3824c3a3b87b26557ccb65e595cf989944630e749fbbf5af5436a10c0d7fb457

Analysis

max time kernel
119s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0001-exploits/midikeys.html
Size

5KB
MD5

d382f99a2a6dd54713e4c4aeef2ce1ba
SHA1

f0ee2b31b8319fbef125e88020ee179bc306f927
SHA256

03bb247d0172ed1737bba3d4e4230b04f38a9de92fd5b0752da235aba0b587e5
SHA512

937beac9866bd3341776f872140e35ded90507573c3f92cc541659212bf9c2f437816f5c1bc832b25b9439f308bd1c3d02d9a3b20a240a18856c9eff9a556219
SSDEEP

96:/0SWSeS7fFaSTKdSpjGdHdHSycGw5yn1B/KzLQD2QEVESHDS15SSdEgtSjH07uOk:sSWSeS7taSWdSpjuHZSycGwCQna9Sjcs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f625737335da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001d3a4874db91fefbbf2bc33a5d7aa76f027422b68879fafc226a7123c40ac4c7000000000e800000000200002000000029cae10b430ddfd586822c6fc022a5ff4ec38455af4345aab276498e1179f3a3900000005fa18d733a83d24dea0d20fa4b1d42538ffb10478163f05faec4fc0bd5445e127525a1af121fc567f2f684b0973a3255251164d89cfa81678cdcce9d34ad89f981974525e332b789d7610ec44fd9b0a706efd550779773b80d4f3bc44aa536669aed79092631ecf7c22d6b569d3fa1ed82a9c7dff922a03858402d1731138e4539fb484ada9e5430060fa128a06306034000000065d9588e3f6f303ab3a82a2dc91102e1037de824a4703805747036854155786dee1b5c542c981fd6dbfd3f51891b6f9daacd8a8f6d370f188a5ec4ec100239b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000058533555890996f1092ebed51e9fb018371f102bd027a3ad04d12bfb6925ab6c000000000e80000000020000200000008f89f5289a5a374b914c1d5d77bc41fbe5fd756708d571667b0f9a2ef6deef74200000001ac582a248fa32c4eefef103f51a120b333e3829c254160b8669c3ae856f3917400000001c2d13205c33edcff6c14ee5e529d7351f725b0ce329ede093d6767fc0e2503425d46feb8cb1a7b13e475cfb8f19a4c07fba639a7e67850517e5232fffa05275	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E5E6AA1-A166-11EE-BD45-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409479137"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2340	2224	iexplore.exe	28
PID 2224 wrote to memory of 2340	2224	iexplore.exe	28
PID 2224 wrote to memory of 2340	2224	iexplore.exe	28
PID 2224 wrote to memory of 2340	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0001-exploits\midikeys.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47255e005eafc2509d80ea35ff7a20ec

SHA1
3a4b3f67f6f4ffd44ef88cc79453420ba09bc770

SHA256
5f6380a4d2d834f09223a80101f583b94885c8c90311a4712cecb7ca823c4837

SHA512
fc87cbbfe80ae241b299e782dcdf10205ed4717315287471c68b21d7b61ee0b472ce5860c081954fd507c77c0a870f2356950c14227ddfbfc2c7b9c28a40b33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
772c1d0a2cf421145f1df6f6de2aa584

SHA1
056074b060933100dc7cdcebe8004b468b0de636

SHA256
3b608b3ff6915a21bb80ba1f37f882ff11d96c6d9a3b52a23ba928185b3a60e0

SHA512
610cfef6c1eda84c518396a67a83975901156872b164e5d28d042500177c35ee18f1010a0702bd1605b84d2a3a89b8ec4b0c1bb585725161a7e116169ec4683a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9e170f8a45ba291da5aca5d82c9b031

SHA1
92889f67a24ae27de0cde794439b82723ae9bf2e

SHA256
4b0d845ecd59346f25c2a1fe2f3af8cd0f1265fcb3abe9efec5f6195daa9e68f

SHA512
cba9ef9fe85a11cc416e7b1f836ebb9c953d22c3455f5fcb9e1fd96d8b82e74704a7bce500e199440b1522f77725e0b3d148d006cd2bbc5e3914de76cdfce5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2550bbd3b5c3d54ab13a83ba02ceefe2

SHA1
81e7652cb3e55eb68201195dca2c450a332d2c8b

SHA256
03cb246d1a3a93e2bd8a5d94a03ee03b6f9f78516385f7b24e4b9025b6b4d0eb

SHA512
c5509884a2a9876430094b4ff70d2d9c386f22898d06c91881bff5797f8b50b9480631d23b244df554f13b6f447053241664684afcda0156ce3e1460cf7fbc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1127cb9ca22e66cd702cfe39c5ec5be4

SHA1
2d52b0f6fcb65919208425b0870e0c44c59defd7

SHA256
42f701331659b1e3335d7e020659866cd4baf97fbc30f20ca7af7e500e832140

SHA512
6797d176a7de917104fbf4fd10744a0efd3a1808977360d9a941fd0d47ff08ffcec9c284e1c36a69ffd214e509dcd9b7bf3f8676fa9982fecec3b387a76ff101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
163ec0c6de2979a848808b18fac35baa

SHA1
c85e915b635d50b3f742f9c78d6c58d497887aaf

SHA256
202efd2ebfa6c69b50f6aa78a436c6c9f34aeadc22e48209d7990c1f469c8f95

SHA512
0e8b125e22e307e678542f14e7829cb06424e8b0b4a15f76f169b9a182506540a10fccba08d31904f69a6e3bdec4ab40f9d395890a3d6ce45ac5d0b8a8b88542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b83d36fadfeae4de31938fa2856158

SHA1
ba02d6220cf1ae2a66538f2133ad9cdddc612a06

SHA256
44956e5598fdb6ea3c447bc46fec06456ce81b34ff67c6999edba94525630cc3

SHA512
433d6cfd1115211f3437b9cc9ed6c339a96ba2ca7ebb5086c6213bc2518324005104b01894458e059c794684491d39f4f82f6753de15e1614498b2961dce776f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
881d5d6a91f1ec490bdaae29ebaa96e3

SHA1
c5d30bb2612b9c5050e43dfe8768b826fb7d4494

SHA256
072d915e9c6f2f8980ae22aafba6904c137d753ca041ecb0498c906d4b2ae875

SHA512
fcecabf700e6867b61ef5fdc935d0a2fc3440efe61798543b82e8e6d8b26b0339bd6a8176faadeb7f1712c037be789c656b3916ef7d6f3d2bfcad2ccf9a4d86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f7ca511415c72793a5edacff030508b

SHA1
cb149ae110889f16156baca2f12e3226e425b88d

SHA256
38a25ef563a0d23251ff62f08ca103048bab0eeed5bb47b463389f4c023f6e53

SHA512
73f5f62ab8642902d7adf1a37453da01608e283c5e3451c0393f6ec2a13d256d18457bda6c7ea07df4a579b103bccd3324fbbb04fa9b0243e566dd22585c7ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F27.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F89.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit