df3d1c3dfb246b90e492201d05219707690037c29ebc0d1d50a3589c6a5cf827

Analysis

max time kernel
118s
max time network
169s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch06.html
Size

609KB
MD5

2df3261fed6891fb26329323f3aafcd1
SHA1

8bc06cde514d7481669525c5ad5f7957b7ce0071
SHA256

3e94a1e73a887f0815ebb2ed3c72210abdf1d95375fcfa978f32b46e8a8f9308
SHA512

7686d55d566a8caab3de69ae6f72a7edf3ca8a96c288b57c82c13a51d6c76d4d8ddfdab270f4b5a3cdb13e3db41ca3ab04657313081363c0f724fc2e60dfbe04
SSDEEP

3072:n0KNO3xK3zniEw7lue7szYMAfN7lFhSeBbmdqiumlSIfLVugVI0YcB4VGCrt5RPh:n0KgAiEquesupillSPVGE5RPLt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000002c041895ddd7aa6e8f7e2394604c830dc6aa8018cdb37b478c7e7cb30d6519ce000000000e80000000020000200000008e4510c20975bc3761470424cd4bf93ba3666562493529e078cc525ae5fb0a132000000086c9821b938141616a539bf9a46187fd132d523597b587a281104879ec574a2740000000a7856344cbae5213f03a4a3ec5b6d459a86037da03d49b3c5eeb82af058085271bea5323a13045494445a49215f5ee30cb2e8f8a558c25c7a0d7d40d7d083452	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5856731-7DF4-11EE-BB9D-CE951E2947DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b365aa0112da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405581968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000005fde2f5df52ae249e5fd3123ab7f28e8f190cbaeab56923fa638ed3599f478ab000000000e8000000002000020000000b19aa369989cf39c41edc9b1aaac6a624ae653fa29ad6cd403679abab1e672fb900000000d9abff409852f81ec6b1315534bf421031e48e91ca04da19008361854880d0e334267dd361b3e29b30ceddf1cb001dabbbf0fc478900c5f1273b08d9ee3ff87f0b09599a8f38b73ba0a4802f6954097b8445c8df3a32a4e00696a19d36d71ece7810c731dca33e6d14b1a35f90e24e36e524b51698da8ca6e4be3c0893f3e4d000e7fa0b12a5035c9c627da28aa413b40000000eeaf6b499af50d2f26ebbd15750fd3ff30d4468981d07281bcca418a8a97b5441f37a3eef664888d07dd7abc96728d7dc7a6bb8abc867bb80b55ffd7a37e75ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2708	1952	iexplore.exe	30
PID 1952 wrote to memory of 2708	1952	iexplore.exe	30
PID 1952 wrote to memory of 2708	1952	iexplore.exe	30
PID 1952 wrote to memory of 2708	1952	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f032abfa395099e65a8c5a1b227cf9a

SHA1
76a40932f1b66e87e8e0b7c7402eaa85d383c115

SHA256
2a99fc2fec7c468668043844bbf2043ea867433881dcacd37864678fc444ee01

SHA512
738ebf365d81f546d126426df468fd69d40956a8523eb47a680108c477e36f945b7c40933aa002c914448a3d838bc6407ee3023aa87ffa66c3f28520f4cfef1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81fa9493a008ccc10b195c6d5febc369

SHA1
764f21307b3f404e5ae962ba9a19dfb1e6e4fa70

SHA256
1cd6705c3ee90ed4ae10b9cbc75d0bcf40eed179896191bebcb86dc4ad195106

SHA512
c200a487e61dc6ddad6d4a742ae4630c07a5bbb42d37ca15731b8a082b5f3e4ff89ebb50cec4279944fd2499b1db3210fef03aebd2ed3fd81f6d4df27708392a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77adfeabc808043984e42219ef12d5a5

SHA1
43b02e8bfd853858fcb7e7d6a01a368f7bf64f2e

SHA256
e70c8b77a081ce00642b5186099d4168c2ac034e5b84bb27d57ee9db8160f0dd

SHA512
05c86966e63010cb4ae8bfb4a90e7ee0b26e6edee95c2b7e8462305bd9a04955c5a2a06a910696925a18e23b12e24f6d7a28897d261c5d786738cb88f3341448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f402133096ae7a2323ac1d9f754acbb

SHA1
e58d531851140cde1efe6b3501c858509daa94fb

SHA256
e844fe64bbe98eda1336833bac5d6b9f825da178cee14831c3eb8292a4d96545

SHA512
6604f6ece43f6a342ef120f40da381df31c51c7d2f06193b378028a414fe4072f7ca2d91b44813e3f3e75522cc552edac9fc1dc065b63b98d1a2ff8036128c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a3e7036a862fedcefa66f508d5b65b8

SHA1
10273d72286bb503a62f2d1a5bffb307e1015e98

SHA256
29b971ece5200a209b59bf482b897996cf80cf5647a766b639c0c4142461c699

SHA512
fe75a0e789e3f59e65f0dca64c845d236bc3ff829750f58de69b68a69c8c4f1259eb163bb84a336885d1c0dd2c30e7cda3634fa8dadb6fd92d98fbf32e11e035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a01aec43859e889d8933a3ec810d2abb

SHA1
22faf2305914cdf13330f98b91f94ecbcc2fe307

SHA256
9be1dd8a3ea61df29e589b01ac1c288c1faecd6e466a3f7dad549faf5f3c45f6

SHA512
53aef22033117865e99e55c139ce4670630e01c255e50fe49f07f807a8c47c75268e7cffc3c5576dd510db1e2d47f8ee76e967cf92f9a70e3a162bcc3f0fa60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5297c12c1d2d74b0d6f804a285f2674

SHA1
ae0378a36511e15fd306f1e54d17fd597eb6e1cb

SHA256
4c5a61ae49a3291290ba0f12803e6b36e45829dcb708fd5b84ab76991475b3d0

SHA512
a5246a81b443cffecb5d94738a39bdc54b2eb35fd89539736d2b233aa1455c1a202774ac6245ed322dacbdffa0526bd427e4937f937c8a378075bb70c7a3d635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
257cce105ed9871468e38d63674c46d6

SHA1
20681d3982b7523c96e3feb6fec31dd107fefe2a

SHA256
6709517d9fecd0bd02e6586f1223a6e30e3c504d558fe3d97b104161f6dd22eb

SHA512
93c09c2b790b664a287d93ef21d76e1d8643a293268f0c805e3cea8a3b6ca8f6e98a54610881712068a37553a38027b23b681dd34a84a145820116410b42be2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d07f529e7575585b32a9cea459ef52d8

SHA1
5778bfa02ec877319898321f51bc083b6033e757

SHA256
2b7138fcee1bcd09a8de0d39e863032618c77f5743cc1fd5a2b9a80a6186cbd5

SHA512
22fea609fac883bdb23e58d4cb0b20fa86114b934cb5c1d791e8a41e6db500b8ed4b5fb55986bc7756a5da0462a9fe71cd1515ce90adafbd0136dbb682de1198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcbda6d8074d43cb46bb73befdef76c9

SHA1
8e6be02379f929f2c687983baa9def0f478f00bb

SHA256
49633de9ec5dca57467311e9e70fcce6286cfe9df1f98b52736153c351a97f0f

SHA512
f876075b41b3e0fb2d650a62c918049785f7bdf62ca654c83e48bbe8e489fa378602acf310552a28813fe4327d170238e973d6feddb504bc1f11e744a887f817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbce0ec08f6d259db6b72d1a0bacd8c1

SHA1
e003d138b10c3744292746a261396d18ff0ce0c5

SHA256
412938b4c6a0e550a2cea044f4f5b797b40bb21fe6d6914ee0a4ef14130f8a4f

SHA512
3b6afc7aa326a95e7c310880420c3cd1f28bc112c200887eaebd0aa37d9a018e70525aebf2816aa3fe68ebd854a64a667c167713a385ae9a7233d01f1acbd5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b96f106c2bf3c3126e049037aee4918

SHA1
a8393c1edbd3aa3dc5d0292f90ec18bdbdc12f50

SHA256
28cec37bbb9416231d3ebd34ddf06a063b30e06613537a583db27ab536c8672d

SHA512
c773b0bf19019348d71574c6a4714d36506886eca4e9090169cbc323954adfd8fba843842a0306676fad627cca97cc0136f270d03b0792c446258d9e1dee0a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE56.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4928.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit