4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edit_medication_local.html
Size

1KB
MD5

601fbf21cb68f72f9c04f46e8047c31f
SHA1

0ee7e08f3c0c86056bcfb9417cf37a2a62ac922e
SHA256

0bcfdeb14fb71a4bb5e13db233faa1792ac4b18f1c769634cf9791dda4f87db4
SHA512

739922a1171f3ee40cc6cf8b0f8d293962fa376bc02bb3f713976b0815fcc8ec44a2b25e92ec60eaef35dfc50c16331672560c4fc606eaf37d5e664257b5f6da

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000009a1ab67349973692405621197dc52853f604d6243e067590ff45609e70fcc95b000000000e800000000200002000000031427c3fd7bbbf702eda99f9ac65f9ec5ec677b8e5dc2808a20a7c5015e739b7200000006b0c85863426c15cf783353932c3045b026719a6a9997c291913134b9da461e140000000d0d1ad9b66085d14516b409b35b0f8e2869623fad0b2c076260f7cf4a1e39da0f321be3e7c81bacd3adf57ed1423cfa9a319d0dcde5c22fd762cbbee15f47791	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C489E821-80DD-11EE-BE5F-76871049679A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8099f899ea14da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405901915"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000cdf6968edfe3a5abbcc574d67232904e99b80698d4f36b62d959a2a3f392afaf000000000e80000000020000200000009eae90524951cc6bfa7389dba723237463fa4637478407d3444340d1af0811cf90000000e488a6841a55d05e818c90d40eb5357eda2f49f605aad9af62fd8c2ab57595bbd847e67dde4a17fe2a69225020b575ef1dc2ba04ae89c8793d4f6c0fdf0acb10698e603fa29ce198a71475fa11d41be8289f2368ea7f71089d5748909358e2d77e17376a6a51e291347e39863d5514e98785afe31005a71ac768dafd40cf4c20d046832894f6a51aeaab138b0d5ba1a0400000002a4533223be9ecee5e86107a47f311a1e691e72d375ae867ca38b5c2f58e21dc40e5623fd3a11abaf00ee2ae41ab60edb394d898a1442fc8be48314eac974687	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2676	1940	iexplore.exe	28
PID 1940 wrote to memory of 2676	1940	iexplore.exe	28
PID 1940 wrote to memory of 2676	1940	iexplore.exe	28
PID 1940 wrote to memory of 2676	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit_medication_local.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc22b3f9263ce18f4ad42d700fb52c5

SHA1
222a858d0701d9fb8bf9b2af293a54163f4de659

SHA256
a41c839157fd0c7e6f34ac425adb05176107e1abba21d35ec3a0e27d43833437

SHA512
dc10bccc0507c7840e1cd7978b141d592c5448038b7110eb9d7a309c63759d113dee4070fb63e93d9b781937d9bc85d0f76baed608adee394387057e7982a2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0447983561a67371d619312c404df257

SHA1
10187521331d700086d29f9707524c48d5f2b560

SHA256
1ad32478ddc5cc6cc6b7a481607f7bec6e12e7c80654dc4a9c1501ad01a53b93

SHA512
f29bbfaecc0af4b1f83e53cb62eff3a167bff62f9f80db8925f0ab5f8327784df07460a85dedca58388d58c7dae1aa59ef0c4a4c40ded3d01a6b9dab1528587f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7102b05d8ce3f00d1756f92a81b449

SHA1
1605397414035f1a8b4b5379c6cd6981af4ab750

SHA256
f65f833eb82df775b13dcfc7959634be4bdc7b32e421c3161621f43c02189a67

SHA512
0548041ff3d354f3710a857b4077ce4660b23acfce9f7cd2dcfc8c7ce18a5f86183ab2a87cb828d068a6489800dd08bdcb264fd7280089ebcf44ae5e724fb960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fd2594d57729fbab8cce2405086198c

SHA1
30131c71fcef0488f716a257b794a0dad38b94ac

SHA256
8dc1a01b5be3a5960b8a24c2774ec6a7ea2d6962bd2267af8b7bc4b92b6c88b2

SHA512
b1e77e4a5eee084bf48fa6173c6c9a8f8fcae3f61e05c61a8e1e809be0ed65cf648493813c78654fa0b348ef0a51537d6a40972a24a87c83b0b69dc5729e655b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e3be0957ba43a5784b1322f6cee499

SHA1
006bafb57d45d13f23a4b8308639eec96ff2611d

SHA256
40c2fae771b83d0b300d0998a021bd1cb1cbf4e99c61a169810e53150cb667e3

SHA512
eb16128f904878562bfa9897153b6149f97464fa29154b8c9ab737262b4f2678d5cb23c876a11ab6fa499609519d9195518b95483fed3e753d211d4aa854c68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7ae084a9ce3ce3195fa1885cfb9fd12

SHA1
e8206928ebd6e0e5a5fd98fa3efa906b6dd8e92a

SHA256
652bb852bc9dee611707a682075d113d2c6b7a9c9d957ddfa15a1f797f42797d

SHA512
331dd4d4c2e22800c2755211143d8f23aaafed7f267e4699d351d83e18dd8411700b5773deb2863977b1c3e93d688e21624e3839039cc33746451570bfcf65b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49fbc9ea9dd31a975d3b4200411a2ac

SHA1
68e4f1c8beeadb31bce8273f3aa872e228540d80

SHA256
946f6a39687b9262dba0b8fa6c0a4c5a3128e127e209c82b95a9a5cd53564d52

SHA512
2687fe3fd610a8fabc1759f93fc41cda4ca1a5c0b6114b7700b1fefc8698904adaa49a6b718588265b09588c09654ab4c6bfb16c6dae939fbb4ba8843df2d0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec37e0a25847ed3d3e8797baf026cb56

SHA1
8a1af9d8fcb4f83ec29245bc9f79829f8ed74c37

SHA256
a523bc3b6d2b2664fae981d00407e164912552a8d805b5e87053f1f585fa4f15

SHA512
a331017f808d1de5dfdd3b06e2c370b468a54cf16c941e4217d2c8e6ddd15dae9f57394c8e347495d21015515675c25454ffc774ab2c3765b74a44e1de05bf58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fafc892f149990699a73d02cf7753439

SHA1
2870b666f71cc209a2fa3bd6042b5dd44f5e8331

SHA256
93c049fe8fe7190f39592ee37148c732310b064a11bb002e2b5867d6ca630646

SHA512
66cc38e12faca9ff24e10818e585236246df8b6f88186d1da5d4afdd05cf60c34dbe93854fa9fddef10204ceda52a664cabe568905a38e61a983cf365907eecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75322ec0fcf657002087de20beff0c6

SHA1
02c3e3e47d39854ab817de7d59e77a571b5953ce

SHA256
55f95c173278451cb1c6ded4491aaa83ac17b5d3415256f0a9542dbf9bd414cb

SHA512
d2ec780e676d1e01b8fb4ba4105a43ba1540f615158cc8dce1fcb967fca1ffe5483c8c159d272ffccf37a17f468b51d3fd6f501d5d437ea49620917bc76249e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4b9e41bcb7c84158e3df3f63133b5d2

SHA1
a0c435d08d8eb6769f51043f936c49dea54ca0ee

SHA256
a5f7bd67382f10c57c17f006567bd7a2ffa9ec0b322ddd651c99fbefc8ff668c

SHA512
2cd84ee8a8a554929acdebdf2bda74ea93de2348f7fa7fb1771b6fc1db52dccc79fb692f3b6aaf94d0fce8627a69da2a167d54ac1a65c91949a9e3accc8b9cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beab39bf51e613b44c72031188edd4fa

SHA1
7ae502fb61f9d2eb71e70068aff3d610a1eeb642

SHA256
cac69916f4636daf3eebcc904af246f0924a853c235476360364a73ea30edde1

SHA512
9a66222744533a2368cb7f54ee6759ae264c6c7a02b84dd2fc0d6afcb042181a8be37db23797bc8a2264120451fe30f63b5609054f7f0f38392701b88489af86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52fc066812830504ed76a383ec20025f

SHA1
6433017ccc3540edf9048b4fb9b4c755bfbc0e33

SHA256
f3c9329b37aea9fc7069472cdc46f95dce9df5ac2f109efbfc10c72861bd62f3

SHA512
3e6da2f9bf40d250d935484d478adb1758e41fb695bc1222b2b2742b6cde8dba78485f594e973959da69fde7166665e7a2a85c46f283b26582f56dfa87bfd519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b72122d467eac2cca4896aa3760a14e

SHA1
edbccbc48b15ec177d899f47fc457621f42dffe4

SHA256
e919d126a24d3fcdb87f175659227ce100969b3eaf84f211fa7eecca546ab353

SHA512
7f28a8b56ddff4491c7d4da1e011edfe3e81c501d573ee6b8b5e0bf436c532558bc385269a6e430e1ddd6b698d753e9b5de3cbf768b3b9100e2e3dfca307115f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c9eb23ced20ac2523ebc7b60abd4945

SHA1
51946c15a209d2dc63b10f62c68c8336ed9fc091

SHA256
4e00a0270de4a8bf6c121484aedb42358362ae95f69e09fd06ffd9481fda3162

SHA512
5a6022e7f86bb979633293250b296925ee616df2d98f4c9cd2160ed220c73af2cd0031312dff03e2994541df07ac2e1e747ab1166e72b55e42fcf2370f0b70a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc1fccf9b82d0af85bec567acd00d4b

SHA1
778311e197e9af98be448f5c984b5d3d6208822d

SHA256
9091d5a55790918aa5f27acaa951518d98ba02ad03efbc2d7ab83bc300af0333

SHA512
6c5d24ce3bec57496b3c3015b4f246d0fe72ecafaef48ad29d9aff32c7e756f2930b3ef4f8d29cd074e75047d61bddd9ecf6cef4b7cb4f7e77a0118fc5a0cfc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA507.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA569.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit