5a8c46e899347ef36b7e6796791d13ec51713ab9327e4f61eb21bbf5eb1020b0

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.html
Size

26KB
MD5

308e3660458bc475645ccb8b64d0cb14
SHA1

d735174a7d344b77a14121ed0c10da2258964b8b
SHA256

edbdff518010bab9239b4ecc02b621d24584cb99a00b23488244529bd3ecc3ae
SHA512

3ce2cf4a6afa3defd7faeee54cefc01c80309289c2c1fb4dd087232d7dc9a7d3a6b88e8be3e8ca73d03f5af4d1ae144f8cb50708e6e41fe48cf5d76547ad7a68
SSDEEP

192:nyvOHNepNSpKma+IpKHXnej2+rKMSlB+vITkeAyb3djiHbD1+r//fWma1eyXDHa/:nyvOt0Ywl+IQHXnLMSb+VeA2xyXDHa/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0699b436012da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca410000000002000000000010660000000100002000000096c73cc711af50773bba8f3a791c52c759b74e34b2ac00a158f65e094cae3d89000000000e80000000020000200000002f465bb90539d92b93cd761f17fec170f34496a096f66d8119dbc49d8d8b9b0090000000a32a2a5bf62925f861723257ddaf522a474fa4b7b0b0a9ff16f071c0cb0f5f23e8eb8d8eb27e79b9a907d40d3afa39cf2ee7e137b42652bdef66708f5411be15b4c051dc3fcce80afb61e5f1eb9779c6695b077aef40af32063c73a0e9566c2cf13696604eccc321abf0f2065d1877ff240981f3b5de27f8c4380478b85f9d4294f596597fed6ad631e2e9f2b7a9025b4000000073ef485b851a0b6ee92137db5a3ca9e1671f5af872e31b9710a366fc468a11404f7a20513b45e5bbcddfe94d9b4c858e3aa2e6de9b2510ccc35f56e3b4c36e3a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E7CB521-7E53-11EE-ABC1-7E8C2E5F3BB1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000c3a6c4ead0b1a21762c894fb7d5ae76bf314500d4274136341e18068c48132ee000000000e8000000002000020000000e5d8c6d4521438ee553ed0dbaf1d927869449c8260a122c1cf6bc3dd9d46cb5c2000000082ffc37d3ec4dde3d2f1a14e8c48fa5840cc4a33f2a78fdc5c90b69196c237354000000059540fbc2bdfab1bed121ff4ca766ae9464aba4fce410a836f2ff4aa398c1aea65dff301683cfa6158b4b8f0aa4115e53a3a5a3cfe906093522af10d50782d5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622597"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2688	2876	iexplore.exe	28
PID 2876 wrote to memory of 2688	2876	iexplore.exe	28
PID 2876 wrote to memory of 2688	2876	iexplore.exe	28
PID 2876 wrote to memory of 2688	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b613069603308e3f27aaed0d9f291981

SHA1
0f39f9446a1f50dc650b6c8dca969fcb33a173d5

SHA256
94711c8708d900f7ce6cdd129d93526e2af51e5ec642d34cb75f965d7cf52d99

SHA512
9dd2dc21a930dd6dc4d23f27694ca06dc03f2b694460cad5d66d4d0068be70f72a39f805944ca07a2917f893c9a640ae1012b4353479172fb1018418cf39b580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf5b6a46db6654430e7e4ecd310d8b9

SHA1
5853aee218ab6c88ae8c82582f6fd4b228c65d26

SHA256
fe86f603477e53b501957027cd612d620237ca2e6b691f658718c32b88a43c84

SHA512
76291e53d297dea93c40ab09f6dde7bdb1ab4b94a004c50264956b31e195f4a7adea7eeef9f25b2d757b067b4429fb81e5d96fe153bd7987221ea7de35bec768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8de24246df03a55bf5dfc2b91aeb752

SHA1
8685fb9fc8259d8b3663b3bd02422974ccb97e42

SHA256
9e50bf0a78c35f6b668845adc741acf85fb6755993af71b57548ae68e2548f83

SHA512
df59830fb3f71f265ca4127e980e9f0dcd451c4fafbf8bf8a716e76a0636ac78a797d85805973752e4252ced93739c966a9ac0026b93e7240192951ad78b1fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75ae97f205fc76afc57e84a42c62ff4

SHA1
be46defac4d71e2019f565cc380d20555e63c93e

SHA256
302e0005d9766c2f1cf4d01d907be4fb5245f2c229b8f8ead5f090170de2f4b8

SHA512
7a3ce37fce09c16bc92b5e4716582944d245780a15f283e0dd3f179be0b6430c4efd830dc40834665a303fd2ec2f7d04ff03365c973d3c6714f5d7a22ea1fb99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f9093ecf7ae82d209c537f6dd25412

SHA1
d21f3e13527a14a384f06f9f02204cbadf616a56

SHA256
8325b4ac68b2d5af5e62e58966a60f3a1ad451cd255aedf7c7030d4134dc1e14

SHA512
d67f4298038015281ca23c605dcb4269a3eac3898506ef629594b7ab3b3c30e0783a7fc40472a7c1838f47d8fa573172286cba4ffde4c3067c805319b5dcde7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cb7e67a3fb09d9d0781021336154dc8

SHA1
075696b446ce13fd63b1699d87d9372e5f3185bd

SHA256
abc8c4c65d8c87edee441586fed25c5b47be14925439dc2659fe35b7ff7cd8ea

SHA512
c48626a398a6c3148daa68f55e5e4305d390cd666202838b9f99c1d3b534768c78e7922ae3e7bbeadc43a01ca6a8014c174666f0b52af245c4492b036681e432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eec509fb82f72fe8357ea030f08797d

SHA1
0155bb61f981f86f5879041864c8784e55510490

SHA256
2b447e6add65aae8729fb3aa5ac3c266485760eab4855d6e5e9a13124cb63008

SHA512
a397fe6e630e050f93562b3e32dd95aee6d07d066f0c83ba5d52f6b19f37c4c462ab5f95d0b2fc7b41ae7d28a35b1aade84c92283d6553891566f967aa07b565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15993d7884e18500da281d9ef0913cc3

SHA1
8266eace40229cc016086269e697d9bd67c4d75f

SHA256
e24ff42c87c5534979dbc5328e195456929af114682e70de25c9e53a71a7a8b2

SHA512
1506d02720793d87ec8d7e43380e6719132c5ba000d12206a09df987b86523e388099ed0c22ca7201c40530d6afe1d352394385a9b38af68a07e6d0e1afd95f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d67f1bf6f66a3dca46fb8d477cf18551

SHA1
d95b3e381bdac0625aa7286807a5c094afe8f2a2

SHA256
2d77fc1b27157c3ad84a64b92a5d8af18665a1883ae175a0a102d10609ee6c1c

SHA512
d05ccadb0041c71485783f19fb2417e55c0dbdb5158b4f0559214a7f9ab8ff45f7835e35b79066dd3bf6bc4f0593ec06cc4cec7390adc2038d3ec989886096d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af0f256c4025e3f98fbff2bf14deabe

SHA1
d59e88f11ae255c805e87ae5496281ffdcd2a490

SHA256
da28aafcddf260b21d1b563b0298a04f184900f02b6387a41740b9c9f02be3c0

SHA512
7576a50b260e9382e6be947d5d4d8e1abe90b2f9b4c4e4b6d9372f4bad315c65d340edb82468c754ca6569a138e37db636cdd131ce70bc8fe1cef9a18831f330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2728c6af84c04aaf3964d88c5116577e

SHA1
5b999bb1dc95f30041f2433db26ad14becd9f5a2

SHA256
d819d0011a852c7e53f2fed8b61cc1652dfc7bb179fbac3252200ccb6751057d

SHA512
2f095217e95e3eea47c1f6d298119ddbcb47587c3bbe9606276b013dbeb6f2409629dcadd1569270e1e18c3c53f18c239dff43a32ab2756712f96ab2b50b5b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a0f3d51bdca37e319f7488648d74b2

SHA1
ff700e294420a09c97a853ee236f98a2d43d5a34

SHA256
91f47bc214d5bbf67e924b0d66028e6d6df07b928845981b5fe674b103a912bc

SHA512
8f7d2355f04deadb3f42d53f1b96c5f6090c67f26882f59c7ac802b9ca705c91e9ec435522e2a87d7a97c55e2a8947670629fbe5d519e2d594e955ddbaff59f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2d31382fca93e4fea7c004f34a98a9

SHA1
dd65e3d65203c347fbf22ed6afdae5e8ddb77294

SHA256
482de2ca422615cf75987156e37a6d93542a22da3764d5f700c388b26d2d6ff9

SHA512
ef8594a1f05407b4c4fbe02abebaa62a3c92d4698cf241df16572b2a3a6f41bcc4840d1964e4d7fe36b16a476333288c2368aa4e24104f459237d0f969000e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d3b60a144fe1a7d3ce1c5317f76514

SHA1
822ca70d86b1b26a3780498604a6f80e4fd46d0f

SHA256
8b038f0fdf5e530af95843e170aac95d2d08a04a9a2fdc117f0740727ede596c

SHA512
b3a05e6b1823a4cbf81716688d89e5d3b9385837e5fb1b17f54b7d57a2faa2dec2dab1a5bb3e36d8add24e431857ceadf5d9ccddf2e1ec58d8c30fe017b016cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f813320f7b28874e97b87da0833af992

SHA1
a6373396a1f84662e60fc291eeac69dee309153d

SHA256
d436e59755a1d7c2486303cddcd2eb36c0d60f9316c07b79e0fb2b245ee4c7df

SHA512
0529e254fb98da70488d74a7e0c54080353a30cc6cd37d3806ef03a084f570565f47efcf69a783dd6c20ce75132a2dee98afa2cb690c242c44e18106bbd146a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA891.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA98E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit