5a8c46e899347ef36b7e6796791d13ec51713ab9327e4f61eb21bbf5eb1020b0

Analysis

max time kernel
134s
max time network
140s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch02.html
Size

7KB
MD5

9e2471d4ab12f3da9a08a8b2947ddc5d
SHA1

80fde91ed6c54b0698ad70c3cb9ad7e085964bdc
SHA256

946aaaf139c58eb4def1cb9a91533750e6da90c7f920f75206b0605f6b05e546
SHA512

a6207228a717d32d6f7ebcc6115321703dcb3cfb62f35efe953867c244c35a02b4efc7f83cb4b42e7806db7361df6b1e65dba5b400c4e271ca101f30222103a5
SSDEEP

192:nyvOHJQlNSgqkDqjc+EmmGDdrvvI16vU2UMzl/EHzTR4nV3IuFm/:nyvOpAYjvLdnUm5O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000c1b819bf364c631096828b1eaae255e77e7c27d5abca1ac9b838144d43f44e2e000000000e8000000002000020000000a0c71ff697edaefdbc43b5ade54bc6e78771fb059e7f5da7b1856c095c2096e3900000009a335c5a1af9b6a9b97f91ff5c433526248b80f2045735896afcae80db53a506bd990e610fc9e9d8836d3563863a477292ade0a85b6fde7f296f0b0dea7f3ec48cd76cf210f0d8d62a21246cb0c308798eff886456da61d2892fcc10d736b1d6291b30b5f2500b4dbb4cc22d8d60e5cad31044f37bf403c8b675f8525be4a53cf6b084789fd7677e4a8c96ac8cdf4baa40000000c9561bfe7b6055a7d3a227879afde514dcbbbbbce11fa072506279155182df1ffb63d55b9ee1772313cb7121767e33eff5c768a421fa171134523ee84000ff7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00a16876012da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405622711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000003256d74fe90672533781798b75e3b38a676f14965fa10ef7e34ee3c6a97221f3000000000e8000000002000020000000c594711794cdf92fb91d513c3b9e03314aa375cca46ef4585e598988b187961720000000cf2437fce119636d391e625f8ceb680f016c9331ee1808a5e9707f67d6a425fe40000000715986d04052abee5f9aa0eb582e23c613d570ab9fbe4ba08cadb467d5d20d4d9e24662c7b154e3c450f42554bd324d9e9e3e2c9ffc4ac946237c2a680a55c76	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2465091-7E53-11EE-B93A-C619D83E0E05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1704	1696	iexplore.exe	28
PID 1696 wrote to memory of 1704	1696	iexplore.exe	28
PID 1696 wrote to memory of 1704	1696	iexplore.exe	28
PID 1696 wrote to memory of 1704	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch02.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a9b77474ba2787c51cbe76f6d7a53e

SHA1
ce2d0ef2873a21d2f45f0bda04460848a310fa1f

SHA256
e8aa058c08ad81c40c8f26b6c45888a083a598b53b024ec0b3ad150fc5ae60d4

SHA512
bd6a91c120e50919bfdde2bfa5cecbe9fec208b4613214469e597786e214d42cb25cdef2dbf0b212f9db41ff023db3d3b2f6dcd5fcdf6d7f986a158bda396200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c193c50dbdf10a73a8e1237eb6daa9aa

SHA1
e3b96da3304890077693935ae50b9dffa99e8f1c

SHA256
475312648b5c0e20ea71c0bc550efebef470eab36d957bdd57ef9679170798ab

SHA512
e07e6007445d94b92bb2d47d43159ba9151f38b4a86a5646001c128c5368e809cd9d3705093f8442f8e62bcc2f5c503458f6456731aee036bec2a8414fa06683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bdf6c7fa1cae5de65f79b0ce455cb1d

SHA1
852fd1858f0447780baf18263a0a040c578aaf66

SHA256
87f12c78099c3dc26f4017d5224cc76d25f106856d015d995296888f90489aa6

SHA512
146a7871e420536ce734b897383c033eb7cc61a6cd84255fc195bf8ebc266dec07b4252f75e421a8a01a6c3671712c00364aa465f3b04d110f09f7d4e310ab80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a7f4941ef8283e9206cc053a8183f2f

SHA1
cd26a2a0eb8b1afe4959b6ad82817d73c944650a

SHA256
d7b3f0085f0fd73e0dc9c85df624872b5661b2e38a5a15a1459a7a4ab8241dab

SHA512
152aa87cfc08a22e0e9b8eb0d672561e4c3c67ca0dcfbf36fda136970190df628dbbd8e064cdcead847e6390f81fcd81e095838e49c4f9cc9a02283c7055df33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a6d4b0b41d0583b5431e69ccbca326a

SHA1
c1b307d52b8b1b3781f1879ff41eb0bab789a772

SHA256
791395ae4c87513325591aa86d5a85389481373690bc1e044a37cc27f6dbf193

SHA512
056b6f582a1517293ed9d0ded8bab6c46d5c3bb973de94a77cde2a29c7eafe5fdcd1230807db82b9733eb0c78ba363930137d86a9445e37d71315341e8b35a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebe4e364f74bd62914a964f977539052

SHA1
9294f2737fc499c646e3329f3410ec0f1223904f

SHA256
28e585fffee10ecf50ed606e91f8a64b63694f4f85943ec7d0c59e2fd5df973a

SHA512
b9701984f92d4d5772ad9c58e318d6dffeea037b6a06c8299c7797cda764d990e2295a6a6d636562a9fbc056ef8a0b027cb4f1a70ff0428c7039bfa2e67d59c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b12f7286756c617e8eb4637482dbdc8b

SHA1
52c779da1b456b2ec09aad0f907328737d2f2e97

SHA256
25697ffbf5346b2079ffbb4acd013c7eb3e4a6a4ab77ac695c255046318691f5

SHA512
273bacb07c291bbc14d1dfc6517d8cb2e35b39a65f769bc429c5ef6c0ad0ffdf6b16d731b47bb1b2826dff5ed0813408f6d423b05073dd0778c495b553d31cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f461708ce05aa1ee3c88e4464512f268

SHA1
d8eac7d7230c0169c48082d3ef45756d9b931492

SHA256
e174703651440265012a2a9da869bdee44bdb436552c128ecbee631a1b906ce4

SHA512
e6c820faa08681b05f8e4ee1fb8c9ee51bb1c74662203a7d98c51321c9d92ddcba07e3d5a9c3965141d5b75bedec59438961329e103d70950b1341d076c4ce89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b073d5e3c6cb36063672400955c3ff

SHA1
43bf86a6d14bc4e122bd849c238ed14bad9d8dc8

SHA256
e79a1fdaee882b9eb27c19116b07ed122dad329a916037f7cb41920c0375cc48

SHA512
70de092214cf7805495b041e0c615ab4de3df73c4743b4ea11957d4585b2351fa8f88c32cb2c536b6db65460a39bd125adc6077a2bb885d636499313faedc511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed16893f51f718509df115e2e2ecc06f

SHA1
370d3a65e2acfd17d9fc267bf3c177bdf765252f

SHA256
2ca55f1b5dd48352c89e2cf2901f0340699fcbb225fdd1e593d07514c2c76221

SHA512
c7861945064ac630848d9c00523a5c8955c9e24189e9007fc33429c86ece1578e63eca5da50d760e893797de348652f0312f3f93146759335b8178c9098074e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab915A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar917C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit