b760df1e0e41884ec67aa54c9900fafb28e14a47f05fa52e8738d304e9bef293

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch08.html
Size

6KB
MD5

24e257f762919016ba7509f019aecaa1
SHA1

0c757adcd87238258705e9f10a89c3f1ec5be093
SHA256

e72ce3fe4a35e4f0ebb02f57ca550ed086c5ccba49a1aefa423bec85f393a5bd
SHA512

7e14cf4018bcea074900ddeb2de38317fc7950bbb9fc460cd7e50db294977b93d1e609f2806bb650342f406cb8aec00729f9b6bb6a503acaf61e1f0f28c8dab1
SSDEEP

96:wBAvOHe5T4P0VVoIJNaLga+AK3fmeeXVuvdsW6eNektePC3NedL3n2Ae9gonFPmE:wyvOHmDJNSigWbNHXFmyGivN80

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{258B9461-7DD3-11EE-A59C-6AB3CEA7FED9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000a3911d8e26167260170156c25107b4eea4b65af2fff8db01b4f0f0d6cecad2f4000000000e8000000002000020000000a791535b50e8b7e4f38323763540b0e2907f29d6e50f28c0079ebdc46babd367900000007adf04e6c1258e5d0bdcdca158923e6e567ea54cfb6e9aa50e1ad4f8f5b593dde257e915d4e68c811308580cab5aa0ab43d7e704f42d561fdb9582445e8c6f0465112d6d43b75303d8aefb26287ba0e56a0926283adf136e2abfa5742ba10377ff9dcb31cd9bebb7906a67fb17c7c804c3cb60a8b926ab5cd7a571afc6c68210b9cce55ff221a5d38a63a4085e764a7140000000d111b1183a65ff5cc652143d0a3c0898abb654a7a1da0f5b7304e29f9a7aab09f67821156821f314528b87807226e59050fa24e2a9a00c17403a0dcf66d20cdf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405567499"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000007043525eb1aa43a89c7c141dce5669ed9e89813efbcb5bd90bdc4ff2adbe4c36000000000e80000000020000200000007d4309464bce6b7ac8c9d5f0ea87e8b6f6623d0d0ded1c6caca4c3ce4a239ed42000000041895db5e3889446a8ebc09661c2e863459f597a0b18d88c2db58944f733ea07400000001d88665545d265d189cb6adc88f1f6ca5684973c9aa2eb9826238473854c0c3c5d6fa3ccc27db5d1c120ab978d5f1e4f0b85d1e5b9514160d2c563b5bbccb102	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a6aefadf11da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1984	3008	iexplore.exe	28
PID 3008 wrote to memory of 1984	3008	iexplore.exe	28
PID 3008 wrote to memory of 1984	3008	iexplore.exe	28
PID 3008 wrote to memory of 1984	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80da5c0476619489a33318fe63391e11

SHA1
3c71f8d66bf0f6db6ae06e4d9f3c0e28da639966

SHA256
39c4a2fe498676f343f56bda6e05c6a8ecba13562aec5d456ff4166e0ae623cf

SHA512
714a306143f28701d9dddf631cf584bc12d9d79142bca8b2543601980fca2e71fe212f160032a59ea1600094f796677393e2e1dafa366ebad9cccc356cd59c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42fe728c3c31c053b0ad072a1c97d9d1

SHA1
b52facdfdf9fc508f05945c379eaf4649f485918

SHA256
456319043892d4e590e7a619bc5b93c2ab1b5505989aa12307b9db7d5263f302

SHA512
c63d19d54fb17b0cb04c2a32b4a959c28d664ca54e8a3bf465049cf75c56c07ae80f26d36e877578b930c4ecb81302b3320334ea6a96c881618df79d78544d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8b9d11f21beca7517829608ea9dd4c

SHA1
b04a533bdd7f93bf6eb0208eb7a4b65dbdb0cdcc

SHA256
567bc76f4452964ef8351842e925cddf47e24e722e02c426600a34125542cc49

SHA512
f4788f427da0f457ef1854c892abbd59523a22be045012268b1d7922a420d933e9a061507c40c64be43f01cd286a3ac99c6d937b4d3054dda1203732ae369ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
981bc3ec419532e451d339ab2a2f7a9f

SHA1
219f6c58973dedbf5e8dc28604e343b95a3d8bfb

SHA256
e31640998552efb371ee7a42f70ffbef07d999ecc71d6991387cb4fcc3f6afa5

SHA512
608642a8c85cee29ae907fdae378268bc150c63240aefa7a1532c1c1aa6669c47596bc219d0c59584409cbd3938df43050c2a4d594230fa0bc9caefb05d412cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb136716ffe093648bb578fc0f792c53

SHA1
8a016e06d296e8bc7ffecd7092e13d7efb3fd69a

SHA256
2e59acf55d580390106a51e840207428b875205eedb043df782e40ba3b82b0d9

SHA512
51cde5f0587f7e2a6f57821da44be828319faf3bfe5ae3aa2f2a751b0bd68deeba9afb20311dcdc6b050a19b38c0c0f89c3038af6d6d452f771a55c54b92e37c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a685a5d75c6921c93776e52bb7a54657

SHA1
4eacbba76ba1558a7caa96307e75599f8eba05b6

SHA256
a96105fdcd78739ca4043335f20168a05ce22d151d63dcd5b9708845b55b4f65

SHA512
7c6aee40696dad2de28b4bc3aac1f6e186d1569e75c049ffdd7045c613fe2f9f29d9af52d73b3582f7e42838b9df7f8f3538e8f526e3e125d1278bfa19e0f00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2bfd8f6784408f56aed4de359750f1

SHA1
a8ed91ffb2890cc06ccf147ede8cbb1faa8b782b

SHA256
a0548978b250fbbb5813fe6f7cb7c8d04256006435345a0002329b0a5478217d

SHA512
03d2970449ec57619cb307805e140403dcfca893820376c2571065419cdffa3d7d381568ba8c6617fd3fdd206fa3fc406d4b5eb1a6f8ee73bf549b9be6aad7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3ae87e23a2ff28936085504ca1850d7

SHA1
e7e1c3a54d0875a4826b72934695e21dff336e03

SHA256
813f6813160c1fd33c9c69a1044ef955cd96ed4a6d7cbddc817755016b62ba83

SHA512
46f1bc2f6389cca09ac279b03d897a73776f9c608af5e0560e62a9da278d3977793cf4441be72b8b17f9270a523c1ae76f409b8c9b4c012d620f7a02f2df987d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a915dc3d5677807d90346eacaabf408

SHA1
bc83b967db9058ae112de94e817acb021b8c0c7c

SHA256
feaf7e8b15f3d47f9ad90751e66f1710492f5174aeb3eef1e84dc9234cbfdab6

SHA512
b1c9efe0db317a33a304db837cdcf0515e30adcb239561c7db79516faac0985e326d3495c987e55c20515e2f798e6cb7f13892ec9c542a9de006e88e54ada0cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6356c2600baf65cee7229ec030b65c7

SHA1
8efabe0475e50f76cf68faedb9a823dd0916ed14

SHA256
339a7667399b3105dfc3a32c6506f86d20489f29e4c05f9f02a6f6bf64c7a87d

SHA512
e5f3306ebe72bd08f30e0fd3adf9823860a1e7d46008d2d11b5ec7c117a5a7852c81f041965fe555338f547a502901d4328a0e3bf0aed4154694b52f4541bc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77754d7367f1c91d76b2b09d3fa8da59

SHA1
3a8fd2d59fc37c83890aea854d33eef8a33cfeed

SHA256
4374bcea8bec92b3dd23f72c2cac44eb55673bb0db5a06211ca566ece7ca9696

SHA512
09a512508c0c3a38e523469dfbb1575525b7bb90cd9aad8abacb34929a8cb1f3a8d4b706261f1fc837c036783762be6520d675a1f4eb0619ad35f2e9ab57e20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3410ff849593158d48464f66177393d7

SHA1
32b4260251481c252a1928fb06541a093afce00f

SHA256
da7cdee8a1957a4375b7328064bf6c33d056583531e64880e35ae6f623e16572

SHA512
74eb82d158316d1aac74b279b82afc5aa91065b8f304e73785d25f6a92e2c15a924cf035fcc456998c9e75c23c0dbae47110981336549286cc4e6d62c4406fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a615e92d3e329fde2c63cfd8cc198f

SHA1
803a65a4c3068bbdd680de9090280b196c0bd716

SHA256
68f55edfdff9f235b641015ffe6c69775b79fccb0c0c70249e0365f8009b7962

SHA512
457a9e5f1ac93c583fceba40f43820bb044610447198d594d53e2a8e6047e9f0afcf3276b3956ca3eee54c73fc37166dfdc12645e024c511fc36433b62d32436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f111b46ce3569b008e45488867b09f6c

SHA1
64b58910b1204084d08f369fe8e637390898ad33

SHA256
69d2b16a4dd60d0a8d20ec264ce9df46f1cecdd1a0af224d8395ac81bfa688e8

SHA512
bcf74b87c65e2bf1ebfa30bd2a008cb1daeafecaaec5bad1655c4356795b50d84141f20ce1d7dd537b020893496a81d02eb2449a484e8e935e9c8b9adbaacf09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9743d15e1d095c520e9b6e0882871d95

SHA1
4d9cc7fa01ecd53b1f77df2c8000d5a5a34da889

SHA256
e8a84842a7032c8026af50bdb6ebeca18a08568e19d7ba0f3a5e8d173ae441a4

SHA512
2c3ef1de7047f3938079105e1c52cb2ef347ec8cc37417f36a7b23c03786ceff433cce3b1516bb63c0573a3879ed0d70131f8ab94de9860166c8a041cc0d5089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba47d48e578a8a2f1f5c43115138298

SHA1
23f10f7857c1788623612d45fe22e162045ec3ca

SHA256
a0977011ac2000ca5fcd19a2ae17ced5786da87fcc00b66b3031d7c9ed18f7bc

SHA512
3368b32c72abc340f0c35244f6e848ef4c196dbb4f4366fd98a5122aae69ea827816804226eed10d53ee3d33d9c01e083b05919b4b404169edd0695556f00dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF3A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFAB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit