d60530634338b99acf6e7f9b01e46aa42e30b330b256f809e5fa002154d34f58

Analysis

max time kernel
147s
max time network
213s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch06.html
Size

426KB
MD5

b98a17f1528d15127dbbd1bd9be8c153
SHA1

ad5a1306d6735371214bb8b493eb5f6e4227c408
SHA256

4a6c34cad30161611b6e57a051d470053ba1ae66297d573ca259d8e31e742c02
SHA512

635ea20291b1c851f19c63f806e2732510a809611b2e99d40a7e9604f03c5b8a0bf8110674f9d2083da2e9881fa5acb214b2e39f0bd6fa118deb5fd2799feede
SSDEEP

3072:y0IHkx37TURzN22AGNM3f/MWpOSW4SkR43oeVpPVGCdt5RPhW1:y0AMUr2v1SpVGS5RPU1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000000f67c5ddd80b4caa971e2301c4bcf08099f672f747e562d16d166e052a73751b000000000e8000000002000020000000a075505c2096f9d5ed67b1ce8e6b8bed9ad97803cf172b8a9b388b24897964219000000099f0a5eec3a0d43a0b926852dd38d0cb8699fc237acd9e9d24329ccdb1fd576ac13ec27269c58e8c9e868d460f61f409504f649fb21348c29b66730a58ba66565c0f1aa1eca5d5a573bd38062e75597000ed4a439697e262981503b4101a68f2cd3fc5246483191c1360a3cfc0e69a5233c0ff1bea5d0ea5f03e508fd4cacbf665ea7f2e9859918c550ff9699535b3f740000000c193b1686918275b8de36c78d39e9aad9deb33e05418c8c6a352a3eb84240607a24bfa8d4b05c5297a0e238a2cbf54cf8076fc3016d43f55930eb66e2bcd886f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000153da0ab518dd3c9957dab3485c5783b39399ad7dc274c445c9257e424e97ef2000000000e8000000002000020000000045c2106142608c396f96f2099c2b7b926e0654a78d30d4e6e310b05cfd3cec42000000080adc27d65d62873d9f1345bb55f21623defbe31c4c437986f489d91e614e5c040000000af52a77d8adcf1181fd8c973c708567532023d935daeb1863dfdaca454c3453e6d9e58b93edfe92f2f8585679e9ae867092e9213ac97cf3b2998e00260002eca	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504ddcbf5f12da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA0F3FB1-7E52-11EE-94A3-7E3CB4A050D6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 368	2664	iexplore.exe	30
PID 2664 wrote to memory of 368	2664	iexplore.exe	30
PID 2664 wrote to memory of 368	2664	iexplore.exe	30
PID 2664 wrote to memory of 368	2664	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a2f6d539981151c2cb9af7b3e31f15

SHA1
7161bef6a462b9cf9e5a6c32be0553795dc2422e

SHA256
666e15c6ed6f45f40f9db0112ccd265abef9753fdb37edb0fbc1f5b99ea44ebb

SHA512
550c5705c13c1ec1ccf8e998e9b485d637abbc37daaed3a4570e0922a82adcd387cca90f7d8048c572574a25573fd7362781ef572f0d06d5aa6ca0935d45a476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3be8a7354bcfcea20ed03e0f5576df

SHA1
3efab347d255c5bb3cb847008e8195b97be9de36

SHA256
83adc82980700ef98681721dc3358719ef6d3167e30eff2b6eb24b0712476ea7

SHA512
eb5c237d86f5278c2aca9a8c70d27e1a0934160fb42c7048bcb4b87d95d41b847860f031c379beb3d3d089e53b657125e39e2d326d2991bf3355168fb0b3097c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345cb229f79a4e2903fad99cb7c4a19f

SHA1
88d645b7513bb2641fa99a9b7f78147748a3034a

SHA256
6ae8c550453f92eabd6d5ca4b7e4919955dd2c0d15a484d0b13a46739b4a91b4

SHA512
104fcc85c24da1fe7e2bda609cb9f8c45943ba49827c66b5e720753b44c54f6a4dd65f6b882a9df28ae06decf7ce9acc9906bc793eabe8566131e9af6c9cc5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e8f8123c93803ac437a157fc0bb703

SHA1
dc9a514b7b5f6d7d3d12c446c6b692521e0a54b4

SHA256
e8039237efbb41b66a085efc4be3ee66459dd5249f48db2c2a4b719f84995657

SHA512
d83513628e7eb12d13b658f6fe3f696727cd394960d4d7cc2fe0118811e995493f65addd084c70a56c6fc63e0ccabc2921214fd2013b29b5a11f686ea6156973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6fc5be0d54bf89f502f529df58ae0a

SHA1
648c9cad6f4f4d12fa709f56550dcb63e0dfb007

SHA256
d94b318f67a316b0e16257c3b7523ef95802842ac1d80e0749e0835198939fad

SHA512
ad47030967f43dc3bac30a190112d1d8bbb4d2cd9991b6a58e6259ba16c84f03ce9f884a83dd3cb1ec5de3a71a8a054add7342ef3f5eada038f470f3811dd571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36238bf15e3b24711d6280d2c0762db1

SHA1
3e8ecc5513e32566df2d91833d94ce2e010155fd

SHA256
610ecaa25b96ca814e8ca82b10eb25e23a72d8132552f771dfc7341ff9999027

SHA512
dd60992f8d7a480a0d47f71cbd3bf7dbaa4da969f895291eda65fea56072377fa88a2b6f830f49f8725f29754d86538c37e6a2eb7f42cf9c28d392cd102fb5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
210ab10276f756f3f8d7a99909803877

SHA1
7e7ec36893061b59a0131eb7d835b93f30006934

SHA256
ec70a0930347c99b1bde33f40186320f66ec274edf6f542ff0bf55091dae6b92

SHA512
76802e756038f4fc184f996dad342e8ebc4533c273a655ff597e37984728f48b1584011dee38b463a97f41ac60e459e79cf6d98bedfe66236b46e84e720c0a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b132ad37561ba586df3dc416c46da0a0

SHA1
4fbb9a713a586e6de0f3d61426a0c4d9af208cc9

SHA256
5e8202dab64ed1da0e916b3a799435cfda295266bb53af307129a18097611aef

SHA512
7ac232f5c92b5e2cf14231ec0ffa4a6b306246c76a58add8ba504cb5ce21872fcb4f0b300f324b1103553f38044d3df36319ffbcd348f06f022f35a41cd968c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C0E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C7F.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit