4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
173s
max time network
170s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blood_pressure_entry_local.html
Size

2KB
MD5

1cdeabe6877fd1045588c42a174a7e01
SHA1

376b5eec8b187c05c562e65dea56622501840f77
SHA256

2f1b3beb96e982fc3a873335c5117682f212f870d5fc4ee6e0e9c2f9e861f2db
SHA512

b3ff351f1ab2a406f8f1b01d6f8ce58052f5edc5307d84c331febe2c972fa3354ecaae2da9f97e278666692ff56a80d020d49c587b184307557b8adfcff234be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8DA29C1-80DD-11EE-880F-DEAAA329622E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901950"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000025ca9467b43481d8dc43da91b5b783b0adedd00d84881b2018661c3282b7c520000000000e80000000020000200000002cc486af0e42ba3f808943a6e10ab16332cbb4bcb301a08c737bf1f1caea142320000000232cd1498dca5ec71781b2068516ae64404662b11e58a328f2a4ddb58ba20dbf400000008ea2eeb31319293b6747fc3f1076ec5eb18843ec938069b3dc2a24879ef296d6cf890aec6d81f92c8c3d1e49816efb76bf5344e644a68f57670afb58d9d2d8b0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cae7aeea14da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000345d09b6695bbea01aee512256c691ee5a847f0d423df081b13babea77f164f3000000000e8000000002000020000000fe6fe5f622c8783192fed2e00e33454aeba50a18824fa4c1a24a2164dee9fecc90000000b1e98014bfc75d3058e2ddc4b155ccfea28623679bcbae6e1e68dbcbbdfaad8fe886a18c1b7f0c504cbb4a85c7acd7f824902e601c1e3404d3eae522e912c4c7aba63ecce46867906db3720613b16a97ef6a6d17e7e6c947fadbd34cd2af8895fe7451312c2d66d306d8bb66bb2a99182bc13f2d6c0d6e61284f89d5a7a9bc28221b30f0b548a2e6a7db00e5b19acefe40000000afcc8c2ae7f7c3a7f2711031336359721b584d601d51f119a9e6753b725a537e1461eb92665c653b20e83ff4f1ef9dc68412b3a33c526b9b855c1b13766ce9b4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2720	2400	iexplore.exe	28
PID 2400 wrote to memory of 2720	2400	iexplore.exe	28
PID 2400 wrote to memory of 2720	2400	iexplore.exe	28
PID 2400 wrote to memory of 2720	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_pressure_entry_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b46162f053624dc3d53aa9fad5db08

SHA1
a4d431d0439d550861b0d45b7eb4f280e024e8f8

SHA256
f66c0a7fcbea54fbfedee69a095107edb25a0a1c54216cd09256bec632d0cbf6

SHA512
932e39375c7cacf4e5c878c4e55d21e5607b1aca981128da4a9be2bcec11cfb7c2d5dad2d1bce4e2d39c32fa32df93462a6c462ad4b6908f044b15e7615452c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a0a49b3b7ac419871466d93310283e

SHA1
94596d8b8e3d3a3ffe6ff80518bdc697507a14de

SHA256
b449cba274f0d3d37cf5abd4e46bd7514efce80f14330ad38b1983be0f20d089

SHA512
91fb3112bc569b5e1edeed21769469d6f472f1cb3d7a12aff2c4a33b420f71d4f01cc76f28ffa04f51d05432406a2bff6329fdc171e4bf0641ee98e2d3468fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f000fa3c255a330de40324a153ae54f8

SHA1
24cefdd1c0749826eeafb2626013d913fa6871c7

SHA256
e4b78089c738716baf70e5988a9c9d270874f2e58e38ea54b2a0cddeda3970cd

SHA512
ef7ee2f977792569b3b0cb50e05db8fbebd4aa0eeb3206e311ec9303785ce1896ae928dafbcc258a7bd097a854cf84287cc5bf0ac872a88c7f3da34c774b49b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320bcd5f96ff97466bca9266c27228b5

SHA1
e67fbd24bd244cca8533d863f65df0b6ca79a5fb

SHA256
477dbebb130143ab432adda9831763c3c50d4787978ff8656fdd40fdb29e006e

SHA512
7aa60ac09da52450b34dfa4ab57d81a8912810fffb7acd1c8edee6e45882e90efdcfab3013b59213b08fb30dec5c10133cfb2a7f9b31d67a25c9051803292505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93fc043bf8b8f1b4f0a1703d2270415

SHA1
ae26cf8bf2e0397f3717a66e1619074576a8ca71

SHA256
6beaa7ff31e9d6002fa88136403942f1487ec32c3f47cb5500e5c4cc1d7e26c6

SHA512
eb52db08161df86e4f14501a24be5f6ce92440f59916f68e726f08d89ab79a3bb0f2e101918c2239a71afa8e2f180e2af796406b376f1d15bda3bcaea87a9969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e516b553531229b7cff56635eaed7a35

SHA1
371cbc31be6856d8f7cf9636e5b14da64c28bb71

SHA256
eb684ab207b9fa446d445778580569708123b2c20cfd191f73e4a3d96b7c904f

SHA512
d07cc3d71a141f61420222fee11bfcdd626a57155b1ecb10d0d8dd2bb7f88d48953708f1f7e4e0cd1818651dcfc77e00b0c6d87f28b4a97e46ec4858e346dbb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5893421dca09965ef3a4825164b3dd

SHA1
2eac28525ab25370f24b8a394e4f455615853427

SHA256
ef00730b5ea0834f04d6c819eb461633f1b8523ad666aa91f7ce888e1ca7ec9b

SHA512
4f46500939db8dfa87b9e991ed3a23d9499de662b9df7a3340d560bac67561115889cb06c4d5b68f8e13148d5c50bff3b59a0ec449dc5e020687f5b68834e827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26fe34ae684f40a7f824ddd331bff84d

SHA1
6ac847084e83c99e69a820686ceb4269e4f53a94

SHA256
6abb57e5a6beff78dcb5a14aea70ca2ee507578dd00918a5e0ee91189e7f65e7

SHA512
3161260db003cf2d593d3f344f2607e135d78d9d671b2b04cb8c22edf42e60e54efd115d297aa382f32bc6d4f4cca166b708ab3e90a7b5965796d01ebebcd1aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecbf0e9d747d1704c05da2bf67b49529

SHA1
bceebec73fbaa93d83e52ea660f5bc42717838c2

SHA256
94b46a68ed7a7d7922007dfc6e42fbbf4004d347ebe3578445a29d01ac7d5e62

SHA512
128ce2148e85257ef102e61f21c05f0ca764a5cd850279bb87355e055cfacdf92a48a7e4f196c7f38823214a85ba272a53141fc71cc15f53f8b2b29ce6d2cebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944aba05bad57383a7a4174ab4db1da0

SHA1
bfbeccc495969b34cfb4627fdf5e27f22b2044c0

SHA256
c85f9919be49b28bc0201184c4214cc73c09194d7806ab3cf9f689f3690c436c

SHA512
ca71ea7e2cb412c4341ceebe2d176fa3da1ab075ea7b69d3555ec9799395e932bec8c6398ef476eef2c37cd5d4f21bcd741dcababbbd65507302a9deeb17ec25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3095.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30B7.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit