344ec99b745d6a2d9e512758702be6ebfdf60b9df6bfb12fe79ba0a9ced52bfb

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bv9ARM.ch09.html
Size

48KB
MD5

d61b1ef443070edcfe4345a894bccfea
SHA1

f5e8ef62534ebcda29a8ec55c7daf06fcc0bca9d
SHA256

91e3e2bcc35a000c16bc54c46a714cd3be466b7941446bdd7d46dc75834371e9
SHA512

4f1c33b76af195bc45ea43d2ec7c14c31b5e133672169a04b4f77848a62d63f4ec1944b8c078395f47ac8fb7e7ccf37bd49171522fa6d9fab6d0422c5020e52a
SSDEEP

384:ZyvOPaYtMKx4U3iK1siN8I35lKDiQjkFRJa8VflHpCQWrrEobjWZ+B3C0+BvPZKR:Z0O+/UH6I3mD2JaQWkvZuCg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac0000000002000000000010660000000100002000000040521627b9f10a76fd6b9f6ef196abc7453d115abc636138e0936d37c74f1836000000000e800000000200002000000017ea9c6dc7a12b2dd1d2fed0acd043d3429f97bad74dee8f2a977482aeb4d33f2000000058ab100607f3c950612a6c5b16b2ac6a487a919cbbca02cece3c92bdc17185ce40000000ca8f22e6b33baa0b0f24c23f6b79023b12a873fff548545642df713f9eb2e1e3b90f007dc6caae98638fcc250a6dd2175e0ff7a29f754e9ebeb46a9795610139	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a0e3321612da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000791d79c1bfd095d92c2f8b3f4620988f66f6e4a7435e16d671b7b39e1b2f5b10000000000e80000000020000200000008a62e2cfe6a6334b6994020f9f8a72681d038902d9bdfe58585253a78f0dfe1e90000000bd68f27b3261870f51c202b88b573888100463561eb1499122d7f3aa6ae0212d185cfba8db213fe4909e241cb66d63efbe7b9a0ea492460d0678bde52e6b192410541d9b692b0aa4e97fa09f82f2703f53ad02eac38ad4bb6a01999393c6a90828c1060e7b533527ac195e3a22c9342d39786e7adea2b73c450dfb095e364c285bdf4afcaefc7b9fe3fe1b91cf065998400000002ae3c6e22e9e905e8ecb61914df4d741524897443c3e78b92cf0ce0740a966f62199e297c84edbbab2a1462ca027d4363c27f96dbc67e57299627a5a9f5e99e4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E01D581-7E09-11EE-9C57-CE48D87E070D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405590787"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2132	2660	iexplore.exe	28
PID 2660 wrote to memory of 2132	2660	iexplore.exe	28
PID 2660 wrote to memory of 2132	2660	iexplore.exe	28
PID 2660 wrote to memory of 2132	2660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch09.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b853eb5a28bc16c9fb48b8b278e8cc9

SHA1
59ff65ab146cfce8b3a54bc7784afded22884826

SHA256
e23cfeea9eedb63057c9aa6b0a990c7bed5dbc2d34f58ab1aa3838ce8476379f

SHA512
5f97ca8d0d9020357805b19220f3f01345ec5feaa58464e849f887c80c0fee21c8f346774a4552eee3ed2a908e964c8db6873b5443b8825f3076a53541dafc03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf82851017eef9ab3b09973066f1370

SHA1
63c0557bfd482aaef3dbd87c82fefd652024a21c

SHA256
6864a210b971b5ccdde5a6d2d39a10dfdb1b0c30846b932fa1ecc7b82b38d457

SHA512
891256dfeaeb043d23a38252f4a388063013debd2c31312e05b0bb519d377376a66cfc48f605b62621e1580c96263eefbaf37bf57ecf92deed086976022eeacc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe4fa219d1de66ae3f9bdc41ced01d4b

SHA1
05657179086b191c161fcf1324a6db550ffb024a

SHA256
6ee5580fca2e65e7568fab2a24258dcf4119e7cae104a568cf54ae75205f1c4e

SHA512
48ae73f643b2783900dc9991f1d7574dc6aa0faae7fa7304f19ad351d31306b645fd43ee84c55bba7bf6c3bc92e7df828e5be61a98a63900358d3e1493316c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7488d5819553af299bceb6ac56ce9351

SHA1
c9dba90b1c28fb9fb518265638237c3babcd085c

SHA256
d05bcc8123efbaa73263ec4ea19e5f4f22c92fab08db728da38fc2a66d42be91

SHA512
a5614fa0c7ffadf409c5d71a78412bb60af731089a9f5ca15cb33ab119940c9769e8a99948a2d75b3da5109ea09a0d4252f92741d96225e19ec2315289efa360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b328bc6258e247d6cb7faf003a39921

SHA1
2aab94feb297ebb83df31fe958ddb9afb17faec9

SHA256
e51598e5012f24fbf05729f0fd0bd9ec178722db9fc55ed840e531a671fbe940

SHA512
c8cfd3cc98f22d882e457655c109a9e4ab9c67a4ce3ec34306b36c1c5204aa25f072d85a5a60fca1725632bea31fc1b6b7a62b9c157668041311a5483d527f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01c5f08ff838687f665bc308891ff36c

SHA1
744dc033d8b0d0a876eafc5db9ed335b72a7cfdf

SHA256
df5c0ec9fa0529fbfe80bbf7a6e66737f2f8d3ad119ba4e6b668fedeb044a9cb

SHA512
4dd1d60e804c8af4ceebe88d14f0932be0259027cb03b9e5887362267047508cf8628601228955d19517621cb25f1c3ceedf2a62816504fa16d175993faa183a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac889dcfffa8775ad2620a595e76511

SHA1
f7208086e99f85b660160a84b23ebba60fd9bdc0

SHA256
ee349ba20a5cbbacee89c454536c618d1d23d19004e5eb16c663627c64c81c45

SHA512
8b4a297c37646d5a313b260135bd50d62b1b2452b8f7bb59a114d5ed51e1b1e3a285a6833343ae5e7b2d68f12ede28f1c816584b7c57270371979da8834671f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0048d39798a8318c46a4ac8fea39665

SHA1
d4369ab3220e851867161e5330260eb332283acd

SHA256
5d60004ce714fc982aacafa1be9590bf64b151a12c3e2ed5551b140aa334dcaa

SHA512
83b901a43ba1932ea60cb0fbdcc3a775fdec28c80e5338e0377e65b25f64999f6d1ac5197394f4335d51d3802f7e62981a43a41b795904bdb81499f8eb73df5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c21c9450c79cc2f3109524648136c215

SHA1
c1e3684b134144d1b90df0f179770dd023a306d0

SHA256
82f069937132001b0ac57c4320678f0d98bc1efc1394231d45a050530734ca3e

SHA512
40e7d689ec6b7d532852b2760b711b9a473195c260c4e3cb17263a3d09c79c0bf0ff40280593fed8d43f5f7cdfe0cdcb5c6f768a97dfc0ab3eb8d8a721f496e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0767d0960a4cd43de923dabf6358998f

SHA1
2a08bf21940fef7c4662282dd8dd267140a2f760

SHA256
33cfaf016ea36263f5853b5234e071776bb95504d13cfd2f81d43aabd3a19fab

SHA512
6e8ff046012f863cb1e24b5c827e1e790bfec6a00985648f8265306167dc6d93b4f63387563c769c5a48e93cbad4b7a6b55e37df6df6f0aacdcd73774f5b27d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C6C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar70C3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit