5dcbb369b68045d87ea879cb0dd8470b731b2209f411685d84d97f7d84904fbd

Analysis

max time kernel
215s
max time network
237s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app/admin/view/system/index.html
Size

9KB
MD5

ea36db7221eb2d27980109599494ae88
SHA1

a462c5a184d73088c261d3f7921b953f279ec7fb
SHA256

f882284ce42193279c771cfb233d28ec8f13c22dc450298e1dc5c81c3f950952
SHA512

d0a01f6e9879e4321bc186171b5919d01c88b7e7ce6c607d581efd64aecab4f29a84f369931e416bb23f2c51901b4860b5cfd03089d6aa5540ad83bd05fe55c6
SSDEEP

96:hnDcMCVOFMwC0M/BXMbTEmKWfGssUMBc9c5ffCgtwI4WTDztkrQEN:Zc03UACsGkKCkHDzOrbN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e90000000002000000000010660000000100002000000048406eae366691e6b333eef2622acf41b46e56def233f28428afbb8d863bf0ad000000000e800000000200002000000088adf2f206a3844fde7bed7f8d5f9ac680ea7d81746e49df3bcaf04d70fcd07890000000ca9627560033da0bb58657390874d31953d3b4b8813a88ceb695db590e32838c80275b58af56140e894fc7f9ea2133afbae82f68694bbfa201503db278e799e2620452e442cc773b7f692ac3b649b4a682f767033bf6c46d52f465a1ef5ad6ef69d1358f297ee61a76108b0f12cd0703fb9f6c65b752ca7e3cdcffdefed7f415536c2131aff1d2b9553b2e6859f56f5c40000000bfc35bfa357eaa299674b50beccb2db54b5a47145e5923250a4668c2d7df6de247a99e12746607f1c3f0ef6b2dbec48fae8f2bfa16a0648eb461849aed51cf1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409f52f48c11da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D750430-7D80-11EE-B5A0-FA0DBFC6BDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000490cc9827dbcb623de6a7da10c585c3c6078390a3f0c2ef60dc9bb37d3c32d6b000000000e8000000002000020000000d4d0528a4e59181a671f0d9cd2f215e112e9dbf465edcfe1a4a974088e2f22a5200000002f85493a4fd43caf488df56c1de6910083203b9ca2725e132beba57aa3c00a964000000083e77eb604be80a5fd841f5c030e7745b490f4cc01b04721c774ba4a620564252ea272a17974748232049a85c26cab76d40944beb722ef3980f3d1dfeb8848c0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405531837"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2708	2136	iexplore.exe	30
PID 2136 wrote to memory of 2708	2136	iexplore.exe	30
PID 2136 wrote to memory of 2708	2136	iexplore.exe	30
PID 2136 wrote to memory of 2708	2136	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\app\admin\view\system\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
219904783841fc4fb93e8438830e045a

SHA1
dbed567260b5c6133ba2e529d1b8a3c86fa00283

SHA256
0be5e19311ae7f94f4a37afcd0a7239101ca7aefdcf1519f1306241cbfa3d583

SHA512
aa88343ca4d740198780339bcb50c91373ea29180d4405a0058445c7b35fe2e57662bd2ba5809fba4b2d7ed8bb05204cb0559c830e70ceb1e9aaa347cb539f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf6107d0286403a3b88cc784dc48375

SHA1
fa5f33b5af7fc06a72c00f869787e6a297811fc3

SHA256
3a4b9bcc40261dac3652b1c5d3638497020fc2dcd48baada0e39e5b837d71523

SHA512
74bc406662d275de36de5306306afcf582b26c92ce17745db68b15281bd4566993e760eedb986fe9530198394456d7ae02a9ade42832ca61341e3619ae9ce10d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d440585e1d8c52d73fe5e4306e5a0aa4

SHA1
c3b59dbb2748e1e79098f8a8f2c3b7245d24a487

SHA256
4ed86dd81efd43b95f0804b3f4fdd5ea2e13095f73325b245382bd86893929fc

SHA512
cfc2b7b4866393d024b10cc74074483989df07f93db192989f921be2b56f105c6864e95ab52ea460cfff8c791e3427d83c71114b37ee1391d2fe88a0066be9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
569a93acd68d013958f3022f10222c01

SHA1
b328545ed4f5497b8b92bed032b46de3797b7bfd

SHA256
6956f120d06612d03c21c0c113c0ddae66603ece63baa5805c80c0dc3e116e25

SHA512
e64e224cbb1ba37a27595cd5e8418b2cb0557ea25546deda7549a67bcd3e6244d439cc7e545db07d4393806b954725d1ffc2578375f8ba7d3ded6297592c26ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
973b0212e04fdd8f283328cd69c1b9c3

SHA1
4b34741ca9097591c8714a787a3fb0a0aa940512

SHA256
d16bc9fea0479a195296481616f6777ed4b51b8a73933f50537f10b347c93366

SHA512
853c3bf3d242e140e2ea0e525d432b696a4430abd87e69c95bd94023cfb0202627a48d1fcec6d7c269e2bc1040edfb01b94360c772100bf0b1112060a33a7239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42750681cfffc35ef6e4234ce2827076

SHA1
b15ad5655a7dcce76693dd02fab2303672323f7e

SHA256
f93071063c67191944a4becd2bdd278b1274481c78cfc81b78cad2464783ca1c

SHA512
85a2e0cdcd4636c3b848c9e9ba4748d994ee622cd8f9828baa182706f6bc8f59254786ed616aba37092a50155c83815a7cf47f1a3d010f9fadafbba18b8e044f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872964fc75137c8152b0310487a5d5dd

SHA1
994fe321e94acb54f6c0331963d20c3b0875fc60

SHA256
e0f456f1d2bdf54da2b9fe1617aa5ac422f4aa77afa4549f0aca62ddc68ae5cc

SHA512
4412c62d94f3ac3ff29ec29d97f72113ed2c22f83486fc89d3a26bf0a27fc260426bed4bd6cb23ed0d456a4fa58a9bbc1a99fad09d34825be7a89424fa04bc05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11086858102029662ec039322e1bdd9c

SHA1
3e5b9fe10f9a7370e62b82627bb6664c2c595847

SHA256
41e9717ed0ca6b8653f13ce4a2c1c11e575bf73ab2849777bfd0d8ac498e972a

SHA512
e956a126ab79dc4da1a61a3982d7afb04f797f789010770e7ba0e090b92032e8e226afb17c39df0ef989e4bf2ebbf1fc57d95713eb5e049138c0c83ce933a3c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d99abf545e517874a121338394238c4

SHA1
ace503d941e1b9179f7545a222da9b4b9fae1096

SHA256
a948095c19da0feb8bbbebbe7564c80f6b14af5dbf5be5cb2c730cad063b864e

SHA512
53c95554d4206fb8fbf59c6850737bee7d17502fe74a7deff504bf89e7b57f73c4116e1759b0f26163b8072ef48d3180a84b25fba82aec141d0e77ced251869f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84a1e8d0340427df67de472ff2fd6000

SHA1
fdee3045bab371ef828b72538b309a9a803a0fc0

SHA256
72b2decef1e08bcf4c654ecff8186cab0b032b369711efffcc7e8aed26b91908

SHA512
9e2600edc11b4ed3213c8639428813101c4ea4470718786a9951a5b13eabee80a662cb88c819e9ece8adbd2d5d11f280ba4dd6ee27e9ed03b9ec3c235d7a4ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3391.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33C3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit