5a8c46e899347ef36b7e6796791d13ec51713ab9327e4f61eb21bbf5eb1020b0

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch10.html
Size

7KB
MD5

db56655216d83a6a93f9af13656fce96
SHA1

48476d6b9d9fbbb2e3c649c0bb3097150d065af9
SHA256

432b08d094723e74b691197b5b6dde99b4fd8deda82ea3e2a09df7b38834b326
SHA512

d9a83eabcdb235d3c0380eb6a6c8c63a8e51b2ffbcc89fc27f5eb549b5ea358b17acb5d2d686e4453209f05bc8b743fa53ddf5db5d5343468bbbadf5b2aa9b92
SSDEEP

192:nyvOHm4cNSDZF/qxYY5B8nJ6SLEeV+3z/+dd/:nyvOGrYfqx4U3S9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000002369cae54e91503ac2b27881b0b808146adbf6cc663d3cce94df2ca4b02a7e71000000000e8000000002000020000000d6bc2a36db988ac9a6d2a6197c10e808b3cf61ff37ae23fca11fad81d81a7a7620000000a6ffde0d49503e4bc7fb4c4d00ac5dd41a2aba59ee7df2b1278a6130ea33534540000000f70925487a141329b7a4438104024c0765340d9b6b3b0ee3fa54035a46c25bd0a8131d02c551cf9b7cc35617776434f2330a7e8a3b242daadd317b1429ce92a5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000d844f477d29f94b9839d4c666ab84ed40023f1af793deb88b0a1965dec9f883d000000000e8000000002000020000000f82b249e10ae45019ad71dccd4dc36171bbcbb688a6a42819ad7ead02d8b02849000000064206c4c53cd9b0303b94d85a7b1afcf58835008dfe4ba0c64fbf03fb0688626b4fe7f548f9d064fa0e249e504edb5b9b1e7d414dd7af445a9e7d3996132f5c8227a5b4828f65768c495ef019501f899132473c6c8eb88c8f3870c746909d24e3114830c9dd761e6b7fcf358b34f0905ebe72372a21a98109c9f6e5e5ace13b0be27212b27f28398ac4c39aa0eebdd2140000000e201431afedb614f43ce5e70ca4efa2938247d73c26bfc471a804cbf58493072cc20ee0db8d1c237dff639a056692a724ce8af47e02d9d4ab4197cfbaeaa5d2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622667"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c067716d6012da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94BDEBA1-7E53-11EE-B37F-463E77455252} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1280	2068	iexplore.exe	28
PID 2068 wrote to memory of 1280	2068	iexplore.exe	28
PID 2068 wrote to memory of 1280	2068	iexplore.exe	28
PID 2068 wrote to memory of 1280	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch10.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c3330bd0df8cbcf3087445efe165e6

SHA1
9b2e4b3e0208222c26c52c3940bb1f74ef55d741

SHA256
4174da4195707597396315ea229e8d3b4aade992a21cf0df708f1bad40c95ff9

SHA512
2161c574430af1af0ad89d9f1b1d4e2fb97289473cc60d4e44c5f10c90197db67cb9858de09ba4c1d8223ecffd0988a54293af873815c78e38dd6561203bba09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd536d8bf76452631e6e79946bb58212

SHA1
60626a69d6bac86fa36021b38e8473d09aca0279

SHA256
900c772372af03578337069c774cf7a1379ab2e8f3c05a55bcd27022b3aefd3b

SHA512
e9f8db6a2c0bedeeb2e9ecd1f1d0ee1eb63db999dd1c4d556965fe65c8133bb9b8bf48336c143c1439b90f02617fc7b1c6191b4cc899049df643ac67c9ab15d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb1c8092d258b6ddcf2acbf706cb74c8

SHA1
cb7d6007e1ed634db102185a14ac1987ecfe2344

SHA256
6159ba75aeefedef55bdd4eb084c3920fdfbd1f164d18d48d2e20abe4f7764fb

SHA512
317f4913e45a8e011908734d86026a9bceeb6142caeca74fed08b81ff0ac3ba3f16470b1e50ff462e8d70029766d5a0c4bd096f3ea9e838fc34af8eff0970753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b014a9e7539e7ec5c13cf2094532ecc7

SHA1
22ca752669f7c49a9fd4020dd6c0cc1792bc688d

SHA256
0cd1cbed2bf229dd2f1fdcbdcac00a4b6e5648906fe92512b8d73427db10861a

SHA512
e3513674078dfec82d6a083239957bc26ed8bf770dffdded51900af97fb9f40c17e518aaf10ad26904da03fa844e062854d374d57ae9102e163ce40d6334f8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec9c604429f939375dddd33b332db62

SHA1
a2d5f7d6015962a15999242c3e0cc557c4e6d6fd

SHA256
1e1d8f3fb8b4ae258a1b5fe5e2a59d8499c47b4332a0efaefa6b5389dfa9827c

SHA512
fed10fa597be1c1feb1997a63878fc4f8c0530bcf61e9fb070df182b7a8ea4766944170d08b8fcba89e9b990b0961de15d502180c0b9566cce362e48c3df246b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca375fee34ecb150bd1d4cecccf80ce1

SHA1
4051a32f5ee417e0dc87fb4e634a1b125d297899

SHA256
2f7d24dfe589ee3ba59edecb86789d6de73e3913d7f3950ba3acd7663b6fdea2

SHA512
96a15bebbc459cb02543846974fd7c296b13e86c5685981f78c941fe0749b24b127be3ac1897bf7be2a4dcbb8ccecd04dbaf9e1c8c88e5bc30ae642e8a79f43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb78b5c27a55ea6db7d2014d95a02b93

SHA1
c4854c59af8572af51aae1fd3cdd8781e7400584

SHA256
4f2d0301ff79f32de78a7cf1be52aecf33db920cf5f612c5576f32c8a4b10241

SHA512
1cbcf8df0f362a3610b377c7675d1f4328fccf9c929f2fc5bf23fed5fb8a0eb6be0c9c50323a92211b3773e28c23866d2c0e97d10894389295d8b011229959c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe5be4344feec342792f83745e5fc0f

SHA1
4014c42ef3801f2df5e905ce55257388fe9a717f

SHA256
9e20b7ba38305a10a842f404c4eadbcf2c1ae6dd127f7735583e5f83f3dfaeb9

SHA512
a37a3556a9a809204b3c4f4d9c773764e97667aaedcc9ed13f8baaf2cd24e1839f431b918a85d32cda07b4356cad118ba764b95030069e8d5051b9aa6a671261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b1ab18799a0938310683231624ffc6

SHA1
be2d4d789b29e995e77fd93df8e17f98ed49564b

SHA256
871548125dbf3d6050a86bd3281df08d4cab256398870c782a9e29f314c5d7a1

SHA512
6db49fac5598df709e0883fee1c811da83ed73bc537eb533fe088758e477c080bf1d1fddf44c1d160f981ee487e7f6cab18e8f9b526d16d865d8a0638f36c2e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3CF.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB29.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit