7f6b4a7c62f5936351d5ac49fb03681b4ad92d4899b0d9f6467dcb18b551d5d5

Analysis

max time kernel
159s
max time network
177s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BytecodeSignatures.html
Size

21KB
MD5

6ef4f8fce5354fcc935c4943acfcee44
SHA1

40d458455dea57296d413c9b0ea96128a297b994
SHA256

7f6b4a7c62f5936351d5ac49fb03681b4ad92d4899b0d9f6467dcb18b551d5d5
SHA512

bafcb08acbbf3bb95a6d946f13d35cafb166d76f2e30335b69326ca0d02d91eb5f0b5209a278e67c8b314b9840d93b6c64b32d34a513c692ed534336ed8183b1
SSDEEP

384:cFvxfr3udKbiM11YavAZIxF41u+sr4dA4xGC9Dk:cFhP4ar4dA0m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000601155d615a1d55e648b5352debab4fd77c3869816d41d2a552db7874756c47a000000000e8000000002000020000000cb025edc9233959a6a88b6ef5296b6430470232a9bed8c02cb5837aa5cf117f620000000503235d0a8f6e084fe31dd2c532ea37d19418394eba21d70fc63353627a81f0340000000e1a929fe210bd0d7cfd0d332b4335838a4e28ebb75ab314347b8ce867ab83b5107c8c553da057f20ea68d6e346864bcac51224a09ca4fdf44cf69222d8f7f6cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406336394"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51C91521-84D1-11EE-9C00-F2322C0FAC57} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000dbac732897101aae40050915c0fb1964784838263d4c2eeb7807739c24c5db82000000000e8000000002000020000000b15403c05b1b74883e813df97df66889989b053654d658799af164201162c063900000009e41c11fbad0ae52e7070d8fe22d40ecdb8dda7639861da35fef4877598708da581f506ddca77a8d70480dbb4c6bbccd2b84eb844fef680a6b688f1a2ea75ea7e0c775f4483aed55573ed0484ff91f47fcb6e4ee3a2c12d3f23c0fcb60c3a363788ad0630f66babdd99f29a421127cf02dd5643dd0f082eee24cd7e6a201ee7ad210f86dffa39e0b61d0e35897fcadd040000000d72d01533a338850057cb47b1ea23e2581dd814829d42aea1d4cc5de6b449be0ea04745affe4b058ccf7364fda9789bd07dc3ce8562c80db46a9123aba36a1f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0643633de18da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2772	2372	iexplore.exe	28
PID 2372 wrote to memory of 2772	2372	iexplore.exe	28
PID 2372 wrote to memory of 2772	2372	iexplore.exe	28
PID 2372 wrote to memory of 2772	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\BytecodeSignatures.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d59bee458ef4fc58fd2b22d1241cf6

SHA1
006642c1a24bc3ca4182676f2451d25f4ab3eab7

SHA256
ac7f36d9752a7ca4e10e89396f88ab990d395dbae8f153ca721dc04fde9c104c

SHA512
bca67331ca033c0c57a9baf83472ebd95d541421d251aacb502641f4ee3cda699b497012052423215779fda1e24105235bca6c0b934cd962e38181a11f58aeea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d449422b35783e99fb727245e7cc6a

SHA1
4f31ff37ee48fe0340864a08429e93d51375b24f

SHA256
48582a44a9999f51830df58b3d7b4bb3e2b5d52670360ec1a13cb17ef815ae50

SHA512
e52e1afb505f50e4e5e67c6b24909489dae21c17a9012b5214f8ad25dba97cb3095acfe67e6267ade738c6f5bb9d8a6162c10a81e63f965f40473aa085f76338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b040b89823b9ad0015d6f885ad13bf6

SHA1
78aafff38f447bba3fc95cca9f708c2b9624d589

SHA256
4811f8b9869554f67d0c0106db5e2eeb0fd90d4e5453c6077750f9089071e89c

SHA512
fc177acf6125c24a8db324bfb5d3ef5c4267fe9a3278d57bd0f248105bf04c4048454f32579b779beefce805d4e0336bc80735c86315387a1dc6d6d4d122ebd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a994a506799346b6cd376840836aed

SHA1
a0b905892a721adb2a4e7e4ff7574857a9f52756

SHA256
b89def7903a97ab0fff2cccc61507adf59f35b81bf2c95f4b394ae50476e04dd

SHA512
1531dde12e00b2a5751eeb5205ce39e87ee30b4fa166b215351c5412dfd9691e3cb369befafddb434b3a76f5cee1b77b33c023bd99d158d5e6862fedfb5a0982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c15e419cdf50cb020923d78de80c9aa8

SHA1
42a7a737a6caedab9fc9c4627a51405f37dbca24

SHA256
061db148c88ae14864a8128fe31ce364e4fc8e8e66cc1464377ef5e662585f79

SHA512
fdb81b831c3181266e335d2e7f38bc93e66a35ea646e49916d3d31abc00a085ac748835513c89fb6540fa84133c4e0ca9b30d20a820526e4de6567c7d1bd3b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28a4688153b1bf972c7d040d644e5916

SHA1
64c1eec054392a9659ad3455e7512a81aa4e6750

SHA256
d99f21eb8594e73e13855dd9d247d5cd957d7b0eb1bca09df26917119df30710

SHA512
370acf237adcd8d77c1d38d7cd9072d5648a0889e970a75737900efdf1f61f1db3bab2f7a6a8506f70f449e555cf366a443b872e63c4839c830eb823b2e250f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f729bc1f65caca7d359b7008d0b81c36

SHA1
3f291c1fc344ebdf5ce01bb8512b4166d8af977c

SHA256
2a78d690af40b1eab2ea234a448815b1f29ccf8eee5863b57d1137a3afaeb5a6

SHA512
215bf526996983f3fabdd751d0fd73abfdf80aca328053a60001bd6a60074bf043c5f233615d5d36fec0c0ce749670f41bf3e3cdf8b28381e2347d854a9f5417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
218ebb6c263862c83227a436922a2372

SHA1
641456c0164479141b375a9ec40227a543126916

SHA256
4acfe9b164eefffef94a8c4b4f4a8dd7de782dad046f2ea909ea434ad6dbaee0

SHA512
3530746a9de128ba750193e65f2c8adc3ede420c004ab6a9a43aab40e3491e18bf3a466e7d8c00fa9f5d2c9a9f543d8a322e07d2569c39fa34607b5658b2b5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdaee3a17691c9ec17e5e6036712dbf0

SHA1
c5fa8946e7c9234341eac85d2a1cae2d98331c45

SHA256
2ef82a07f9dc3df29e93d0a9bc4abea6f554b3a7237f6b0096961605547b67d3

SHA512
4a67c30183ba52c8aa8736ce74a63720cce60df05d87aabb4ba6b574e7bed680f4ff6a3e821de360a2e9720977baa43b289bfc784c5057f12aa51b0ecd8dda44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ab71157f1b8c66666f1dce48fb0153

SHA1
c90c53f0430c9e1bd83162c63703334ccc4785d0

SHA256
95d7f82a4bb21d96dbf81d70c590c03f2b2e22071eff9f02aea572cd5a9f41e2

SHA512
d68431eab21f6ce4905375b9e4b8e97b7d3c7e65740d5d46b39420352b6a71fef69562702a5d54743e6f2d9b26d6a1069263c11f0d522709133ab256f6075c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E44.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E86.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit