73957fd1f888a8f94d3c2396e52cce5ba48b8443960edac35caa1ff4715f51a0

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch06.html
Size

530KB
MD5

65425ab8ea50ccb9dcbb226f1c72758e
SHA1

87270d8ca35c433ddf3734bbbe95258afaff1544
SHA256

6946982e693572cdffcfcc661b1e5a59592529b0cb871e94f0bbf99f312ee76c
SHA512

5660aee6d5b64b43160184b9431670b2839624e1d1b85c067ff98a8233a5458a746470fdb0b0afb12c78779bef6f8b962241b3e08bb80404bdca78ae37d2ef80
SSDEEP

3072:Z0Oz9I3iaHEEhAkHp/1ZMAfq9qeSz1VmN/5SfAdVpYVp4tVGCXt5RPzj52:Z0I+HEDkHlvW5SaVGM5RP52

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000003fa5d117990fd9c9f76078190f385c2729a9a26a7a82468331ce07517c7a2504000000000e80000000020000200000000a8375d7ccae441247ae5f0539e5abc7a71a15574c1d0f7a932de0809cd4492e900000005e511ced52272d6a0383a3dc747e7f0475db96e0eee530ace0f87f5fe583c68d1d624736ff4aafa4f1e2b883b3e40e14c8ead57506110787eb2f87c9a44f97b60408f3e9c3ab5c17eee81c2e82f1255aa1928a25405c56679418808b4b99c36642904170dd9fa9400d6ae1b7670699b2f290631498e459df2a6742d28684672b60a76a4f47c7207283cca538641f786c400000004f49573af91da4d35eeead39a8d5aed704d2e40e744bd9221085277229033989fd4273a348c129eaec80d985b3d2c33106f4eb14c44c059e28d6ef33c0123907	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405554748"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c3464ac211da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000bfee6e120364043a6b00373a9e9bad0cbe5dafd6e3109600b6b92823cebd3932000000000e80000000020000200000009256c2329d7896f3bc92e27b462adc966d4d0decad456302dd70cebb7254a17a2000000023278af5ddef8b0d55cf71ed5e6296447a87e2829d338202225ec21272b36907400000000ab860fe06553ee3f2662387613d9958f813a60c1c3565e0a13ad4cffeedf3d6c385beb718e4ec87d326747eece826c1c1fa3e40ab41cde6a67e3314c3da4343	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{751ADF41-7DB5-11EE-BCAF-CE3FA04DA9C5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2676	2836	iexplore.exe	28
PID 2836 wrote to memory of 2676	2836	iexplore.exe	28
PID 2836 wrote to memory of 2676	2836	iexplore.exe	28
PID 2836 wrote to memory of 2676	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e38c24b7b13754442ba5fe73ad80a3

SHA1
5053109857799b7fb5414b192ff3a3c045055e90

SHA256
a86c00469095b20a0558041ee7930a58d83f547912ec225213dfb17a0918e2e4

SHA512
f00708757c50961ad0ffa0b813ae42ada814a3e4867f5995a358b660564decc85f356cae01ed1fe217eb94082a2c2127ca9ae64ae3b63699911acd2f375b3068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ad95d72c39bd641e4096721be548993

SHA1
c2478afad9915ce61ab7f59372a5b476d0a87e8c

SHA256
6ff6060682270e21dc0e5586ba9e0e927b4036668f038f9cc1e8595860863f18

SHA512
d2a44160c804a6767997499a78ec151a6141f09b58eda102596ce1a99f50777b826e9d7c0ea2008a1ede2afa44e463d12147714a4c278a508634e41f1722330f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c7942def01164704871c37559b7cd9

SHA1
4309125ad4f0d42c96e3999dd020ca8eb8134dee

SHA256
84de6ef13436f8b99dbfe70df976f23ef08cf3c85b4e80021ae3b5285c5eab27

SHA512
d13ea8832f774aaf1e79a6a137ce304d1cec12af6bfff7a478148f36028e398f635762ac56615ff1b91b110a0c2b693f6493966f113d296c37a4ffac8916568b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f4f5281b592143a3974771767f1ca9

SHA1
81cbe247f1a28f95d16409e8aa0a1c12e2880b1f

SHA256
0c55cd9f3f7e8652615237d7ef525311ca9d2f4f3b84b9630a758b76d29b675c

SHA512
87cbb7b8a90467e40dada9f33cba7431c6b2c5e302db6887585f40e03de5310f098f668eec78564553f9e6ed58627bbb462c58d1eee42135709adb84973e5510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
add9b46b95875bcc413d631768d69920

SHA1
fcfdba7cc3f0ac3b816f67ad91f4b90cc2a8f193

SHA256
f307286bb094bf8ee42ac09235d82d05f91aba51661db6d113244b4ac249eaac

SHA512
1a0b06f82309a672309c1d22b3926d29bf9ca44fc848af0546f05f5f588c9a6115e641dd4b172d96f108a9cfc1ce0207ea066830dd58ddfa3138fd2b66590fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a33a72475511b3f8e00007f2c712d5e

SHA1
05b5a1b93ac5d458a63c3cca92141a7c6bcba0cf

SHA256
94976d8384174f8aa9a6263bbe39b68446fc58d7e6399c286ae0c95bfef82cee

SHA512
06d44cef93a4aa0863aee87234370e673a7ac7e3f1b8ff7ed76dc9ee5af2cfb506face69d119c16e06c920b270ac47366bf08d3871f9ef19e22ba299754e3494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39a4a15233f34f2a7ff091e953f7bb8c

SHA1
304412bb43de1afb563e13cf505620125129df2f

SHA256
02132bbcca0250fd7171127a40cd3391457b046ddf43c812852651079ed3dff8

SHA512
35a72d54d908ce0c2ed6bd1496b221f36640c40a8d198a80e1b4235f17f39710220be2ed1f9bce651cade8eb766210498828388eda8ee316ee04139c4352b750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da24caf1eed5a737391ea6584e571d5

SHA1
ca1c6a48ef0cf3cc7088d8205e4518eebb2a658b

SHA256
239745514b44fed10b16f9e461d26c6ee537d1c73bc4fa127af432f449a059d0

SHA512
9283d64020920af85928103d84c40b945df51d2a8c6b25bebd72845d334369c91b784a0cda4724d05ab8ae572af775f339481445b217b056ba0dc5b2629d3b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2532a2cd660e8ccc1472e68abeb0399

SHA1
98409871835bf5d2c112c1cea971fd18fdc9b1d4

SHA256
8aabf70b012c8d0cb2639a09e640c968b1c70de2ef04d72ff6b4900462d28469

SHA512
63402f2844084c543ce399aa8a2d891ac608d1966c6155987fef193630219bb0b05f1fdab10fc96abc5059e0d5284f1c29035cf14ea247785cd44056b8731780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc7ba17468313f5c3a3e42510e1ccd9

SHA1
5ae54e5371dbff34b6817e72360adf7d6c0a6f7d

SHA256
433a25a8cd8cada91f1ebece64d8ea3166742a0d7d451c6362e9e4157049d8b1

SHA512
a0511b390168a1d9e566f41e482597b8baef2fa0cd8437bc070097adfeb5235fc371d0950ba33397838c92ba869925b54008ca292716f383ed2467864d55e04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a80d2dc24a6f298298a53d76f02cf69f

SHA1
2bd8ac0b5490bc422de4da596252533f10bef929

SHA256
0d37d69db1efddc14cedca060d29544d513cb311b1ac5e28a3b14042ac62b1b6

SHA512
b236d13bdaaa03049f18accade856b8d74858ccfe314a54fd968bab3e61977dcb5bf012f777fddd72dafec908b64b7dd8d5ce2d8ea66d779721a754e0e677320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6568.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65EA.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit