583717a08cf7c421e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000a50d5273f850db1159dc9470e41ddfa3de23348e29a5d8194d2635d6c0d0a11a000000000e80000000020000200000003a025b44d91742f189610f3e332b8f96dcd7221a84bf983a1e134057711170e52000000069ea5516683069048ccdd2aeb4fbeebc71e4eb493170478a5aa20531067eac6a400000006713ad8ae07b9451e3069d546fa44147cca2a2bc9fc9adf6eac88aba7b47c17f7c1ca5ca8a4a165c4607f23ce88797553293d8058dffed20a7661b4626e0203d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91FE6571-7DAE-11EE-8759-5642BDFC5F20} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405551790"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1164	iexplore.exe
1164	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1724	1164	iexplore.exe	28
PID 1164 wrote to memory of 1724	1164	iexplore.exe	28
PID 1164 wrote to memory of 1724	1164	iexplore.exe	28
PID 1164 wrote to memory of 1724	1164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch04.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb04ab6b84861af6da5f6c76b6b31812

SHA1
8a31befbf03cbe425f74d7e758b5578e85d33289

SHA256
abce2bacd0104526b0a033abd24f124029f29f9fb69d869561661ad5b8f77162

SHA512
c4e0ed03209494c8c43ae7d60b04defb31dd5fa4fb4644b3a5996b7859caa7b2784365b495c2d37f97f3109f1ee0b5ef1fd8d13058aac7b1dc0c12e07af3d3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9290ddf96dbdf6b611d1b8dbb71c596c

SHA1
7b83f4e90c8662e4e5641c0986f93a8e2d65dfc0

SHA256
a5963ea2afd35494736b25e60cae008cf609d079f248a7db940f5fbbc1ebe98e

SHA512
ed0e55ec8bceed954b799cb40c94cf4006163c0e4950309c908d6a19a69653d09d9b6c86daac48df15d464eb04c17e7724767a0d5fedbd2ab4046037cda2c487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cabd5ebf5ce9179558b5170b2d3d158

SHA1
db17ec3cd1f31984f303022bdb8a3229410f670b

SHA256
3f6469d9313e2de205217cb256bfb7ff003999363534759e6a203923c9671c88

SHA512
a30d4603fb4038005717b08913be04c62a932329e1c2cc06fe1ba3cfe204a4b89dd7620e5692ab939208fc29c2a0f472065dfc3e82b76acaadd9e0a51549ddc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1daff3351b19345cacf7bfd0ec4bee8b

SHA1
18a770ca3da1adc4709d48b7486c0c6732774204

SHA256
dcf12d287d164afd3496946b8cd39074f2c2c4746dcdc6659afb603ccec29bfe

SHA512
508c7f5b37b67226dbb4567356b38afdc7ce478f19d0341bea5dba8dd14754c34badf88ff49b8707f31b02f931da37b2fcb9d59148b46bec1647cb718358e85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9bd73644fd37bb46eb4009bd7914e9

SHA1
ca5a2f8974cb884e95d7ff42cb687298d05b1509

SHA256
0b0d96a987cf59c1fb67ed38996ed276fe60e9f52d639eb3323b1bf716cea3da

SHA512
8ca26fa51b68305b1d9f9866fc889f082a6027001d20aea4e059430f563e1d961d70d7a5fc354f3fad84b7f43c76f54120e659aad25d59cea42cd6dd02ffbac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f8d97fc9b3dd1d49d0ea8ef46b364e

SHA1
9d4c32c9314bb65519a2f8f51b11c75713f950bf

SHA256
da0408678cf1411732a011f4778c363a74f38e57e83b89e25011abf6a6372b42

SHA512
26b72be9699908e2558a54a0abbbf037f96b163fc87b5f96e2cd6a2b92a4415a5fa7ce7bd008f5b7189b0509bd337e77d29f3ddc8716404b98cdd4700c0b5b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41f6bed5caea96d740af664a0d115c96

SHA1
e449ea9e21e1042765fae980c15e5dfde0b1e779

SHA256
f1597dc8c38a3be6bddb8fbcbf3c1ee66bee46b1a6e96274cad22996de192459

SHA512
849b1499301d0c170ad7cb182aed34b1211979fd11358524906331c600cb976ef908285c9fd22a48443536bb1ebe4b8d14288cdb9a20f30bb2d18068cee12c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f85778e196e9a529caae232e0beacfe7

SHA1
d418105ff32ef9f717bfb5848bf63a38867d09a2

SHA256
13425c16a3a66a1437b7d74be128295f743e67b6acb3f1c04f2faf0ce101cc0a

SHA512
d263d53978a04dde61478ea541057d19ec944eb1da9d553778bcbd4ee830353465a757625c47e0bfd6cc609753deaa13e7ba525712c424def46ed52ab31a97c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2e806b8136bc048ec46b7000cffac2

SHA1
f18882dd471d15be9438f21857084ba84f7b83c6

SHA256
f6c821c3cbffa972073e8610fd9da6a0348320db4d28cb0034c74f695e90eadf

SHA512
f8c64e808e2eab6a99ba41f0d760498c8098a36e7eb77a1205fcb06546cb0a161b550fc36a9ba3d9b0d5dc34959cc38317fae6fee3fd3f23ebf7988421648a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1194.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit