4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
118s
max time network
152s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_labels_local.html
Size

1KB
MD5

d3f96ad2d65e65ddccd0ebc7b31734fd
SHA1

ade1b020eb11ab2ad5935c1ea6e311ecd27756a2
SHA256

2697e2d2abec0dfb176a9f3d0664d8a2df1867e503cc8739ef01c467a6572bb6
SHA512

11e085c5f202053d767a1bede4c32f711f8f77e67f86d3f63d560ebdb9232e2c1feb3ac4a0b525253e4d54a557a346850bb9c4335e2fabc76b8f58c5c9c809ba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901931"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac0000000002000000000010660000000100002000000069331343af64c5f5f8b1b691a4aaeded59c5b1c608d253fa09ffb022fefcbf25000000000e8000000002000020000000639b987a9cc78c2fae03581e806bde2987393f0cbd2809872bc1717024f4744c200000009d0585640787366bf39ed2d47fc619512792d2b9f4c9f7d93bc8a883e64396c040000000d31d8341d39e4f690d6d53ea68a4a3cc3c5be08cde434a4f13f40a1e30845fd70f828c2ea01b06ddbdcab3b0017328f38b8795452b58bbffe3213856d2fe3968	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE667161-80DD-11EE-9DBB-4EC251E35083} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80086ca3ea14da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000651673388bcce17fd3aec7513f3f50a4090124c46a8d3d50f3a66dd37364bfa0000000000e8000000002000020000000c254e2aa8b2077ab184745f1c29cc9a8c8953ee22a085e25ac35ea28612a7a05900000000da33d296e145577c0370ae2c421d3084f2be9e629634beee965b03c88634e20855d48fea6f9ce7470c17c37e2c7ea007f7f6c4aab690efc98431c8e2271ea536b7c570c77f48e93e199313a639837bdfb34d922b49c0dab6076d96fb431da98f297c5c64b60fdc8d3f07afa4947b778095b95a955ce2a70e8b38db0b0d6417616c723f8ea9de2e97dc78c1cb63ce0fc4000000032d76374752d306f06714fe97020d0b7c18892691097563198bf119f53dc0464d593593c6584ec37a0cc895886fa4535955d089d5c7a6f7830b1057859bdc7aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2764	2872	iexplore.exe	28
PID 2872 wrote to memory of 2764	2872	iexplore.exe	28
PID 2872 wrote to memory of 2764	2872	iexplore.exe	28
PID 2872 wrote to memory of 2764	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_labels_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6087d5c6b2fda953272354ee9b3c4698

SHA1
a34dd6f1a528f67f223651c1bfdee63c25ab6731

SHA256
51446a06c89fac9d7d0bc6ddd1ed58daa24f6058da2849950711acf2d6c41ed8

SHA512
996ca3f895798386a67bea8fae29a596d83f571c2840a036e893be638e7ddeefa541080307124158178e71883a8cd2d6c3856f0c1f844f7715bf45380b253da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c0339fca1790aed6bf23d85c2f51c4

SHA1
cfb354c8296e5bdd7ba9a3fb32274eb992fdbc1e

SHA256
0bd9552ad1b5ab846f698f5587f664611ed50eeed3e9ec452130190b647ab3e6

SHA512
49b556a7fcf1bc75a20d816232028f389f2e5751bf7d5938af6f97ebb50b9d5d797eb843d221bbd43dd296ac6c0bbf14e4008f696eceeb4f4eb83778d9825839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c78082baab96a6cbf47c70ac8ffa0369

SHA1
3bdab1e1ace82eb8cdac30725d4cb27819ce4515

SHA256
f0cc0a3b60db0d7a655e094f7ff8c1071f0abd2e1151f315e67fe35e99cab133

SHA512
8ae4f6ba7190c1448cb2a4b4d93c9650f47a556c4f20f762c8b9f8f37b6fa678df49ea7c761620796ee9539bc7bceb43482427e675bc8bcbab07855fca0f00a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee0f30845d2b52c1d9d46d58a55834c

SHA1
20d5f99eb0b8df4cc46ee325833930443473690b

SHA256
aa2be9fb522f7ae8e0442aea25578a47b92acf8d6f8f9613c7e5c772131d1254

SHA512
e710ef9a2695fda69e63620b8f3e5fc9824fad780590856ef950a4587b035a7a6d0146d29a4d1adf751e7ca8d39229002e0bef9521e847ebf53789b29e250d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f39a5d5af66f3c70a5a3058661d41e9

SHA1
072f5ac37599ce45c1c09fcd9390217c6a67f85b

SHA256
885b730d3537789e9b1ea8c52f1561435c77cd7458072226398fa660f3b41ca3

SHA512
441b73ec038ef6de5b708dfcd5a67587dcaa77378ba32d61639e915281b9bcb8aef0f5cb8ef12e278deb78986792caea14a61292efde2c3030627f86846bb49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e5bdbaa40d58d8ec2cc9630351ee842

SHA1
b1fd63db95781f10e1b4cb6540443f5affdf97e0

SHA256
2b83d86fa8674f5d492c37dc5bf68b7a41539aee531b31235c0bfe71f2cf99a9

SHA512
ed58d1d66a21fde71e3725551cbb72a094524836db4391275146b7a2e22c93d3dcfe1207e93403431ef83bc8f2b4b613a889b6220c5590c2c44e0339d5aa837e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d842123d0e2b38eecea8d6cd15e3d7e

SHA1
bee8677e853ce6765daec9666b3ddff31a1f5d15

SHA256
58dd35b1957269bbd1ab44a13654724f4e8765035b70db702f70a06e41fef047

SHA512
6ae5ed8e1ea7e4b9b15eb7017c4a7c297b1cfdd6ff37c1fbb569e4d5aae70025c925f60c19367933e2df2fc667925acf9d833923b6539fcdb37fce72681fc1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaad8bc3684381d2c6043da09747fdd6

SHA1
c88c845c8977e65ba87b372ea010f296ae63113c

SHA256
03d74f8d68e11b1784f00ee3459a8c471937e1fe5a86a9ce050e41d91e2cc8fb

SHA512
d7978c91a34236c24d35b72ad81379726344adba1f6b69c93f92fe8c2a2aa0eb99c6c6848a4e5e361ea8a160488aeffff3f92efed86b09f5a79376f849116881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65ba0c893f78d12daa7a3ac036037600

SHA1
1fca6aa2d19a83c4e2f244476384d8ff876a6c27

SHA256
aa67f3951f44fbf235337b75487c2215af3ef392b5386b7ab325c2d66b87a4d0

SHA512
cd21b96e3693f7aaa296063640aa95977a7a1d89b2986d29da64e458e85063b84891f01d7b7069dd218c1f2243a7d1ad978cd053b93b50d107f1b6d8f58d4c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eefa54de86f4089217c693c002e80341

SHA1
7d349626463c2a636bab01911d1ef060bae879a8

SHA256
8f95157373628f4d6ca0ecc2fb1b2edb668c2f70603b9dd3e08cac1f7bb3241c

SHA512
77dc338c3a41363aa5d0af0bf1b282c80949ee9f57b401d96826e41de75e27c2d60d65d3f17bb606fa1e9832190de616800b6c9560cfe2e4bb6bc6a82f146ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d451c423f6341e1de61770dc7163b04

SHA1
0d1c1001b21a9f9f973e9ea736716d13640ff37c

SHA256
6ceabb2689f43fb1129929d146346b86e1318feab6e3844a29f77b5afb4dbcf5

SHA512
9765aab7d33f861f3891116f4263886efd658c6cf598d9841510c056cdcb0b14b3d5fec171857db1194836d697dabc202c7d8e8ec09660157087d4d9e000140f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC352.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC384.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit