6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
120s
max time network
156s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Annotation_text.html
Size

1KB
MD5

7e0f4989b7fb92513c72df1a5f6a4b33
SHA1

eccc2a6431ab9e9d2094fe9d5c21a08fd2b6d977
SHA256

9f62f7311addeff29afe55aedf0fc957d6bbf1353df9253d78623dc057762e5f
SHA512

841494213cfde6263cb66fc383d34d68c8beec22445a9b8d740d34c2f42b10c91e9a7f0c1f376de9f3a0d67aa4e11463a136dfc165e226a42e1409397764dddc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000d78e905cdfd74fbb3932add5a46c2c7e073c8945bf26c8fc40cfda7ca4c79469000000000e80000000020000200000009bf262264ce0f466bf2bf1e5e12f2535873aa350a4077a876891fdd7b50cb5bf200000009e9de4ad809d38beae695a85c22a1d1a723b2d7d97720461ad79bf87ec86f139400000007f62b5c2424796220b81063f7d227efd02506d28519f3326ec43413936e2f271815456c26582ac808f3a02dec3807290187664308cd948e370ccf19f294fffea	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ee43be2415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000cbd62bf7bafc8d765ea7c75a60240fa626ba5f7289c694b28310d3eec6e52cd1000000000e80000000020000200000005a952b4cce6952e0ccb4068699ee06cbed3124c40e1d51fe32bc875c28df924a900000002cbcd11ff0b0817906edff061eb52203dd151100ee9dcb0a8f435387f689cfbdb8f6935396cc953ca672830e3931999ad215401e82298be03a27f79bc420433c0d5b0929571d495f327eb806335cccdfe0be3e33a24d42db718d9098e42cd4093a398a23c66e651cc69dac558927f9abc6b14e637b11ae5e7ab0328d156317ed1393762d6f6c350cc9dfa44376fe825e40000000f8d3fffeef0e53a66406842e4d3572282ccd2e52c9d18d7a6924d43be937e2f7fe0650ae53bf10ad16b3b8dd6e7ac7b6a64c7211e0e3e086e15042f5528c1e27	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926886"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E86A4E81-8117-11EE-90E0-CE3FA04DA9C5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28
PID 2148 wrote to memory of 2692	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Annotation_text.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3fdcae46475409453b6572365a871ab

SHA1
93fe6d9f3a8df2d0085e3d3682d4db5c46eee60b

SHA256
772cec6177963ce13d52b998e13dee0cc8c6f70fa5b51f94a35cb076b1ac2571

SHA512
fdeb83feaf83773b1b371e0b405ecb3e811d73c93eb2d6e2ded4503fea4609074fc03856d8b8786baec79f7f8b4d73d0edee63f43a564b7f1984e1eeddf2ec17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c23134da562b0f18a238dc3330074e30

SHA1
91be0b4b8697869125bd2839d0d28aec53d8c164

SHA256
da7b2bb9fa1fe932b7dffd2a0267d14e81914cd6ea468798ea00f047e1146cc1

SHA512
fa851b678a3df6f29c975563d622efce3be782dd30d4477d3badffb76c16862aa179be78dc3c74c46631ee1f7f9e443d7ae3592da5baf1472499896ddda80deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1726797e3841abb630b85411f3d0d3e0

SHA1
88088072ec5fe8fbe65906fc1f0f3a2c93fa2f7c

SHA256
d5221ca22fa655afe55bc9d7cb426e044c8558e0ef2b4c2344af78cb8ced5896

SHA512
2e58a2915ef602b46313714d7b2292993e0643a748d179d2cff2be397352dfe8b7048242ebb22470b224266a525cf66eff39c105be9d528e25e8e3d1d2d44a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7a08b9961313f3b700e8331c95603c1

SHA1
ffb78a38bd57fe0dea84a6b0a26281aa0a89b71c

SHA256
3e1a85f61c2d8afed0353f03088cd264cb0c485aaf984a3b955520411b04f74b

SHA512
4dc39c3fdac06f437444337f6c2d6e136cc772b7b170b4132494e5c7b09a56b8915d8570099b503cfec46fc9a17727be0ac584e5c0e291953da386c8be48e7ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c51cd747e9a6475658ae1bc9f02655e2

SHA1
4d79260e2e2ceb5a5fa82d9edcb2f7beee2c6c28

SHA256
de9efa3e7d1947b82968672dec976896f9206ca3623a6b05d94453dbac3ee80c

SHA512
f7ce82c2d2cf8faa7e88993afdd535c256cd2d31886050bfd6b671d77f70b3d52dc52ff66e1a0cbe4a7c077a25d05013d408e4fadaff989c42f94c8a7b8adc78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a326361a723251b17a88aef225ff4663

SHA1
2c0169375e915cd30903bda9f450b41b0f01694c

SHA256
fa8b883dd9f21ae3f5ad919d25dd9d591a151508003fdbbd84ff4e1ee8cef13c

SHA512
4769a1a210d7f9d3137ad957dd01b9b07b0a02223117d5d98eabe30456d9d03349ef69ca80c8adda8c18573348a5d5a05c9a389a0a150541fae923aebaaff3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52259556ce688d706cce8a37e3485482

SHA1
eabf45fb537fbcfff8a12a2d211be032404a5cb8

SHA256
ed324adc9686520c43e7de07f94680b0ddb665041113b2d59ab3e7f0a719eb37

SHA512
3feb524fad6f13bbb12946419c63c7da867f26913d01765c29a334370bc8b76924fb2208f87ff0edfcef4e802e9a9c7ce74d0e8cba5e9ea6ef6751ab85cc83d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a68dff9bfa3e81158e5d4fcfbbb0353

SHA1
2d8750ab16fc1a5cb7f4f7603a466c0fa3de518a

SHA256
06e6955825d6d8364a9a4a1be221b0ecee29333eb26e1df494a02e6cae995e8b

SHA512
1db742db011883ee1a2cdfae1d367a4a65a1ddb875282efb553461790ceaace63b8116a59a3f62bebf249283b51c3dbd0c7d1e7c0b7211bf8c692a004f4da47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6993e179514ff688f09ac25037aa2681

SHA1
34d633b7c69988eaa6fedfc205dcba8a491711a2

SHA256
1da158b60167c9151619fc55c400d42f092bbca8e838649d07eda4e2ab1dae2d

SHA512
e0a479f489a670556f46db471873339758bd1daee026da6a61fd15e1978e803eee6cdf70e9e5976b3a72ac27ed0a2c357c333ead5ad84be201495995efd5f916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df9d641154ee4cfa6dc474040df2d3a

SHA1
669065b16d24dd5980e0694b866f30f3f1533acf

SHA256
f7088b94a27cd3fd7a8919b768b4cf40cba8143b8ceb34cf022df02cb8fb03d9

SHA512
de6896ebb01ba93a082ee4c68fd2670273ed7ee6a2770ef20e07cf0539c14040c5a18ddaedd8d60f2ec96c60063e2b29974df2865a9935a9ab8e80b076dcb3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e752e08288791fe95f975b92d6fbf0f4

SHA1
ceb4ecc5a9b18f32a97ff2207f8c770664588ad5

SHA256
98da7ea79d52b020463009df97f526cc121cefb13709d2ce70f689ee4ee00f07

SHA512
b69c58a09aab521fe635153be424f93854310b1bef3623c849db533aaaf24a79a5cf702f0fc7f95382185f1a028a90c95419edec600994ad9a295aac656484c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
494fd42af0a0b568969a3a55ef780612

SHA1
83ef47d84a2ebc59ac89c50b475d4ba6cc9e8d44

SHA256
b9db8810727be186f7ac7a64d8daa607b4f54206a4ffa700e4d073e3cf20450b

SHA512
d0ad91d7178ca6049abb1c650a7098ca0694c10229eb95ffac370e48fd7ead9a47c2164ae2f7048a5c24d2ba0be5ccd5bf716b1e598a61de332e9261b88b1ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8a7ea2272cfe416565307c4da154d9

SHA1
dd045fdc494030416bb4b243dbe4bf1f9fde9187

SHA256
89b6096d2daab364b4a24a01926fcbba957751a56ebb9182af1322d123410fae

SHA512
71d6d93db121e428d7343a518473c41b980fc3e323d1093e7050a5593f36cf6e12e972508a906efb6425f6a24e2de24b28487e45857970a4a15609ea252c8ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8df3db5693a720c4fb8e9ffa14b5ac4

SHA1
1e5dfaa5d01aaba8a253bebba2fea3f022958db8

SHA256
d886dba608763514fb173809f49f5e725b0da5d2e1b767bf87da459235771ae6

SHA512
15a5ae8fefbe50ab8bbb4fcd8cb5ab77b831d7f0eecffbf97da1742ff2e22c66d735af3be1a4907197e831aa114d7acaf66c157153af236682d39458def7d57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072fc7cf28a5517eb7053b2f0a24a009

SHA1
f3b06cab2f2081f2bcc39cde52ba7724cc99519e

SHA256
4cad297227fdf88a3aae92545b20cd901537657a64c91bc69ed226c5ac9846da

SHA512
68a4dc086fadbbc0a8f922299b9d7d1447c6fa52d9ccccd371fcc99e96873961dd146527fa3a077fba67c6c5279b72bc8852cdc84160b477300a507416a3c26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC249.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC27B.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit