3450807c130b6458cf4ff90fe647faf5c8a8ed4a97c41015abab34a6b87c2f58

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch02.html
Size

6KB
MD5

c38020b9630b60b60e4f458f3a86b1f9
SHA1

7c715a59f6a8e4911d8b1022b4f762bfdd488219
SHA256

d2b7f9524a01ff21fa855b14025f4f7ff6094f6595d1980b7815525a79f373d7
SHA512

015780bae888350cace14d730c887853fffc8109b9605306468d6b8e4a562300e6388ddaa9163008e1e9c849f349ab4140edf1a01762010c088f928fd4d02c90
SSDEEP

192:WvOHWQlNSgqkDqjmKF02m8drhy3a9cUgBJk5xLTzP22VVdVuzm0:WvO2AYjjejMB2sgJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000033401259b93317ad20d592e5f1454e8e30beba793c372bc7a380584eeeb9ff3000000000e8000000002000020000000b0c052b1bd5e72a66d93e675ae9bd140e339d098ecec4256f165031c54392063900000001683ff74237ad178ae4a8fbb3d3e3e481a1c59455c8f5d7efbd736ea6a211cb80ef6822f2c82003f56a3cd23f85f0bfe8eff7bb26c88ef463f242ecce4a3c78b52b84870f8320a342a0e3f314e9ce5a45a77b562572cc1f2295de3a46bc091771266c765f665f75618acb423f7979bd29832d20daab386e6fa56eabaeb3167c4a8dd6d7fb8d2cb3196a5ec8e49b7e9f2400000005e96efbd90bc18cd7fc0f1860ab5b3c116daa02e8574746c3678c26a953f63f778aef5e0952d38871d8b823b7c3ed9b6911513c1d2bdf64eb8ecff96493278c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405583651"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cb63960512da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000dd37c165e6fcda979f0184c50bb3751a8e39ad53b49f789f8f07f028a94905fb000000000e8000000002000020000000e2bf338dd6272a148c08466fa61784c7bf9cfcb064e59452ccd9a160b6f619e620000000eec6a9dd62f355eecd052ccb82b0c301a9d3fd840aa82c227827c35d04d4e6534000000020952cb4812939ba49b72be29c04f969a2e1fcebba12af3a056e8932c678db87271d3710cea735a3158e12674b51edf2beb88e0a114ef410783a27e2beb7c3d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0EB65F1-7DF8-11EE-AF89-7E017AD50F09} = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1880	2360	iexplore.exe	28
PID 2360 wrote to memory of 1880	2360	iexplore.exe	28
PID 2360 wrote to memory of 1880	2360	iexplore.exe	28
PID 2360 wrote to memory of 1880	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch02.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b494c378ad29cd63ac3148bd6b4207ce

SHA1
b67af5c52047caf4ae4b97f95859cfa45283ea2d

SHA256
1e1fde426aef75b7e1ab0a26d6a75754fbe813627fe49fb315c70045b2a4670f

SHA512
270309378e52b51095e6d40ab222be736e3620bfab85d91aa3d574fb190112f3b11ddd838f36c3b2fcede941f537b15ccb83ba6b68dda0163094b620a9bff61c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ee28c6bf85e3b112c49c1f49fbf1d6

SHA1
73d07735459a59e253c52cdabd190a84a63e35fc

SHA256
0abe2fa5fc0f14b5a93195aeafedc1f91e9c995a0a11c21a74153a1bd4c010a5

SHA512
ceefc3ca3c11a54d482826d4ad93400c35ba47b8761c1b0c0da8989fbce3e8386abd92c2ea504969aac700fe80399c88d87bf20c8797d3d7fdf5c9d9c1dd38d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df519d548cef9e3ee44e39b109de544b

SHA1
b5a6de8a5c37b076801233f8cd89796df2f0b857

SHA256
667fd51912e84e6de14a0f447aa4d15d437ae3779293adb48123d171d80fdec1

SHA512
448a2099105aa8d86a1ed2d4c41f8cfa2b7c8093a912d5fa56cd1fa25043ff7aea74b62733361356174f9ad56e290a0beed89b2798180a162c1cd5b287dad4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9b962700b9e0c69125bf7a1300a2a0

SHA1
f481ca8c781016ffeac686016e6570d6439d7c10

SHA256
39294ab119a56c5c57d7f4597c3dabc2db6cfb2622f6457c1b46051600a404e6

SHA512
80e722995aa7e97c63fabca1402904cd05cd3b2aebd207bae917757d6791f03835038afd9ed3d83938cf2d29ac7a14f2382b5b2fa5645918632f2516c37e1516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
435bc1d0eb25da29aa96f5775f702d39

SHA1
c1f9cdbd2b051573f1eb4020a11584b40050ff52

SHA256
4525a22a999bceb4d342ea7b3083e22611cb7b048e6aff56bc7f927d31053414

SHA512
9465b28dadf2b34c2258c78337e0ceb6b0c94d615c1d6cf5c4e37e9681527db38d782978f4efa4ef230d3abd0be27eb2a47f1e660e4ff222a15b374a5df366b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeeeeacc2e694bfaee09aff0ad2fc176

SHA1
671ed56960bc1cd7b003d89ffe8e2fbacdab472d

SHA256
e1ab070c3bc45a6b1189751c3a1b4c149526e3d1a653b83cf0e81ff5106949b6

SHA512
932b0865affbf919f17ab7de96241f5c4c9b64f073dd5635f4d9c7176341c17ed317b903557267afd51641264f4c6c9c5fd7f7e9f1d1b1998011dc922c71a1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e93c77755aa3dbfcebba835517a02abd

SHA1
26cef3a39762c622b7382a4757e8b970617980e9

SHA256
f4b9e3e5c1d8daeb14859050934738c8a1e792d7c5ff0cc4ba94f6ee16ec953a

SHA512
f1091eb2b6d5ec21f17b60245ee830bd53548d25e1442f62179b28b8c0194c93444d9e6a55262ccbd0c3d4ef21bcfdc614df07a93bdd3743553a82be1db710a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe25771113670d9d614a46e1c1d2f8b

SHA1
27f479045a4c96e338d34d0c795d01a3ad90546c

SHA256
66379fb3841a87765c5b8235d05350211270fe22f4a9352f25bad42d3d93102b

SHA512
4ca017068a727040d88c0bc39af75f4a13b3e52cda96f02c9e3d2743516e9a2f2be84bfac4b1c33811cb4e2ae69b0fecbcbe37b2f2b7c0b8ee007261480c2392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
950af9077939842f28573411b3fa8a46

SHA1
7d92108f5ff32cece4ed7fbd21ea16ca1c9bc8f1

SHA256
833fad82deb8f39f1f670eadce4ba53bf5934eb6734e85e066c1b0c1c5ab6058

SHA512
0808be2dc6b89bb65272f91b8221d27cc9e6ca2db52ef47fb4e789bd7fd7ef0399cdffc86de122a3dc6b37ee6b94657e618ae6c72e88cc005646ba6d38751877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0efc447416275b91fee93943e76e188f

SHA1
c1934b53f0ed29c7dc43152fd3d5710d6c7be72b

SHA256
b44ad0b90d5a82a36f534994ea4f5ee684477fc9b26c4f752c136d02bef137cc

SHA512
07af99f5595865c73ed2120a9207977c5f564da5e8600b397dcded1fd1034dd7eb1de0bbecba31495fe9fd0911058e2a5b82c2e5f6e55f88ffd313a4b3f02ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165d2c0ff90731b4ba6a4611edafadff

SHA1
b6244ec79746935b0b2d36a52c4860a7a073cb38

SHA256
9844e5862cb44b88197fd49add2532386320629e31d8898a20dad68fd07fc776

SHA512
ea74932aa83073ca3ddcf532f6a3fc6b50dda0a6f79490e1e5bc663001f99b09bd54172847be14cf1c75654322536d580e49eea1f036746dbc40e6d886f6f0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62447b3245f6abf1980e5d020952581a

SHA1
c5eb793157b6785d87448c30655253204064afee

SHA256
bc52c698f54acd70482794a611e32cd0a14319962220af62b905ca915a68801a

SHA512
385538904c5ef7a027d3af958de73830082aee09b67c741dd9225f7e37115d76f3cc9f015e52cb5d79fa4af78954f12994d701e1fe230dfe82de2d1411cbc3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
796d1ee6071e7febd304271f5588a58c

SHA1
f256b0bf542cd412f13331120cf5832b50e2b7a1

SHA256
237d555596750ff8340db9d4ae361221a7583591409771e491cca5528351b3c4

SHA512
660a687feb2f5cec496337ee8a02c6ebd89ee0e771d8105c134434dc43b002bc78ba65f8f7a0692fb2598594debff21e6aa1ae3362c6cb34b494254b66fbb79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3b6efd890577e0f2e8c9a661e4cdfe7

SHA1
819b116ec795c6ea837a46327fc749a05d4ab240

SHA256
e622b73435dc4f7bac9fceb84d3109217cbf1dec9c0dcc430d46f6861b2418b7

SHA512
40d9e509e5727d160c5ff6c5e28395e755018a9c5e6cf8abcdcdc2329179f4128cf4c2c811d6a7345320f8111fe9c11318b6a7917dc3625efef2432a8ea8fe92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e1e40639ec76281bb57495508be551a

SHA1
a7f2bab58b843fd5f5297716aa529b82922cccfd

SHA256
9006790d617cb68f0941f41b7a304980da50c2ef257a3410965de790c3907690

SHA512
15ace86e7c5f0e5991cf0072026e2a9780b8885525842e34c5772dfdee18d9d3d55118c3967b9bdaf837715efaec99b41ef1f8847dfc544c661a84903f47dfdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a859e943397c0aef2e288a196a035b3

SHA1
dbdaec66241076aaab3dc9d6a6f2668684903e20

SHA256
72b2bccf689865911bd2cf2851c29c7a06e8978a1da2fe0a6bcab9d1b69398fd

SHA512
108122b4f41077857884e06a12fbf57c163684d68838c897224f0c147ecc6c62b22aeaadc44cc4f0c0a33ca1331273a2553c61da086d86b42e7f4d5cd5c32789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e9d04bbc5704b2882975dd3a0fcdcd

SHA1
360fa5e2deb929755736c3410d1375f768b8b4c0

SHA256
5cb2422888046d88f76206febc2d2eed4e11cf70e32856e98ace43b000270dce

SHA512
29036e73cde33c375ecb665348130cb5131a8d159090de25ac0f137ada2df872be8a9726d3e354f857567da3de7cd3a1e10c827f225055af637f6556b98f66dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB82A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB88C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit