4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_glucose_local.html
Size

1KB
MD5

bf57710afa315efd25ec6a7a691880ab
SHA1

0143d6261505b4e19173d67cac2727e82b5bfe3e
SHA256

6b7fdea002cd0b8ed8b38fcc500987c39c679a27a84aef2faf58c2e0772498ba
SHA512

fc2808557caed6ada3a82529ca756fb94ee88931de032cd314f01fa675a450719f02c7ade9feb2a0af8a64a3b2dc537cd1cc33e226173424f081a441315706c4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707e7999ea14da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C444E041-80DD-11EE-BEA7-5642BDFC5F20} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000006ad736a67d7b7cd0537bffd7d062a8871a1561130d2942f3b429e5084eb4a51f000000000e80000000020000200000000fdb7b6a56843b2de8e7a0fe083e852587b5e82795fc7f52b5fe8f6e9365262090000000aedc593684134da7275f527241d9db01cb22e05756f35173ddf0265bd8bee32fe146b6a862166655488d405024976877e11d3c16dd2d896011796c2318f48b3c3ea6164180189ce74c6d715854f3d7305155775e4ddfb624dc0950a1ea792c6acf26eadebebf98ff091ed94cf7d206a5c23ecb833e441b1da87b49e4b63a9982abd77473643d30fe154c1b967898115240000000a53597f69cadbafd22fcac1699aeff9df24029419f5c398b3da680f562eaba9511010bac52fd3d97f956037070d9a004b96b21da60e986292985aeb404f72468	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000dddfd4cc2adfdf44a8b9ab5ae97d4c54e7427bd423dbef6bd8f5004d42fb529f000000000e800000000200002000000013487e347f17cee69ef3eeb7dd1f39f2ff8659f4f40e178b668e07d9b962c7582000000073f0744d5358b3b185571c7b74887dfba09f0349acf665bfea3e3c1ff1e55dd4400000008ac7e8d2aade7c7f371bcb3d73b187631025a73aeb2b194093191340cf94b9b91f9c88455387b56be15a376ba1516b64e9b79dcaf1b65148432c49cf1427052c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2220	2124	iexplore.exe	28
PID 2124 wrote to memory of 2220	2124	iexplore.exe	28
PID 2124 wrote to memory of 2220	2124	iexplore.exe	28
PID 2124 wrote to memory of 2220	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_glucose_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00d6ec4c7176a0cec9277c5924658d0a

SHA1
285796861f6c1b5128d732e23a45f2f3dea10e55

SHA256
9514760518b1ad39ac8d084a69b09e0f45292ab16984e77ce3f4121fb9f8f927

SHA512
d81a1ae99ee7ec9662c20be8469eb4462a94384cc41ccda9bc94939a71d1837198a59bf5107ec0b5164dcc96554ba05d85256f82f59dfb3e2e44fca016bd9368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef0f7cff3fc1b40aeda91358a75cd49

SHA1
0754baee685fe7d9f55fb49ca736682ac8896f90

SHA256
293d8d4534f644bc758620c0b430de30bb2892ddad45066806d574c7c611b3db

SHA512
e20bc41941b1b07c658dabbe13b24af034224d5a0f8cfc672cb29b00c7268c223d28eb300da5e1d1eb166ea844f824d9efcb099fd0b48a184909f7a060ed46ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae84406de6d3fc25aa7a9430a6190c4

SHA1
d21d452665ac62af11eaa68e8ac8e17efe040ece

SHA256
2d856fa1017018e7b4f985eb2c558157704a1f1ded77bae696ecd535e90e729d

SHA512
328065a5c919efbe180ee24bdf364ccb50e8f79142e086374229b9c384164bc3836820d620c8a126a9e33070ad9d699560cc2a0c2c5d5a72d65ace6f57a60535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
156568cd2854e81fa57bfc33a0b1829a

SHA1
c4e2bd42e4a7fa03046e8ccc11034b73ab0e1f89

SHA256
ab95a78a80c4dfd52842f1295be4ac2aa0d9293d9f55443b491c8a698c2a19cb

SHA512
aeacc9bf10187541bba3cd74f3f7fbb883ee8d1fd956e8ba48da00bde9eb63ff38ba0a6c1a056c0276ffb6eb23b511af8018883d1e6b4c4bca8265d6d1653535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f70f5b80ece479dc130919f01682ec05

SHA1
f1c9823c2bea9ad3443b1e55ecca25247817773d

SHA256
45cbe259ed6462d1a114b0d9a4fab7881787087dbf8b6949dabf036c29fc8250

SHA512
9784e3f33001aba9d47e0e7472a52dcfb373b360a385202d9ce605c7f490ddcf0dc50930bbdb62b2fc07bfbb3f1344e862883457634d33eba4d1971d6afe739b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2862aae863c9986e98dd1fb88e526d4f

SHA1
8f2fb026b0402ace1938d5b1ffaee348416cdfe4

SHA256
695ec4512a5496a578fcc8df689a36b8002f02f598ef4177a18b6b04d3e3e4e5

SHA512
8238089cfc315723cf4c76b1723a4359b6f300fffcdec8a8200851e3b411e045b6fff08090f5a6fffc102b30f4d37f9d63be59dd89b8cf5997c212ce98efa01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e03ee5e4a0895260c9d812084a10f65

SHA1
ceb9c6c8eb03234a71da62533a90adcfdabd00ba

SHA256
d55037d86f3ae066462ad611e27cff3436db4c5ccf938effecbf9ee6a34ff48d

SHA512
b36ff3abac8ec162df522e841b41ba66347c296a911e4510b4d0774ff43daade5e9f21ee6bc7af48bde4805eaf09a0916c80724308ceaafe171cc9c61af56e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72bd897ececa4ea53110c902a893f901

SHA1
1d84b86e4c29ca7e7cc7f5c0caca949b5f4ca9fa

SHA256
c26c20a2e31c2d08eb4a8299f7f4d26c8376684aab729eb7c7f502bcf74db14a

SHA512
1c9e2851c87f513255c187f500be2bff2231ee1b6859e21d158df6bb47832a3d4c91d15daac6300e85d01dae59a15df949bc21b5bd4b7a6a5b82d0e8fdf65107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b26987a051b9aa0a589755b6f11fc9b8

SHA1
7c91a379fef8138b5bd4991aa9199ae07b2b68c5

SHA256
948503074ad769e30a6cad86566a1c9b363b2c81ac9f75faa49846704c836fd4

SHA512
b97aae811c02833016f4fc605a2f2493fd0c04ffb0076d2b44defe86faad0413df748bc5ff841c1a1b3318861d2c8566844b16066eabde558b0054ba852e147a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ccfaaac654f4c6a5151224a56b5aec

SHA1
358e9245b99cf25f5380b9a329fa776d27e6e60d

SHA256
1ec047ddcc792819c59152f7e7d25b30393cc01c6b2cf07889a4fcff02efbe9c

SHA512
cd3e4b35b04b071a4a3373160a9b66aeab292a4f3da1c17568b6eebb917d8be2249f401f600a240805abb19ba9a2e6c8dcc1b75316f4cfced2cde00fc5bba7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fea99c8806cc8fc071cf926515768c2

SHA1
44f9de427a72b165d35ee01addd174a5f6fae0ca

SHA256
366c59144eab8464f75cb831d535bc7cdd4c3b3c37e65ddfd70fe09dcea8f931

SHA512
aec07322344885723d77041b8fe4dea99040332ecd0f11574f94dd47a0b698dd71bb97d8378cd676c89fa8a8ff95bf788fff27612674519f2ea9b8abf27d722e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7843ad18f8cf3521600ed505a6078fd

SHA1
f5064b376b7c0feaba7be41d53f6f014a98cad71

SHA256
dde6aac5ba93ca572ad671b48ab66646e8998be0041e03b3e1ec517e291de70b

SHA512
0257c014a817b88d3a7c2dabdac2f74ce5a22e3304ec779aa4e8702cb7fc9901190e9dd2ac7d7c7ac555d91b6aeccf09600dda188d99639a5a0e8af99706be3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db9af2c677990e7fe043b5ae3841e2d8

SHA1
c0a3c21d8e20de60b0f15d17aadf1071bad4f5df

SHA256
ae532e47c3f958a0d24721bede2c7bf4de68a833b95a58c45d9f86633f6db550

SHA512
05d09cc7b2bf34fd09a7b747f5ada3da9ce32c401519aba20f753460760e596fc50035d6c0028984a1e2ee941175ec0722b33219f77da6dca9477e1c7b7c8fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc39c8b7ea3d914db8aff32a24362ba8

SHA1
c59100b200822b9ba62cd44b7ac3279c22de4b29

SHA256
061ba71ee7c7a4623c23ed5e74420a43a3f9888669b498ced2a9c8f96bc853f4

SHA512
2f9e5c865944b4098e80919f285bcb8396d92fcfd149e1c7475a5fae17d2a9ae5875963bbeb41444d78b29e50c938465db5075cb43ee8fcf9ced213b6e88186e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7dec5fafccb967090a9bdb7baad6500

SHA1
11b31b7bccc8adc3e91d06201cf5e1f324ad398d

SHA256
2fc7dd61330e92622b4b2b0b2be2067bb98e3bc081af93c9e873d6880645e4b4

SHA512
4f86fd7c2aa68f648cb5588209ca548814988b21d49457fc9dd83ab11f8fb9cc0192242f8456059fa9343a8fda55895a8c424fe694c410d65d0b40bd7f358723

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE22.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE75.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit