6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Annotation_ellipse.html
Size

1KB
MD5

c1c80ae6672d693085bf37fe80648604
SHA1

24a0f37e4a13c71aa87f59f7edde19fb4549e53a
SHA256

ff47a9524daa7c21da9bd176c30c48d3a681c3fb225a8f18e043c25541c8f919
SHA512

c3353aeb23fabf60f1af89a058c07c9cc2ed6c6d1c75781d1367389dd1df6d382ea69bd45f07ec6700cfb5a5edf1cb2d2a3123db1a5adf25e6f9ca18c4417d03

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE8C7D21-8117-11EE-A0F8-56AB2964BB14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000002a515a06345383cca901db4f41446e7e07ca094b4c724a45272319ec6d801e37000000000e8000000002000020000000521745e3a7b9297c63e837f68520561578a98ef2ee438d01ab45138de9447b1990000000d2a01157147dfb4c535b20d21856a12322aa8028f7fbe69ecf7bf1081a2118a7b31f7ad1ffeaba71a94aa16564df200c642298899dbbcb71244fadd0adb3031ed572064a15a783cd916d20a3edff3f0020ac5e035ebb933e20777740264619492356831966f5b8230fa13c78d12049d8e8f7b75a6232bc2d3cea88b4c2c06ccdfcdad5e464d30013e9464434498fda4a40000000e3f59ccbfddf52117ff2bc5d195044b34aa20711e34552f78dabf0b8436b557c4e3d2d0cfa631b2ef02c9e3669128908752911cbc952e10c8f43a1f773c7c23e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000002a99780d15d9e6b3f326c8f57fc4962cc77b53e9af24da75774f864f38e9959d000000000e8000000002000020000000c16bf7d6c2478936865ab317c560ddc53a81ba5b7191a16ea39bf4872422c75f20000000dcfd0960d0207b4b5d53cc9cc1003dc56db71de32420a4b69dcd0e4354ba201240000000a888cdf431b8b79400037f500d9148b86954ae8925c447957604264a281891015a6c71a525b9e104f49a768eb271f563d1538de6e0c6dce79d2363a9435347be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90112ab52415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2700	2272	iexplore.exe	28
PID 2272 wrote to memory of 2700	2272	iexplore.exe	28
PID 2272 wrote to memory of 2700	2272	iexplore.exe	28
PID 2272 wrote to memory of 2700	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Annotation_ellipse.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5983f2d5386a09a584d3b6bc1c27da93

SHA1
36ba2b1c8a27f32282f042a77f044901f2eb59a5

SHA256
14d0ad8954f65c1be077bd4f92ca5a1d89301201c1b7a7b0fd7e65b1d22cd831

SHA512
afee6f73c6e7f1a79c2f0f65a05b8a7d62055b94975d3825b0303a8a45c8c78ac17c3ea2aeee6abc3f2ce79410b45a62b52040270678cbbfc24a22cf68429375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5983f2d5386a09a584d3b6bc1c27da93

SHA1
36ba2b1c8a27f32282f042a77f044901f2eb59a5

SHA256
14d0ad8954f65c1be077bd4f92ca5a1d89301201c1b7a7b0fd7e65b1d22cd831

SHA512
afee6f73c6e7f1a79c2f0f65a05b8a7d62055b94975d3825b0303a8a45c8c78ac17c3ea2aeee6abc3f2ce79410b45a62b52040270678cbbfc24a22cf68429375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96b3eb8716cbb61a15d82b310c5c058a

SHA1
f4f33dfae89282333ed16961af6786b915468a02

SHA256
afdcf095b91b73ba1ae122693767b692f158248d41ff6548bd9984635413742e

SHA512
c07ba00e90a67b986b6cd6ba9e3d2c612f58fdb625bd53e746c0d6162d4243b4e09aafb14171ab12fde9c9b194309fda2a53579605f4146be8bde383609ccbc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e81ec41c2d2b860f02b4d34e8f7b56

SHA1
7044e4a89a67216fa7eca173b26b99392a40e633

SHA256
3817249bef78a300b7a67ff346e01cbef561a30503d7aebcce0030c4f842bf87

SHA512
b21e881f2d5db4dc67354df4f67d8c5fa65ac0ee20acec19d00f7ec3a626a1d841990c0ba82a15629e4987036d8a5f615cb3813578a6f7395a80a8eebf82ef9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c62057d3df096c1d2c789b2bcfc7b72a

SHA1
5b17e6181df0d2e817b1210d5c69977faebc3135

SHA256
1c62b981f7d5c271f4edbbe7eb183e0e43b661652567f0fe15619c9abd244d67

SHA512
50aeb2147f2d25d6fb275e55d98086ab1a768bb31c743ca3e707dca4f565eb791850c34b6e9bd2d54a5650b860347f7587a941d3f861780525af1ceaecad60f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0172dde050ec1b88613a1fcebf6c0755

SHA1
7af5db348a9583a56fcb62afffeb220e28a615b8

SHA256
91485f6cf714d27c21f0d55f40f95040ba1c2bc4dc113be65abbdc11a3fdb4a1

SHA512
9e4fb008d61f2b0f7fc84308806d7f42d07963dbe866de4ed5af40b777524c02d61e5a958a7e5dc1668eb88dd891a712ddf53f679fad32722b741a03f3cc45ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec1f49fdd1bda479e1dbdc23f2b9f58

SHA1
9e2f51302b461819f4643c0fdad4dc08790a4b2f

SHA256
c494a505ea8b422e1e385170a703a82714db3f225bebd83880a02225d90c93bc

SHA512
bf7c35795f2206a872b44857cabaf6ce2b1f841da511528232a76837c74a8b4777c8b06a6e9b16d118fab99cd3c98a6794931c9a84a3ff290df0c084bbdcee66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43198418a812c1b025cfd9e365cdff61

SHA1
786d486d15ec026d7dd7ef781505f6e9052cc5d0

SHA256
3e82eb48f3649fb9bc8e789a040436e3f13c55670a667a06d4a188376c0a7f0f

SHA512
594e95761a2384e8356840e9af6f5ee9d513af0a9b2ff1bca52e100070bfacc6f9368909cddd3e224924dbf89862d3808dedd7dd4e868e289ea0b0ac542f6df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c1c8692c469197980061082dc29fbb5

SHA1
d40177a9f2862d025874f8e86c0d83dddeb1e5d1

SHA256
38cd3da135a7359e153065538dcaf1ef42c9317dd892564abc05c3bf47034a5a

SHA512
78d52604efe04d41f9dca3d8f4d4766d0bb9e03d92f238ed4e8b0ec719950c61a4ef2b4f4f5402c7fedddc1d63d90c33c3d84db8c6a29fd1f6a8cb874ed03176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27908b32cf1a685b171083c6aae821a5

SHA1
e93514d3412ad2229b7a3a230b3ee02d1e63178a

SHA256
9413037d5c007437a43db5d8a451aac52c2e9b2ba0802080c94adb5fc76d2649

SHA512
d6db65c11d3966fd19ed57d29e3fd46dc76556133e89336b1dfc666373e686dfd850cf4a8fb285b16357cb99932107c4481baf5434965ef369203640ec56d5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f896ee520f9314a7d2c2c5d5f261e35

SHA1
9246a8cdc5c864894f49132242c2367dacc7eb4f

SHA256
8de8ef5829496bb9224ed6a6cef597e743fbdebdea51a2a1b6dd3f1ae554eee8

SHA512
77614d822ee309c4f815207e77879617408ab39ada3bc3caf46cd4ae75c77289a736b3c38ccd9a82e93434d8ffbbcf3375b2e455ac782f97ae2661d7999f6c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ab9ae9fb7bdd49f4cdc7be4c853d55

SHA1
1b2ce5e1cf1f4a5773fa71759dc1a379b58d8831

SHA256
9a4384843340ae7abe0881b26e37847d17f5f23d7df4e196c7abca42cb33f4ee

SHA512
50850eb5a91fc192ab435882158fbe7e646d85a1ec5850d0f0817001915e23e391ddf937833493a6220223bfbfec76a7981d07cf4c2b7e725f16315e712da316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0e6d92f971037a6316d2fbf24b23d7b

SHA1
8593bb74103e5a573d835cfd734f38c4e6258195

SHA256
8512b92d2d1c8c81e894043bad002f05574ae38d27cab2ec705bcb3146ff2dbb

SHA512
fd16cbebf3a158faa68f2f38f123a4d03db7a481f7b33a153e5cddacb56bcbbe64d542a0d59fec2fcf10914da9bd0f4da327bf92913de66b18201a0d0f7288d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10b5dfd65e25912b71a7411d0246262f

SHA1
9e9aa9c8f109e53f4d5e596fc494410a5abe1fbd

SHA256
60a9cb0670cb9259579b4c5241251e61717ff53c008ec66708892f9cdca66ea4

SHA512
f332c20cd94172ed18dd92cac7989e2a51258eca6f3d25b5e08bb1d326ba65007ea4f88fc16e4f336fc3ced7644cb64966db794ab167c3be0b102fe40540a21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b888049f37bb2745ab2d1c8d69328e3b

SHA1
cff2d90b7fe4e9ff4f35043134865b5e5189cb86

SHA256
d45b950bf968c8f8128eca271a3ea4244391ee4890143c3e86b9b6e3580349af

SHA512
8d5bf4ae541ab6f6faba00f72eef26c66f8af490d92bbe2d3b1da45ecbe42ee051ec3fa99f51dbf1c0dea696203662ac1c23afdfad5919941cb377f45619ffe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efdf52eec3e914b74b7a0117bdaf4262

SHA1
23bd6543d21077d4d9294c24156c25c3d4681cb6

SHA256
c9cd2aafeb49c8c2b0ca3781e14ce058461beebc055a72de5f62724b942a1461

SHA512
a4d3f288f2aa382ed4009459d168215169cd71a7e45646d717275b98427e546593a236496dd7107a9008729d2094e06cbb18635c47446a387572de2fe468229e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c620e8ad7f05ff827b430254db6ef1a

SHA1
c6c9f523df28cbab35cd6c002e7f108ac8e5fbcf

SHA256
fc8de25115fe9f65ca0227a186706507ae40620a80d38ffe0782f215ae2e6988

SHA512
9d2160e9cb757a71101a34ba23adcd4b528f0800f7cde3a940fc33dfdccf95e4e4a194db4397bd15fea6fba7e2cafaaade5c1b62e6eec8d54db1d4eac02caef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5A9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD60A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit