d60530634338b99acf6e7f9b01e46aa42e30b330b256f809e5fa002154d34f58

Analysis

max time kernel
164s
max time network
192s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch09.html
Size

49KB
MD5

330b2e4284d1f91220bbb0801ab80b3b
SHA1

fc484743bc99838c9b09959a03c8f1d81fac728a
SHA256

4e6cb4ca2f624228833db4275ced982b5d27e025e678087ae9f638617554be3f
SHA512

f0c92ddc3bfe1dcb287c7bc72bfc8476062911f4e61db852e0b9da0b895ef823ae212965e02e275675241c72ecd4fa20525d2880d9183d7675fb57950bda0d79
SSDEEP

384:yyvOKaYt3Ix4U3ZK1siN8I35lKD3tjzF+JahEbPHYPVijugEoCuHBtnQYjhyrBvs:y0OmhUI6I3mDOJUVijWAjQPg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9DDE6E1-7E52-11EE-85FE-D66708FBED06} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08821bf5f12da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000003f3f13793aaac45c8033616251b9ab042f98fb0157b0500c6c0aaa4791cf8ac1000000000e8000000002000020000000ec9b3229219eb5881e120f55b4879b8f1891b18826eb2cfc8f9d25d0c3e3b845200000002658891ad5193f4382413d619700cc34924a122bea362e3878d1933dd81fed4340000000ae259caa4a461ed90a6194f810954dd904c3285e4b91fe10404fa85e519ae4d42be0cbd2a237cee9f0fd5dc636042ba589bb96b6c88e5a9b59c369da20c0b3a9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000d79675edc24693f876231799ee65771677c87166aacf03f9582751d9ab23ddfb000000000e80000000020000200000006c85fd029501ef3aee68a0ff213ff8bce396865ee2b2b7995f479fb53a1ae49c90000000944b2c220953f37624fb74a6bf9fb16e66839bcc37dac11d7d1eaec5eb4c6edb51ffd75bcca5b7306f04c2b1843c941bdbb73b86f12c663a15e3ac144873be2bd0226ab41fa3ca32b2772bbd43407afc8d6ff45566abaeb0928903a5923e7a29aa26d029d86f3b477bf1fa48f5aebdb2ef46905a3f606d49f08f59122e699783ba1d069f01820dae138907db683e039440000000e9c4d25986bc1679a0b9778ab005a528d653e671b2722fa3a5e626618ae51c30837a43ccbd5ae1010d83651590ae69da5e1fb413cade32ada462d33814d69576	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2864	2776	iexplore.exe	30
PID 2776 wrote to memory of 2864	2776	iexplore.exe	30
PID 2776 wrote to memory of 2864	2776	iexplore.exe	30
PID 2776 wrote to memory of 2864	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch09.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52004e229f1ba0960f66e55cccf70b1

SHA1
cc91bd61e3c551b1162375ca1c393077e6968924

SHA256
6f5536e97a4b01cc6254419f4862fe17f7652abbc44393f2be7dda7d94d036b9

SHA512
97d2af34ae33ea4475040ea5e40eb3e7e8ae2e4835671c0b85b18b66a88bc145b51039f61b5e78135e3e5f5641bdc709414eacead46f093997dc2f9213113a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ea8c52cb4d46a571eb8656c92ea113

SHA1
1f88da2a4d6327fda9c04862339194b8aa30d78f

SHA256
80a53ecd741ff337b3b6eefd8eeb8393af89bdc3cb424c3ff5ef2cc1f3a87f62

SHA512
275d3b7acdd4e18a1b1fd7c503323fe6708470a9e374b547b01665662e8277cff40456f0a044e19198f66acd3398d5d11f30fa239a0a5d383e58d459e66ce119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1e7c5a771659983ca71e9f704cc6b8

SHA1
818fcc02cd3f7a5bf66d9eae15e4263b7309e8cc

SHA256
124c1b31c07c3d9711ab9dc59555228682aa3053729e6400c8d4632a5fcdcb7a

SHA512
1633ddcb97c04d406daf5a5ed7c333fcf3152b95a65abbf8f7f9a7d52bc5671f1e77c83d1b589b84509efdda10ed0798fec9beda9383271aa339623ff07c01bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c5f79aa80268b525425efb96b797109

SHA1
b42e65e5bf84f6e5de7705a163f24621a76b3de2

SHA256
591bb9588ff1385611852106249e622e0f72d52f4e2337a4da6a2c3133912385

SHA512
74c7a62e2e3d113aa86b60044f2230057f888d15f3748fd74b829def76facebb08117d8ace3cb5d001932708ef16b8690e8eb9029949787891f78f601da7fad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3055748057e141e4dc7d49e68bb5d633

SHA1
6b8eb3bcaa8eef0fd42939ffe1a56dd9b88bd0db

SHA256
3993e3c27744d24e6ca0e363256cff9a25fcf700002ae85e2b4fa194e98656bf

SHA512
01f4a256ae3039b0d7271adb49ad556d8469e4b25bbfc41eca5954c6e348dd801ab340fa498adbe4c100f420323071ef9413e96d52cfd06933b3c5ac1b8f9027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3055748057e141e4dc7d49e68bb5d633

SHA1
6b8eb3bcaa8eef0fd42939ffe1a56dd9b88bd0db

SHA256
3993e3c27744d24e6ca0e363256cff9a25fcf700002ae85e2b4fa194e98656bf

SHA512
01f4a256ae3039b0d7271adb49ad556d8469e4b25bbfc41eca5954c6e348dd801ab340fa498adbe4c100f420323071ef9413e96d52cfd06933b3c5ac1b8f9027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80ea0970e15785302dfb0dec35da1cf

SHA1
57a6b6a48c04c414903c37539c4c816b08c049a0

SHA256
5cce9859e144789fed57609b8d36b1141b13f1dc5e4cbd21a325bae7c26e3fb2

SHA512
efd1f16cd48e8e63d55e1ceee5d7bc703c9d64a71824fc082b68994baaf9876c31d566406a1bbfedf8b064f2f460ef14d6cc8e664b70c1ec162ed8f77d031dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d76a9bccee7d57dca0effa657d100ef

SHA1
197ecc9f844d41259f748f7e2e3f239e7cccf952

SHA256
8d27aebd8411eaee56391ee5e1477ed93a80b674ce014aa9bde277aacb59fa2a

SHA512
6fb31a45e0aa140ede56a561521e938137f7fb3c69744d79e34ab4f8c2fef7ec27362b63ad0d3fbe8b9eaf8a236999a31c5b9e40424df2441530700f60a71208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7bba372100ffe3598a0828d02ced40

SHA1
a90710df88cc1a2fd8d27970505bae4648bd3a8d

SHA256
38861e7e303c368eee469b7df43655da6bc1541f945cfaf9ebbeaa5a3fcf5af4

SHA512
913f591aaf0f7f841f8c3b93c7ac87e17b3fc7a7fbe53cac9cd408f32c6b9a034152bffb6ffe9321675a2b90a3195a26bce36b10f5b17be15433efc8bcf1e39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3822a6e1b60e03e735ac82b5355ce573

SHA1
b4551cf537984695218f739dd01a2c62ccad475f

SHA256
68c939cd73da7a9110120d00747ce9989c92f0a972d3a89ec7903fa9b6871e2b

SHA512
980cb8b69b318352cc85bc998649e0daeb0d3357aaab6a0bcedc772045051ea60bd861741ee0367545f4007a715948e10a4b9c4136347918671ff75a219ce4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f84bd2baef58eaf5b5de9654c5e016f

SHA1
83e23d94af91fc295a865857e1109df161a72c00

SHA256
3f947fbc73e7c0463835b47e4cbde951ea151cf163d6f00cf3b61ac7952885b4

SHA512
3a53c404c7596c04032f007cbdbf30fd088f995487832a6089b87a8cfc608d0eb621d3c0a5767c66860cd8f12c8abe7cd75aa70f3bc08bd793c79a9f954c5558

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D5F.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D91.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit