d60530634338b99acf6e7f9b01e46aa42e30b330b256f809e5fa002154d34f58

Analysis

max time kernel
132s
max time network
194s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.html
Size

18KB
MD5

2d6b7a6422a5933661cdf88f3e5fb7ce
SHA1

8a919b7956efbeab43d264e98a7bb1bc62b7beb6
SHA256

f6d3654c5b3619d0c5b0f85fedc7db5b4ef6c6a0433c3f630e57e3c0797161ad
SHA512

fbefd7166b9993564e4181cb97690e3a1eeeb63437c7002a53d956f140433261a8f9f57bb228237e1a4452df23573a8ad9f4bd80e5956320ed9d72a4e8e79437
SSDEEP

192:yyvOHdepNSpKeTnIpxBJzjSnrRgUFmkec/P3dABVSBRbB21fD9z0:yyvO90Yw2nIDBJKZech+DS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000004978a1a0bd69be5738ab2210d8bd23a63fad2a3c8ac6fd99e7c71c6ef130f3ca000000000e8000000002000020000000e8874e5d3aa324db900ecbc7ea12c4e6055ad9b697acf8c64f4661430424c4ad20000000654b655ed9123f83872945073b232e442e50d2c38a25973d21d4b59a019b7eee40000000c81f6c0413a81a0155cc5aca427d4e2156f2e1258d69a5cfdd53bce9523ad88da520df81d481feba115218fb4cf52c5fd79780279a9845a788e24c7fc6ecb69d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA318521-7E52-11EE-95DB-C2FF944EDF5F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b440c05f12da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000093da06808d5be0b452b4427453ad26f4397285035f84f650f429e6d15343168c000000000e8000000002000020000000c4cb9e90b1a272b239197fc1381fd63f44e7628a2a3918c9b6c5842e4d5b38cc900000006a96af4e2048601aaf018d3291c5460cdc1f510a6d6faa72ea0e00fe6aeddd1106a0af90d57574d492a226a2562d4a61f800877b258c58abc4efb1d7ec3f6d872c39a77541513cbc89453a2b40e144c25894b63d0f8cb62792bad61bc70f2ca81a0d9f95623af252b9288c235d0b94fc492e2d1af75d4e9ffe101b98c59a7f786c7f19400ced58b6bee87adb155f11e540000000a7b1021dc3c9f6c66b8e4cb7832d902aeb1e0f328545a1f6f94cefca8112615dd2ff3d0c770b2f4f28c1c401476688adc0e843ed2d2e73c2c97976ea8b14f9e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622376"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3016	2880	iexplore.exe	30
PID 2880 wrote to memory of 3016	2880	iexplore.exe	30
PID 2880 wrote to memory of 3016	2880	iexplore.exe	30
PID 2880 wrote to memory of 3016	2880	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33e06e93a37070f86d33afa73d781c86

SHA1
19c149334f2dbcad98300c31e4ee64ab896b9487

SHA256
8b9e5e42794c92291b52f3758dd2df12216bb84911a3fccdd2bdd7247c9484e8

SHA512
9d9b617817eec250b30895e90a87594b66b9f3feac803c651edccd483fa6b4eab8763b05f8426f20fbeca54f71964734e1a92de74529987288235ec10a81ac51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f8e6814811cfa14437841216b35aba

SHA1
ccc38897fffd97273631350c8af43b20a4a4da77

SHA256
2ce67abc36aec69a161606d4af15458c62bddb7cd0b9ff4ee9dc21eea7f25cce

SHA512
4dc33da68697e99af40a20dab33547a75eac7f1dd564de41290da1318a1316ceba97ba7491f3683770646759327baea1fe7e2852d9a53ffe1e35da8d48f85d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9379c79f32b1623a74541d68937f476e

SHA1
9ecfe7761b48ea92eac4cb13dc236e63a3f6e834

SHA256
24da1684ef1d2ae5c99376139b8edcba005a650d27056d84fb90444dc501e35f

SHA512
335337b481f70261e51192fde4edc4ba429e0aa11880e0e5957e672e142365eeb54d705d0e9000ce77981f9f1acd8720791b39b4526c5d1d5819e28aa6cfa104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb965c505067d0e663e8e72275b55eee

SHA1
e47dc1f8861ef387f04b5d382775c61f14b34564

SHA256
09d90646e0e24dc97c334ed8e76d488d05d8da0148d73dd5da5efa9450c69281

SHA512
8c553600298f98c1c73b3b957199b635c7ac5e377795c3d5c6d82a128a34ca81b9293ebdb5ea5f95c74c3530aabbe5e88ecb0619c28751b07431683623b3f3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ffb16445b2e69147a645f5f79dafa6b

SHA1
3e0c05bbe63f3780fc7cc285a3f6c4a9f86bee01

SHA256
05e2861a9353095efa96cb5d99b816d8ec32e7fed6b479c5d700baf5d779d4a3

SHA512
c3f9e8995113ee19d11d9804b3acf992d61927bdb6a5a8dda0786612820e8c94d9f29428d0b40c8ab36bd62ae46966754f526c12789bc8b61131f16c39eaea95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ea6d34456e87377d02ab61c2532aa7

SHA1
04e7a3db1f3f0e7876242b6f511971ffaf82bace

SHA256
b8ba8e86f7ba93f852833d45e1fec3365d1e8df10b85c7012f6a8890b5705faa

SHA512
34a4be9b8bbbe4c1263b8d238b92b98aa6d034a9246fb9db851ad364f0b54bddd4af0a8389dabd1d991f2a33acdde6009b899bb2c8b758d65f6b60fa1bc62fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9adeb74099c522c11ca0fee7d875d3bf

SHA1
ceeb16a2124c78c34be216466447d05c20476409

SHA256
c230bf68dc4b2750e4f695777a961e407413a5f37ce60742e56f6c59d8177d45

SHA512
2173a3008a3da741c028a4a248482232d5c82e9048ff78fecc7cb98f54b6d82ec06032c6db46a93e51f50e210fed7d78205cf21fa3a1630a0c864ecf11a40958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51daaac1096dd5336cd9877b4b24cfe4

SHA1
ef775a6e29ce319ca53002a3605336306e367381

SHA256
949e9464fdd308edc5484ed36294a6dee0f9e064e96ac0805a80801719c38960

SHA512
b734e03a16ca5ab8e14c4e445db02399f7c8b3bbb3ec93358b88ec61c034b2de97e24dc08b47b6d8f9c5c34d8d19cf4ec9a3978fae706db958920651f52e08f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ed368780e91a53e1a7f75c14da1bfb

SHA1
d85345fb7b5776a167593bfae9450d5b63ddee59

SHA256
726424bf89f1ade7b37461b17a4a406a66e852f6285f765695e46acfd0af050c

SHA512
581db4af57db9e3333dacc1f0051e4f55df42f48ddb3a57626b78ba10d7799412d4b853b5fc7e5f32df9f681081eb2f99ed9c93bec8eaeb104a400c0ed7f8387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd809cdcb143ecdb2555238cf2ddc72

SHA1
889b2bcdb6a785d95b767bd92420c02b1e7ce04b

SHA256
e4c0fc1cf6d79435f56410b9f773f9e5ae4d68893a55653d110579f1f9f93ee6

SHA512
9b0edfb5ec70eedcaa502df707552fb165363122171601fd1606dd01c638554ee10de60e1b69a67e661efe10154d37b1bdddb7e2c98bf2afe4d98bcd98d8b842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61A3.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61B6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit