9f3a6a86c7f0d65279ca7307afd5c1b47f42fa12587a7b890e645935ac81fa6b

Analysis

max time kernel
117s
max time network
184s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch06.html
Size

412KB
MD5

e30defe6fa71507aa0f122a1ec7f92d5
SHA1

67c4226754655ec6ce2294fd7b2d29af2afd44e6
SHA256

fd41fef393b888104cf69600a29726e49947960f0f93cc38cd7f401ab46a541f
SHA512

c61736a296b0981c9075ef97cb4d034aa3caf175b135e507c90e5a681ed67377f3614dab62446eec227379c9c35e5ca00d2fab1c6c7ec6c6ec97fe2dbb5646b4
SSDEEP

3072:A5er53q5/tpk2FBCM3HeVSxS2lTWSV931ZVeRVGCUi5RPcNy:AkYnkTLSYVGA5RPKy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4777FCE1-7DE6-11EE-8D05-EEC0B95564F5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00f6c1cf311da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405575719"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000e0634736a6ba6128d89639c7d34b76252ddcde7dd7a958821a405406d0aba10e000000000e8000000002000020000000fd6978150cc5295320bf8b38b0e34a8a2b19c7e49d652b316bb7aade31f6ffe720000000f25063fee8c9d97771a8bfc0344bfac75f81b3bcff0235b293a2bcd1289c0a1440000000b0e94a0176fb933a9992354bfb0debe1ab7f8097c341a548cf8e7fc385408fc27caa78414c3729e75755ed1597f4d0881743d56098f90185d27ccbf8b19dddef	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000034fd6a4e5f7b2674054822837dd36ef6710ee1f549f2490ef187267d50db942000000000e80000000020000200000002ffd0778117e61ee4fd9ee277985a177c5ef88232aee2ca3622c44e05c67f1d8900000007d1d9edd6dd90b691c1ebab0ef7a5aa0e95c4f591e42bb8a8071f45c792dd50d4f359a4fa1ba4a051ba8ac082c273f9ee8926910fb57325ac0ae6a8c4801aec722d842582f1c10b9a10760fade58f5530886e7c9f1beb23cca3ac5464d5269e557c53ee3056bc760bde217d60d84723e8befdbe65cc57f0be279650f3286213b62325b0df1266a7a7f0d54a8cda8871d400000002398f9c3eb5858dfc58bf86f56fc779ad65495454133ae66f70548f64cab1e87dcae0919296d0671d080ff75598b8aba2aef89ab9eaab556d14fe98e60168610	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2988	2160	iexplore.exe	30
PID 2160 wrote to memory of 2988	2160	iexplore.exe	30
PID 2160 wrote to memory of 2988	2160	iexplore.exe	30
PID 2160 wrote to memory of 2988	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50cc7b918944be9ec305c430070f9fc

SHA1
c11840c923ba521eff0b80c961d36374d42e4d4c

SHA256
e4da4c0300e82ec3c6edc68033cec2473dee4b7445bbb5d6c570cad52b6fbc42

SHA512
06e7532b52c80078588de1bfbdf7c551f7db58782a6b295f6a05b98a712d77b5c044f39ada553cfbcd27a2541daa5b51ffb1d4274cbfb22a994c60a8ac38100e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488816b65144182941ed98e9eff380a0

SHA1
43b28ee087dfe102e60809dd53ff1b33f4db5d25

SHA256
d1fc06ec02ba5712146ff91403eb5d77818ffd29da756b5f2ed16e421e0b160f

SHA512
513bd7ea6cb270a6fec9e632480e45db676278b6248ed76e1d7f44474bd3f170917a2f90d4d2cd344522d4e4ab8e22387ac82b0d6b99c36e77b4b439493474dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd0ec84a05c972041336c47446f39c5c

SHA1
7c588d9d25c3e5176f0e4e160195322be9f5e396

SHA256
74dc7e2a81bf5ac76f1bfc5cd89fdc6823f4fee164f6a025c25efac496fca834

SHA512
7559946069f785aab931d26c39dda87d9222f621c35a0be90139cbcac54c04404de3da3cb67727ceadf71d8d7d796952b53b083f6a35b435132d0fe0c431e9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af1c547516c1b2f6c96d481668608f4d

SHA1
c87f5b95bad047e7f29d8e1f398feadec7813408

SHA256
8fc04c0d8c145ec4269d5ba5714a24e86915ef013ac0b49bf850323776fd7aa4

SHA512
36b0570fc784f27168358c6c1e5a68bdff9e3f7d67d5aa5fb4ced7753d8692c98914bb9344d7260909dd91726cc7144f4d0bf7fba7a3138723372a3cac162e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a7678793a9335cbfbf55c0927c5f62a

SHA1
482f9c92d4e5f2ac466143b67d8360c66d34bef5

SHA256
fc9e79b48428f3a7a92ef97e1417bfb3e639bbbd8864cdc15f8d7af9e5f64e23

SHA512
7b85c380f2b5720e3aff93f071f40526a5659e08826476b3c148ecd8dadf444c988cdd42c766d979bef2defb9b0b73135b2b04b40e39a3cb31846eef2bdfe9f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e863653dda4ca80bde7e90cd950980e6

SHA1
4bb92dc1bdd519c7f812d80a28affcbef4316ecb

SHA256
5f658dee8f8fd148fb892d0d7e49b3c0a7ea08a646ec322a87297dc90e0e1a49

SHA512
c3b31d17768116e632c59d404e8b038960e470ee0b1fa38af0261c8b257bc9bdc9e7af087bf42cc206c52e1e325a1fa7a0a836dd72ec38643a537ac4c2cded89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0de02ea5a3e070361092add1abc65be

SHA1
5d15ad979a09bfa0b31bd71942642e8b8b3fa332

SHA256
eeffb4566e50911e508b483d98170546981c17c188db789d01b21f08c95ad8d5

SHA512
0c541726766fc5cfbe63965631ebe6eb47a5c9ab41b78c5f67bb8f98cc091ec1fe741da5865247be596b926df2324e4c694b1fa6e9420f544a2ab08b58b7412b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53fdbc8d119339431dd947fb87bdfa09

SHA1
06262556547ff79cc222d9552ff3a5ddc2943ce5

SHA256
54c8d333f2701abe8c7794c9b41553030ef38c825ad10a92a3c9a458ace152de

SHA512
65828969de25c728111f95f9b871c578aeb91b82f331ccd5bb8279e0f76635e92893d6648c3dccb04f3e70caf112f2f506f5031e67cd3904c8274e28aaa653b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc0f35815c4169f7d7a5024d62de919c

SHA1
274e651efadf41462ee765008674fc1891f81822

SHA256
5767789ed0a12a568ea7eff12d788a6f9bc043a4dc2115b81b80af362f9dbd68

SHA512
b7b19b027955db560d503e2797e3aa823183853ca419bc437dfa16a8efd6dc201b74dd85791a81d4a6d2e649c54321379035b5f4129e5ed9c1429cde339b62e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52b64719d15f0f63e0e9df443ab3423

SHA1
4119da9c8b49342a0736dc7e8f3d59eefda6591d

SHA256
fa99a454d86e13c645f6554d3fd930f09bf44b14ce2ef6e52c4e6532c6a034e2

SHA512
0a9c4adca22dae07edb879a6d968a9d130d71eabf43992975f973a78c2b601f9ce97139d19fba212e377e1436ae21d30bedb1f8b8f00c8b3c985117b4852fa35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E7A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E8C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit