45c8779a8cc21c9094d548ee40eebd6731c4bba53ebb794b696cd7ef51c9ccbe

Analysis

max time kernel
240s
max time network
286s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

3KB
MD5

55acfe384eae522d3d9e0c046ef9bd53
SHA1

fbcf05fd0ad0569b4afc35c3bd8885b042832b77
SHA256

62ffd64e012a83d114bd8e15c45808773d66852ce385599a8f8a0fd5d7acc87b
SHA512

32043682d12cd10e24ea18d9a636b7f03ef688596818b1e2f15b090bdf69251fb2b69136231c418616fa95d3d3d514ae98b529c7a76d3f286828029cc574c0b3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405729249"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000005dc267eee0d5c8e7240a96438ec0d824e72aeeeba771f7577bd92242f1a45fd4000000000e80000000020000200000003d3e7809eea1ee7b54870fc3869ab2aa8dad73d160f631aa41df0d4103cd66c12000000032c56cd6cf67045049fd94718db8fa8fc3e6c85d5d7f019220560ed25a035ea9400000004fad8bc4b03203c9bac08cf607832ba85caa84b5e64a6cf94387a96110d7e1a3e0085efd6509180e08643a720ffa603fce254f2a1da6627ea0fc8ad68dbb723d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCD480B0-7F4B-11EE-AA63-7E8C2E5F3BB1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd669200000000020000000000106600000001000020000000ebde1313b76ff09b48df1b08df2c006cf3881a49d7dd7dfad3e77c29dd3657de000000000e80000000020000200000005433f5d1e17ff69b74630ad38a95a5d272235cd6493e6a01e6d2cc829f3ad8f3900000008820dab5f12735b7f56e05de4beb1cc578541373a1a83a8d622068e9903e9d5d6778983b50c4c411370c62c12c8765c4c59d6fa9796c51cfd62a5b23786ba575c22d2bd8ba98ad40ed469b267a73b9b3971bb1c619bda01a047c4bf5289a47774a57ae3423eb3ad55e9ab65726aec21c68a22ac507b4589dd7bd080c5a61e7af91cf30d12f89edfeed828495374d93fd4000000094bee22c618aa4dfffcbf4b360cde1ad7420b4b48c703f2307188e2b9327395a42ed8d0ef44e08064c25cbfe66a785a688356fd25b3648fff9129d90ccc38dd1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80cbd4925813da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2516 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2516 iexplore.exe
2516 iexplore.exe
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE

pid	process
2516	iexplore.exe

pid	process
2516	iexplore.exe
2516	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2516 wrote to memory of 2524	2516	iexplore.exe	IEXPLORE.EXE
PID 2516 wrote to memory of 2524	2516	iexplore.exe	IEXPLORE.EXE
PID 2516 wrote to memory of 2524	2516	iexplore.exe	IEXPLORE.EXE
PID 2516 wrote to memory of 2524	2516	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abac420f0d30f12a48e46cd12f67c31

SHA1
e3ef017884bfe26252b4b66088123e1a31727a5d

SHA256
ff271190ad48b6af36da51742d898f039b0071aea737e02bdbc8a30e1542e344

SHA512
5307500d085b4ff6c64b1bafc5935581bc410ad9b395429ecadd2071beca7c4c194bd08622af4626752bc5cfc32ef8d4eca9ff8d19562ab78fe68e24f59d6576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55770bcf29900e0d131be3ef7693cbf5

SHA1
e83a5b61d9504fc29bd6182b785311fcad102c79

SHA256
e90ad4674efedfb26b30afee3298aef965c9c4a93269356335a742e9aacac4e5

SHA512
3956523cc1f5f6d9894a4bccddcda76223ab8cda8cd633b9edc8ea037aa08872fa04a8af5a5e0557233c647515f03fcc4b76fe3cb114f7f3828ab30c75ee9514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5757f0687bc8dd1f963652ae156dd401

SHA1
cc1baa636b5d255cdd7e869e0abd5aa8263e823d

SHA256
9e17db1917d56425ef9e7fad0d502bb96fb336373d5f203684c0bcf3867f5b61

SHA512
c86f2d3fb450a6b887e8e9503b05cc94c4c3c3d54ec4e4b38cd2148cad37b4c330cd18360ee48c0651dec821aad28d957f8eab6b151eac5c800cae92b08f1b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244cb2b3751825c9da53af83b15dd62c

SHA1
3114f33286a11aed86837b473a77fc6a247a73e5

SHA256
905ba7adf324a71c6378561de80e6a9aeafb03b6d99b5fc43165044d025a629f

SHA512
6f2bb8ea0b325734147cf0efb879949acfd48865e1500aec3432175b217368a3a2b842a1dc3d4dc14b88e8029446adf242d599f89248b3eefd658c13d1376272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d874af7198e8ec5df5e5814a9574fd

SHA1
9c6db948ad9bf1a5e8730f9dc25707769e7e05e0

SHA256
9551497b66827ee3d4770fecbab0085bb3c4f14abac258017acf6b7de831b0e7

SHA512
143601ca30d45537e2bd4da9bf291b82bafeebda5172213b17ce8c7b2ebcb8816053603b9a28bb7c7ebf7591c5e79e39348f5fa86bcc085ccc34b61c868c4576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
469d9c6a985efb715c117be1837f0052

SHA1
03d0508c6a7b6209ddd28c62865054f3473e78ba

SHA256
78acd17356d9f7f5d620f0b22539efe5185543a5d7ac1c2efb5b96b1984e6999

SHA512
35c8d7f0f6659e41338d632a73372b3a0de612841004541ab5fb6f20886cb9eb9e7b9db7147e53af53d7ce483bd2f94d731be4cef6f05bba0c8151b719ef799e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588c493d33cc5a4a530071130b07734d

SHA1
686ea06ac7d8c30a1ec602f80d886d98c0bbfb91

SHA256
c1e97639728c997857deb44f5af97f569dc61bb90a94d0009710b7d8da1f7fc3

SHA512
cadc094403fb17d5f0098d3a14967755fe6f25e3fd94d4876cb573e4c00401d7216ce6ca2ed3ae68514636884ecc50951b51c5e3ac9a1bf78183720b81fe9096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e014c34b7b29f2290e671839ad3c366a

SHA1
b09a1008fa877199ce8e61af766b3dd190d2c85f

SHA256
f9c4aefa17b26af87238807d567d62e48b04de994f42c1a63dce408b514a4041

SHA512
b828da5f6c16b98cc270f1e3526fb32d968b174b7f10c74265b6fa125ff3987ac993626e09d96ffd0da38ee3708b8d8c429aaa276a68bc99920b6baccc9aed94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bda69a89607516bc839705349e2f2ec

SHA1
75125e6a260cdffebf5c6f0eaa93cf176362ca7a

SHA256
cd48e489ce8e4c0a147367c90b6dc5282738f5bb277aaf06cc24fcfc95b12330

SHA512
b8880c777a2d9f81833ada33b7fdd71afb6c6b673ceec5df6d7571e056ee0656a81838c621e84d42fc05bf28e1533b48fe492fa1f4412933b6c8fdd058ffeccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad910b02337da22e9fb6130a533d12e5

SHA1
0edbce5b5566b9242b3f792877fb72b3badc46aa

SHA256
9ab0884d824319af0abf86c7f19199ca5490aa83fc724ca954943bce2ca3c13d

SHA512
d0c6c24ddef3615ac40765d036e99212604a2baecc02d3663b095aff23e1ef3b2ac589706f6fc061329d25327d0dd1eee7d2e28c1a20e45153c6c98beba7bdcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA8A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB19.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit