3450807c130b6458cf4ff90fe647faf5c8a8ed4a97c41015abab34a6b87c2f58

Analysis

max time kernel
172s
max time network
172s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch05.html
Size

5KB
MD5

aca25e3f99026aee8713b916fed1788f
SHA1

f29eba012246f0cda2e166c8179e26bdb3929761
SHA256

1aea80cd735f3e470520e62ce7e6dcbf67f27c667e2dc8ee27b3574f134eb592
SHA512

9cd178d6ff7e744e2c0e9b9c6fcc1f17a10b4426746ba17226c6ed4f2fab39749ac7afe71e74d19c78d972e948dc82dad3d0a8b71e78fee0f59309920785ed4e
SSDEEP

96:dAvOHe5Jwk0VVwcNaLgOWAKSfmeliRb6eEAglRqsEfpnqeX290sa56S8r+Q+hap7:WvOH14cNSpnfikvwdxnN290H0S8r+Q+i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95F21601-7DF8-11EE-B0EB-CE951E2947DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ca776b0512da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000a6f4e3b6dd6e4b5e175085f4acd89f2daf884d2ab3bdeb80eb574a7c434c26a8000000000e8000000002000020000000ea1707596028f5fb601c3300310b82b0aede9473d5d89b2591ec20230cb47bee20000000c9cd48534581159e1ed00f3a3aa406ad44260a86a763165913a60337fb70aabc400000005d0070a2ef4d4706a567f31eaeba0ab777fb48725d652b7f7bdbae774d9a0b90d79cf3c3b643f713115e0442154f3c7d884c5b773dd1b20053980d581f2505a0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000fd83e6d639c7841ede3c18d2800854fb74c65e2adf31760730e5ef2228650c68000000000e800000000200002000000020234405b0200f08d56021b29530f2ac76fa44746d4de4845862433052c4f4b19000000073e5c87e97995b9870409f560b10b1fc33b575e1ecdc33f1fe096ceb725353af59ceb572e2e1dcf53c510dab261a6480877dc967bb7302ddb735dd866af96508066ad77870b3dcf22ba269e623d3b989585e5d0d763624efeddccbcd485637f171044cc584004dc3bcd2ae3b877b03b9c4d4f4ddad47c250054dfa486da6b5a141b3fb629730b595f111e94170863f7a40000000b9640f8ab82ffa7c4563198aad6df3f278ec522bc6827a06c73a7942207cfb5aa7110878614964772b92d6169054a9dc57b153bdebb8471dbe7cab2ba6cb0e97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405583580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2744	2712	iexplore.exe	30
PID 2712 wrote to memory of 2744	2712	iexplore.exe	30
PID 2712 wrote to memory of 2744	2712	iexplore.exe	30
PID 2712 wrote to memory of 2744	2712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch05.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b9f72869dae97e277fd64f8aa9f47e3

SHA1
3cbfa8c4628cb1f62b22c1b2315c23db49003424

SHA256
57f533dfc3d8b5bc12627b906cbb3f2337bc9f4fc40a229055e2092edad64658

SHA512
518884a37bd26bb96551902b62fc1b408f540fb8a761035711ac07d39c74d0e3248122a306ecb83d473089b4463213d7d2591ef29ed4fc4ecc1e216a9b31ab68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5c0f0856ff5bc688b01a51a6e88eca

SHA1
a41c44400de6fcd25bcfa0d29a0529393b899ab4

SHA256
5146471afbc426d1127b0127d3367159bc4c3792a6086055eb1cdfd9bae88ea7

SHA512
e940036c92b0ec7886592c776377ce19972f8dd4b44bf84879ef06a17d1d8b9a48cc1ce4cd361982ead38560bb7820f1d508787bf5b3213a91922b479c8b23e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b293de290713ecd1b4eaca5f1a25611c

SHA1
245c239da21f7a7b6136954fc37f14b10ad18e47

SHA256
f638ad44c2f84607d0e8d9c4ac76ee1b825f7ba0032a6d683e7346e3b66cc6e7

SHA512
a8315cd9607d9a32a00afbb35e35aebe55337ce8058f2725499baca62d5a23c550e86af7ed3a62cc32f389972cc10edcffcf7f11306cf33b16821e149653a4fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b6a85d698c0f7b063731e9a927fe83

SHA1
2d43ebfad8f36e10a286d6e050ae1f2e7083261e

SHA256
dad600a1535a40b7124f05da8bb14a695047f2318339065030f656b25a3a8b40

SHA512
840a0d781e3f25c98c0f3d562aeb981f4ca13654f256396bee8693709611f07bccfa833d32dd0240dcb7c7067dee8ae8152b1c7113aa5a7ff9211e519dfc90bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51dadd4d9519ab48aa8bf0475a0c3902

SHA1
168682e3c0691b2bfb3ca382f11a60889a8fa1b6

SHA256
6c649c24bd0cde34ccc3ae3a8095965bd6d88440c669df3cce75ab729c7ce8d6

SHA512
0d893c7e9c87e0149a079b2975d981b3352d149618d8764617fd23ad15c9bf1be8ef2b0fe36576bad76905949adb546f9fe7a148e12f18048732b2999fac13d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9dc7f6c4f1b4fe07683c27d16253886

SHA1
74cc761ad722971a616e8600c36306cc709a758b

SHA256
0719235bb520625c2011435a19ef0d5d8de3f64ce9512390df0d3e1a5d2507a5

SHA512
626136de9198eba4f34530299bf1feb06055327279e42c8ebe305c3cc95b5307f7f2b3bec821002435ff833e2ef2ee2e3f617c561440da525d578df374c2095c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56749d637978a6e7c36fb5208ba5823e

SHA1
09e82a4d23a223c5f97c42ffd80b408f04c40471

SHA256
c0aab7cb4100887e1f21d4aa6790c46592a622b924cf253e7dc10dc2856f7526

SHA512
11e4d6262a6d237f166aa801b0e34d1f5124a16fda711da4ce959ce1a74c50f964b27f1d783126497790e6211527506295c98ae28985c201856de7070cc04bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdbd2537bf4be4b4b9981a49fee373d2

SHA1
6942b87f628e20ddaae9aaa02d72ffb81aa7ec1f

SHA256
c8c58ca14b4e0218b32a30fc2b281eb275c8764183159b195f9e6520146938c7

SHA512
d76097a7300e77736f27200c0d6f64d604fc38bac27a4f4ffce39cff77ff65dc7eff334b8dd79f0e5f1b28030ada701f1317ee1cf356f67084b1fe1ed0ec65f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c19a1634df0faf2574f574ea32e4eab

SHA1
36999913418fb1b3cb3710b659e6363248e23325

SHA256
d7b4352feb9d90289e1a8f676bc1b796e5699dd9e912c220cbc3f5d3fce64216

SHA512
25721e6ab2a01c80fdcc6b549a4374ebfe172bc500690711b4633d1e28d9ded09719288a8f94b4fcbee6712ba25f8bf89b2bc3e8ff97f064fc9ce4f6aeed593b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab394C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar396E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit