6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Annotation.html
Size

3KB
MD5

d441436d2e11257268cc817548d0a6a8
SHA1

4d86d2b8a497c86a2d5f9bab2c46358dfac2aa82
SHA256

94a0f04279dcafa80764784448bbeed635a74afb6bb7f5210e264d7feeb8ff36
SHA512

25deac9d5a98db406a4bc03b8217cbc0c93d998b8aa88d3ca54fd8c6bce463df092ceb34c2731eecdf2960fbc6548cb16805f84cb4537633fca2bb2f024ecf30

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC0F2111-8117-11EE-954A-CA8DA7255242} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000004193fb52f04958374d889962d28fdcbe658b4258acc2b9158fab41e0499acd4f000000000e8000000002000020000000610ebd3f3dc18c6405c02eb33a5b0db8b1af4fd9fc2111893b04fa6cbea70619900000002a74e5a7992bea5cc13bf958f81d000e245704685d680d86f16f2ee9cddf07e974aa5fb92cbd6c437fe5ded675a3b117ba13f56920d8fd2530ec41e0695e044c80162bfa9701f96ceca9f90acaa0cc8b16285f3f654340d2d5bb41a31fabfba1b149080b8250adbf1de508396301e0487ddc772dde4f3048296d97de580a040ebf7f2c3ae612bf1a7c068150a5936a0f400000009cabbbcde6105559345223f9d254973f6b50f2f4c331a53bf26465d7167f032563a39c639634314e909cc22a90c72f29160b150a1a254784903bba7d8edf711f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000000873f07c2b0281b9fd00e05b2551322972be47817d48deb331565642cc608add000000000e800000000200002000000071aa6a1d0637cbc8b14c1bfe1453e0603ef81a0344b053b3c8172304f0d8d6be20000000b2c9266f42b0e1719e42dbe74a9e185c37936b160121198502ff61f4949ab4d94000000023f576e17a06432a978813f696eb6f26930d0862c76a4911ddf1df6247d0de9046de198788b59ffc527481046ecf7eaeee9eaf29ea3ffced16e2ea33b906e697	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507021b32415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926866"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2796	2308	iexplore.exe	28
PID 2308 wrote to memory of 2796	2308	iexplore.exe	28
PID 2308 wrote to memory of 2796	2308	iexplore.exe	28
PID 2308 wrote to memory of 2796	2308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Annotation.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10cd018236526a97a60b52477623d045

SHA1
b3b800d0faf8e3d14a4be545579e9aafe0dd0b52

SHA256
d3998b502a97b36b094f41ae72a128be64f4c626c658cbe9cedcf830bffb72b2

SHA512
b87fc98fdb332cfceb3a3c552c974832d69105536af041f832f0fbcf922178b413c137e9ca26e84eb4c95118472bd7225d66679dce1dc979cadee2b38a4fe615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabc1cc041612c2459565508e28e8ccd

SHA1
0933115d3cf9ba386e20bc7a994db7bdbb4ce8ad

SHA256
6f9337ff0da989bb90f9712158cb9689defb1debbf7cf60b6280be94a53a28ce

SHA512
7569dd79baceb4b35357a0f63394298f54d34b9458994f9834f7804e1d3e3c61717a27e96fdd07c5fc7d25cd80da3902b3a79763ff09dd9d6117d184bcd9663f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064d2cd99e31c9d2b50da0d53a36013b

SHA1
0ab9738b264a988e4363741d8c2b20bb1e198d1f

SHA256
f49583fa74f49dc4aff6a1fabc4b0be4ebabdf91c24cb38c5f288ea1b6eb4d04

SHA512
b731b99fe767247f27578029d71d96222b8a4af3b43050e2743acd711ebe1c43e9116205c965dcc17bc33abe2b4a74bb8d063fd6eaba2976ff1b1db9117f58f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb69df6a949d16a2b7a87880951eb495

SHA1
eabea51730dc1ff7e9f8c086d752f46db2d5464b

SHA256
557f2a2a340aaea823f0762d3808a9d040068e311d29f35169ab9658f61c8d02

SHA512
25c426aec65897e058b90c554fe30aa8ae3bb1a04862df4fc44ca2743d0efd04ce27cc0e738739ab99680b7967e75d8ac13861f97a8df5fb552938b376e3f62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86aaab540c4af960d798d375915857a1

SHA1
85cfd2d304160025c34629a34256d08ef87e0f02

SHA256
9ba95f5c6def6742056d6f12e1938b5045903a220c72ab97defc49378e614836

SHA512
35e9d2db4df5b5cebfdea380f16d769d36bc10ab79fa959bfd3111913c1eb62b1dae887a013469e306cbffe45616d6d8c885b16c32f11c41bc36ce9a63b6755a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41396175af33dd7c9a33ca1d73f0a67d

SHA1
8eddf0c39cdc2c48ed95b572dfa8292c56868d47

SHA256
c081ff138ba5d89b7b95f768c7cb139b66028c514c7154df451d32e47246a895

SHA512
41081e5541975d2a6c73f83bc69710edef5cb9029f152cefadd46a098296d915766a8c25a046a2345d6dd134b42da87bbf813888d6d49732c35037c84d776709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f1d0fc74faaca7efa1f30b11fadf61

SHA1
a3687c64dd3853b8a69fade722527e23cb2e25df

SHA256
f6f69876ef1ab53bb6e9d458475000a5b230b0c0cae8d82d53bb5aed55d76c0e

SHA512
a7840aece9acd0825fd27c76b169f7c2054c6675ec3e5d7f82afa3ba2846022092b0058ad4dd140f936db814bf59b27769166b6811bd77246f5069aec67ee40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957b69535e072132b577563345eefabd

SHA1
2bc64a612cead52839030e94f1c17ad1564d92de

SHA256
60a8152fccfdce9159d6f265d60b45af74b056d174bdf64b63ad840bba1f124b

SHA512
d068967b67a5ec3e186e663856c9c7ab383d9898ddff5d275634774926c5321f503e3e81acb4e52de63a045d37a6e6204cdd65bc3257f4e30dd617042ac8f7c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93476753416842c52201f5243ad08cd6

SHA1
46e6fa865e4995cc3578819d0fef0ba43aa34944

SHA256
3fce033de0022bf63dfa2101c70303553c55339d2c16b07720b1814f602a3f81

SHA512
8fb8649145e07678dbd75c5bdd75bb44a0ac6eaeaf9f22ba130afcde33eb3de1ac902af8427474fff0ea7d6713c4c5de9cda177ab40572f8d4340770c281ed06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B52.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BD1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit