bd25db25437dd60f2e485c5a965dce9b197ffb3b523dc2960dcdd042dc4dda39

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch09.html
Size

67KB
MD5

5c16a0832fa48b9d3bdc5e1331187b42
SHA1

2702b7c1e0eab3555730120478c7c7d3792ccaa7
SHA256

4a471d3d4d3057b81125e49ca99f3368265162d68bbbf618588d21af581d2463
SHA512

8f2bacd96023b48ec715f17a0e9430e00e6daf0ed71c9cda2d33cfc83dfd3177078b81ae5a0892156e63feee9fb28c0f98b94d7132012cff429da3083b9d013f
SSDEEP

1536:Z0OvUrJ625vPMW+WBcqZKMGSSxMgxXkyZ:Z0Tr15/BcqZKMGSSxMgNHZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000887c1cf9ca3bb6ace2f8ac9bf129da7ad155db29f1c644d0656a7cf8be48fcf4000000000e8000000002000020000000f9469cbea11366e95cee88a7cedecc8701f35adf6656f70e0c776dd5c59f40dc90000000c0cb9f8f5cdd254c30099bd1c47a9b9972b88c1480fcbda06815745ed73c7d772b06f228f8dd4e88251edbc6a96350e8b09389395c3ba7c123157e93dbca373f92ea8ad2b7ef0932f6d09275867029544b0f711aa9dd3b2a389c23a16aac2cf5200dc86718d09696ad2846ae75c86de99f4a9d84f348c1ea418380ad6e6afbc6e8e6ab02d24cbfb51827c0dccbc68832400000003b7f55ec4bfdabe55e2c78b26dd3b6ce49646c67edb3d1e1c907c8ef65cecd0839e114f9ac00ff65a6649a269fc4daf276675d0e48fc185af2ba110a2a5d6002	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405590106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C81890A1-7E07-11EE-B323-D227BEC38C3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000006d1c21a7e82c4e3da836a05968236e8141bc3a9a183ab205019de59ee61f86e2000000000e80000000020000200000009062ec8aa072d3d6565664836e8e9500e27a37f3fc386962973c40a01656569b20000000b70e6b91cab2054200d0939c2298df7eb0fbb824588baa8ae50320bc2e720a2d40000000ad431eb08630dbe051f452da14d8957e7a8e6e6b823e84441146cf5036fa306eb27b2d44992f8baf8363046fd89c8b47618c2b168029660b02a718bf9fcfcfc8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304c849d1412da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2684	2820	iexplore.exe	28
PID 2820 wrote to memory of 2684	2820	iexplore.exe	28
PID 2820 wrote to memory of 2684	2820	iexplore.exe	28
PID 2820 wrote to memory of 2684	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch09.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1397b039acd7b386b7b0d40165956f0b

SHA1
4c2b9aa7d0b73356d1e55ef2d49fb9da47302891

SHA256
4dac3b51ac68e6b19199d180ab309303d80f8a30d29b4794d69aa5912b3fc825

SHA512
d34c18f583078e3d8a9d08768c7e1b835cda5c168c50897135467a0b3f4f19be67ecbfe52e1bf912a317faaa9862b5226e08ab1aaff6614099d9daa8f8f85f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ae5dc90dfbef9224e0ed6f1b1fccc7

SHA1
b75447b417597b444129318da86dc7b95020cac4

SHA256
b532f6891208bc6f7f7587d668d61d082bdf5653086775f1d2e87ed2d9eb8c1f

SHA512
fcf9973b34b92fbabd9bf26a4ab0012d3763cdee7815340dbdfd4eb79d28fd22a5c4f121cf0fd02b506b8d19e4cc7737dc89e9364f97e0c11a568a4a8d753c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c0944a33bc9c7b0e3608c358cdcafd1

SHA1
c4eda1fb4a902a0a12055c87f1625e746d5e731b

SHA256
2e347e5374f59c42d6182610052991d076e0ebbc74e0a4a564fba9be1641ddfb

SHA512
93cf866103ed4574d1a491ce0805eeaa2d372b01ab6bcbe6ddfb7fe5c48d7791b43df4776b82334c62332a80553d3c1518429ee0937f3744200bd57789d806b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab3a1bb084683f8cca00c82dd39ee83

SHA1
8408089f0a9a52d8bf816f4f443fd8942a402df4

SHA256
cd0acee39e1ec6721c448857eb201f36a0707f82c64629b22766e698df7bf601

SHA512
002dca35824a8650e256da6bed369f16b1acb959456591832290f5be9f1c0f1e8766c5e6b73c72057afae0d1fb2786e81f35d2d37c6e8aec8a92b31cd5ca4472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7635a592e66252aab65c3f0e4d08f0a

SHA1
26a4ccca21a16e3fe773e64b37471f62dc3f0413

SHA256
5d2b2b3535af7b0ccd077cf6d721a3a58212a4e28ef9dec5a4d011831750bb67

SHA512
e6105f7d3db0c133ac6ca7a2fafa854786e533ba25fc91f18d7d17ce3597fdce82c4c37c237cf5f941eb7998e2682bf030e47aab7dc7df146d4ce7c049e09b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb8df4815c1ad7813df288e1f927e7aa

SHA1
0b4c96208c60cd5c3f9563202d457bdbcd1ab2a9

SHA256
a88df6396c1833ceedf34e43e36dde7400bb099dfc3c016caf4c8dbfc8d680a1

SHA512
f2c68808ee8dbd4f655852b9b68d9e9eb702c25d89d27087d6407df882b16eaeb48d6c91969af769a4f489a2d38892b274ed4d2f3c5ab6d2fe8d1f4b5e928ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d776efb0514f1cfaac0eeebf59231a1b

SHA1
68e965a2963f23b909b4be14bc93775046ba3a85

SHA256
7d15a14c2cde7fbca85fca5ffa7685d3c0dc9b42edbc289f31dbbc2fc2e833dc

SHA512
180c839ef4d5a4377cf9129f1023b9728d44c01170289dd2654b9786b1dac54ab3a81cfa6154f1f4f7d97e78f110df4228914c83b0d63dc5c450bb4d37fee559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
235e1d6d841fec304d67cb054e412b2b

SHA1
9c17108432fbaad6f0df46f0492145d53ea8b7ce

SHA256
bbd2c99ad11351d3c224ff3ac2b2c53f92947d9d634f82dff57bd10250f8f44c

SHA512
478a847d4febc5c2988cd853605ece1e0d3a89a09e8c9b22db82337a8773d9d0f499f73dd96ab398462fa9f5f7e41f5ef24fa941ecef5f711aa3761d688ea972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb7077a4ee761c45fe4340df1e497ac

SHA1
c7ffe85b85ce98bc0ecebd729fbe7ff1a92f3495

SHA256
1e526f3abf1b295dad63f1704801bdd77c0379cbbbdef634276bdd485511ea99

SHA512
37387239c446d48630c8144a534b669e21c48f988b21994e0f33c676516036cbf2effcd9a42927b814a7299703c0b0a0dd6ab01174796e937773b0df2e4bccba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab947.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar979.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit