3450807c130b6458cf4ff90fe647faf5c8a8ed4a97c41015abab34a6b87c2f58

Analysis

max time kernel
164s
max time network
186s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch09.html
Size

30KB
MD5

329cf4fcd4febb96d1b0d8cfc69e232a
SHA1

2cdb3260a2127883c1adccefc4823e053d1b2e1f
SHA256

7e472c0a05f9c15f4c5db968157a60580fa72140bb1c48354add209d9b551550
SHA512

fe8c954e281a4f94e275e1bbc51bbc8b689ad527e75a35d5d867a55f148b2430fa61a0ae0d831b5bdea51d3ea77661d4005c3652c46fcbee5f7006bc597f7f69
SSDEEP

384:WvOywYVN+hjnMBRhfDG1O7n5FUzi7Oj8Fu02DRs4ENvmbEFGv:AOAt82nozieQBG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00077800512da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000003c63383824d90f691ab5f1cc3eb2d163ef457c5b5afa3ebd9f4c138eb09e2c3a000000000e800000000200002000000000aaaed7925eb8cd6e396a0fe8ef8499f0a3469b5ea52a42974e0ca5289acfa8200000005274f2c01a0f3d3f7eabc73d5561baa8e05ab78960bc026f2b938231e79ecdc640000000c4655d56c7c010ea38dd301d6f76551c01f98b2d4f779a90b7ef2ccf399ffa25fd2944da49e4b66c86b8f22cb4a26dd7bf8d9d64ca70e613b7d8ba61ec24eb93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AACB36B1-7DF8-11EE-B93A-C619D83E0E05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000aa4ab305906e1780feba3c80c73a809a63b2f6d117295bc6c479210c8ad05735000000000e8000000002000020000000c4e6710031ebe0b6b9cc2b606cd6058cb5e90adc08cc33234d47e1f14a5ba91990000000c1d89e38a995928b930699461e28c179a773401fd8773f88fecc341c6e413f58dd5544c4c209107ab8225c721d6f0a6986dd088a7332a8e2b2d6f27f3cde8033b52cb6f0123db82d6bfd1bb2773235c32eed5599b158da5b69a7c3b5c7473b943566aca82ef110f3a2c3f2f0b23c187ed86efc51f17c7a3d2ed327bc2537b910bb58794d710b179b908a8b795278ecec400000009b93c9c25dbb95a5bf7249d5ca3121843f388b8e8713f31780c513442187c20cea5af22370ee99c66d617227e61251fae0784b4c127d81cf28798ed5a2eabce3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405583615"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2604	2684	iexplore.exe	30
PID 2684 wrote to memory of 2604	2684	iexplore.exe	30
PID 2684 wrote to memory of 2604	2684	iexplore.exe	30
PID 2684 wrote to memory of 2604	2684	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch09.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e3942f85716760cdd410e5427076fc

SHA1
1df21beee96def302d733f4a5d32da4e1a1b6461

SHA256
d716bd8ad08e97d84829290399210a25a1517399c43843bbcb5e4ecdea9aab9a

SHA512
e5a9c3640277d789618cc2a73fb96b3f002b14ddb9686b9a3dcb3a299a558e66c5a91ce8b1231ab9ff8809d6d8d7e363a067d8193c2d6f634ed0ff7e5e320fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a821bf7935d45eeda9c43c7a701ec134

SHA1
328b3b2837d8c568acef6b1a2b715262c238b0d4

SHA256
9716174076d23876d369fa5f35aa49df56e83a873e61c67cb6291a85ffe50e90

SHA512
b7a83c468e7668494cf5307b7f603fd2913705d2f6f996c03291424c90fa2f03e7382353b50184a59253af5eb4967cf6809091ad60f611b2afde864dfa8fd738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd129d60a2ea7dee5695b40425bacfb1

SHA1
22618b008bd3453cdfef03cb2748ef85aa5d627f

SHA256
2a9695162088033a884623a3c6113afcff9d77922a3ac165b1dc172bb9e0a988

SHA512
49c191ce8134760a36e8660232501106c87b4937a699ddc21726db2bc203eb59ea3b828d148bb011e9d901bf63dbfcbf0155348f411627f58774bef4500e2b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1928a23ecda1679d1c389e5c3429ba

SHA1
93224d4f84eb22ea43493e8cca7c8a52d16d3bd9

SHA256
3476a551ca6f0ec81b58cbb4286556de1153df979da669790a41d7199ded4341

SHA512
eb4f231c952a6b340ffb460e4a5d3fabc98145694603482300fc367d9f50123ff2c7ec8d429112dfc4d28abed27a1c4542bcd082a225e00ae018afe462c6eb4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8be99759efd43296d21f3f251e93b797

SHA1
2436ace6c56f7a7f7b31cd347947380487f18cea

SHA256
feed43aef996012ad0e72c92e0346358a98d4efe84b3ef4e742530554c26961f

SHA512
b1c1a0f67d2bc76abc83f44b54ea4db1e2e3a0181456664ef81e22bb9a0dccd4395410c2e1b4f01f29092c1dcf8bed34b984b30e1ef9141122717742ca541c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39157bb114103e4ed5196ed6abae62da

SHA1
b0518a4d37e81e77b1998922537dff69287e5db8

SHA256
785e316785b1e218be7fff9c33d933c0f5dc742ba0345298ac988593f355291c

SHA512
0d971b6e7d20354789f24a1f3e1ee3064dc9dfbc27e969f67f8c1d82f91fa100f616eb5761a58eb40df8398987de78b59c8ce555e69ad17c9a233b35fc9460ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7dda241d9ce40bea893948d5f1611e8

SHA1
7ccc7a2f94168315667bc20edb18e5f0e50832a7

SHA256
853421afa35582bda79ccbadd4913f81e5dd627a1a5ef56130f2942b96a02488

SHA512
ca680cc24930f10ff07005b264187788164281542259799d640e55bb600e1fc7e066f954ae9f85c80e797023641546751c1da2bba2267c2bc230733e329031d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc582a1e9f56b5403d92a160fb82710

SHA1
48864d8e7506f0dbd871a6f2986d80e1b9d3e7be

SHA256
bec193dbb4c7fced23b792f4eb9576729f73b6d129a6eee30a784685d087af92

SHA512
6978d06df7dda6d975d8a7f6eab423cd23aaada734cf7a208a286f4936e99c631be9dae5e13f359835f282e140e03484991d6ca2a97835b706cbd88571be6197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d3f971bf16c795296ab34139687575

SHA1
9634310eafc2e71d1a3371f4b5e0037774fd32af

SHA256
7271bc20d5cb955c446b4c0282698073e8dd4837463f7e3b675cbf51f62497f7

SHA512
8174758a88e4712ba93ee99ef9b479c32e554f0ce9811b464a2eb3c3bc09092ee4a304aab9c7efec4aecef4b793cea96262d06d9a197c730e293206c6d264da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90ad1ac885c3297856d037353e8b627

SHA1
b5c8d7689041abd4427616341215247ac909c258

SHA256
aae4aab2e6a3b4f2d088e5f99b8109e4f1871a5beee07bdafd20db0bb4423e5e

SHA512
71a2deacb5fa2d21aea10756682a763b214c24e0c1fa5ccae11e3859b0f2d7841302decfd7c1349df97b631da5fb976a131fb29d4e71b1f1b3f6e5cff1230c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05822320fb65434b3b9e987f9d6f5f4e

SHA1
515694fc46dd009f727efa8bf7124d994eb74a17

SHA256
80cc525bfc9ab9b59b37312842fe38d6ee7923e6af50a3dd59a25c71ac0c9c66

SHA512
9b092e786b6958474d1d5a06b4a8e53a7a5720451974d0f02ed3a42c04e6a2f1928fd4ff405d66493eaeea9cc448ab503689159e9107bf8cc799a6eb8e6aed1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c84aa976b118165ab5bf73cd5c7554

SHA1
5894a36b529870964903fa4c7e0271d5a67715ea

SHA256
43f118a41cf75cca24140ce4fcc4db9164adfe5a8155a4c6cdd3625458f9fb2e

SHA512
c2b34d4e08d1a1d7387b56fd9cc8cf5bc86e45f2501fe9804b31904209b49f35a0fbdd112c7ada058fcb4d4f190da7d34526cd2e05179d20507b738112d72363

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab53AF.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5400.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit