6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Annotation_line.html
Size

1KB
MD5

890007215b99e557cfba709dcd99919b
SHA1

a431687bbd0d1988252ec639c9057e7b1cf4fc71
SHA256

bd77493c711ddb1c02f1fa30b6e89228422144fbf1870e17c41cf68d6a048ddd
SHA512

fa4c4cafe0c8a5282ae8ac87a1d5a42bee2d6b310d6c216b4f974e2c34b3dd1dbb6d5d7f97ff0b534e148e13ac03b0d8925e1d2e9783ef942919898594986221

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0734fb52415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000be9998f78df507e555e45b16a261a47dc7142f6d5e7c33f9c849de8f5074b008000000000e800000000200002000000013017c30b3dabf0a282b12bc95399620dd3a38f4132a5ee265cb6b9d146031772000000068eb0ffb9f437dc53c98c2b774985e92734f9a7bc347821ea929c1f3e9d1a55c40000000aa6d1bdfd7596bd5c5272cfe9637f86cd420126d82b432a039f02d00181d87355555e411ade6600e9e867264336c93ac492fc4ff369fdf01c135d3341a38554e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF23DB21-8117-11EE-9E49-C652905ACAA7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000ec300903bca06c02b2493a5d57d50b1d85457a53ab75d7e5641aa288ad2e58b0000000000e8000000002000020000000f9ca618c49eaf8454a34073b346ff963fc4989d219970883cad0343e5003198c900000001a2ae9298b546460ed79183078744dd822e32338a6c947b3a54c9c6afe64c9b05df91a65651650e695929daea7b80841ae09e9c9775f9c7c21e798463e763d58327eaff9720180772a64d43eab6d358d53c12480706ad35912a97405165dad20c09c9333d438ff3c06af3b5f6dd338e4592a8fd3b76bc30209da5c716fc37a739313e03db1503bb715e9a80aa02504cb400000003726294fcffe7c40acfff51755614ba66ec2ac9823f31ad882ac0119f7f25b6fed61b05a1b3cf0b94996400c0ef89582de392c512e3f3db05949bc2c72f42df5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926893"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2692	2204	iexplore.exe	28
PID 2204 wrote to memory of 2692	2204	iexplore.exe	28
PID 2204 wrote to memory of 2692	2204	iexplore.exe	28
PID 2204 wrote to memory of 2692	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Annotation_line.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4857bef3bd8b6d5e33fcc5306ae67dcb

SHA1
74ef33b63c7fcb37fdd11a9ce3b7bfc0d3aa5fc7

SHA256
a1f03b5fc853a532995b248c1f0c4d3f965c8bcb2bd1d6e44990f387074fa26f

SHA512
e7257b622e7096ad0aa3ddbbc50560ef793b4aa14b33218abc81126d5e9d52f419720f89eb51ea9a5cd201bc26ad9ba16c37e63e9b38076cc1805b4755b999e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20e3bae203b4bd002c80d0aaaa77b34

SHA1
a75968b07220e3ff1a8adee3360b3914e7c58fc3

SHA256
603a33e126003016c82904d96e897bbf3ae106698ffa9847fdacff414545042d

SHA512
601e4cfd9a664cb4c729e4fc5deab29be44c40c59c3c0d772816d45a5f5e3225d8ac37dff2523fc928dc4648b21b7e5b94f6e5e087518030cc24c666be1c3a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc03144f1fbb1555bfe5e74c2aa9af8

SHA1
ecfd3c65ffcabb89635378cbbbeed36a34c12516

SHA256
6865620d10d336aef86661e337bf624d19ceea1b622eebdff31b002f70f4a134

SHA512
027cda976beaad028a858ebb0e5ceeced35f9271f52fbcbc89d56efcf329a17a847bb01044f28ea2a399993d3ae606b4b85eef0abd325db897b788df6c17032e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95fdba37760d6398eb148ccc83bcfae1

SHA1
a28f531ca6b9abd1214794b26c02c4e4a9affdba

SHA256
dcd3654c0f09a6070830e4eb37888d5b95820b4d748f33e12c371ecaee430bfa

SHA512
8142bde2c69217eaae7a1a4c08c57685ebe1354f5033ecee2d62f984afd33a3af2477bbd51ba8a409bc9ea9f5f7769c515c220d5b2f792b0374251b938bffe96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
831e688d2ca243e34dc9da9b1e0093c1

SHA1
06959b9b0264283bcb10af1050f827d9b940b707

SHA256
19dbb590902919f99e104060622fe6fce50382108c870ae4b0c7591c10e19035

SHA512
37dea55f48153e542a480022b338effe4b1150fc52712ab242965fd965bb555b25a0c5f15f7f82682175edc73a9523b9c340ef0152f7f5a20a5f15db51f17eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d91a228ef43feab663fa24af6e06cd

SHA1
7ec181ffd89c55eb09c8f09267ceec0d8e6791d1

SHA256
14f14281e64ec907e6d18b9553436371cb8284bb63d05d485e8342df35ca3747

SHA512
6b05dc9d2716b54b359edc0420d2d8af411d1261d0b5b1dfd219ae318216ae5573893f7bb85655f3415a970db3189f0857c42272bb124376fa9c9bc97b237a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07d973a605bd7fe79284d4b9c93b6ed7

SHA1
b836b5c0ac3e9bf4e6f538f3ea745f530cf5eb87

SHA256
ebbdb8b193f35b7dd29e3524fcd41e26daeefe18029ab8d681afeae8fcd643a1

SHA512
9e4140f8665e31c9a2db61a966a2c848d0ae37197345da68844c475ca1651470f5f63edd62ca579241adf069721f4715ac2025d4ea1c1004733f0e2a0c59fca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db121fd311a6ca0d379b56033438563

SHA1
88f84667e0cf691c55ae09cfca24fa5e316d4786

SHA256
463a7cf155f550b182375361f9a4d5c840fcffba33975de8b58ad135d83754d4

SHA512
7260fe5bc61e90fffb13e5755457ed1629cbccf1a17b44c8119d3715fdbd91dd6f5aa165f0ab6c2286bd08773fdb03844e8ebc9fc712bed4a284e6165bc98143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7549f84f21c5e9c02d83b898ad20fe5

SHA1
eb8d65fd28d5b2bc87d4cee3619319a28517c123

SHA256
8e83d973c0bba860b575fc4cba9dbf2916fa4ca030e616636ad66cc203173e12

SHA512
2e2ead7dddecc0f2332e2c20ae259d39812ce631db995772842fc8133542e00b2879a6f1fb5ef83e5952497ceaf79802e75c0cd454c2a0f6ec031494704969fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBAB.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBED.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit