82d71e9f70e93c6e90e68e69878299e31daa535258addd0dd94572252a260e33

Analysis

max time kernel
145s
max time network
179s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000fb27aa98182eb6aea2f5661e8d4567b35b0c288f6d1cfff38a18e02d33275503000000000e800000000200002000000022bfe2ecde56b1d712ac25e168bfc8457b17565c8416ac837ef1333bf65e478e90000000de9e8f9e846f20955b20d2e5f9b82b1e3cab9292e1ecfb3e5dfba232f30dcc1dc9fcb321fd62858e3289ac64561bcde3c206c0f6a28bb21080b12978b406e65b453b68c4a79576f4c010bd8cc55c2691b6335807f6faf4d66c5b49fdbc2f0c04842bd2ff399fcab0e103620b6a8c8d04833fe402c11b68b83f56a564590e4070b447ab368da28acac8b044888219359b400000002454f59c39c5d9c6bc5f55a6f2a45bf3a5eeec38a9f7c8fc49f354ed9b491289097a9f3adae9aceaa55a7612c163209cc600eeb06cb7ba311252254c6b059b8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D36C3C1-A20B-11EE-98E5-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b38046fcf6906daf5c08ad2f0bf680c5af79c97f66046eca99985ae43530a9fb000000000e80000000020000200000001138ec2b64fd490582a11c2967c73c06a44b37f6bc938ba4924fda899f4ad03d200000009d9f4b86c168ba5893c7be98ab530a97a03500b33bfd7c06f17a5c87bff61ae840000000daeff68ab67fec53c66b638e05d30ca837bfda7c880d78a3d1101d65c6f9913749c452b499a7fdbc947e4fc129f0add8b08f0dd0139e0f78bc0c60798fc63936	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e3018c1836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409550002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2612	2596	iexplore.exe	30
PID 2596 wrote to memory of 2612	2596	iexplore.exe	30
PID 2596 wrote to memory of 2612	2596	iexplore.exe	30
PID 2596 wrote to memory of 2612	2596	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jre\Welcome.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1717faa568ecc6a4199b7de1dad7a114

SHA1
bac5246270a1cc354d643cf2c4f7eb9db89e034f

SHA256
e184163122587fb25086c51cd98d8022c50bbe1bfc7fbcf56791f35192a03b11

SHA512
e6b7c8adea5ce916b0e41c0df68bd15943aaa4c3e5453273019c9dadc82f13d2f6e9343e281211b6b179e95775732a46d0f0b5a0baea8dd5e9239938acb2b53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907dfdfb5b9a08c22db2966f174adc60

SHA1
2e6cba7fa0d676d02509cfa110e67b005ea66734

SHA256
a2e766eddbd045a3152e796c64c32aa414378a3ae3dd40f2f7b1e73b5d36dedd

SHA512
5cf332fd177ab85bfc743a75ee82061a09cb4561be94bbbf62b89d590e24fe69b65c217336b90f7b9426cd6d2e02f5ce514713ac56a85593b92d7b42b0dbfbe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
978f48e46aeb911c8717fd15c08a784b

SHA1
bddbe7a99fe8d8dc558ac64b2a301be032d85d91

SHA256
c1560787b2b100aeed9a11f644455ead6e052012cdab694b9dcbb63103e0af13

SHA512
2224e02b5b045d0051481c036e56946bbfc032efb69e3af5c6caa95da49ade5421ed5463efdf0ff353c535fc0759bc4e4babb7ebd3f27c1aad2f873c9b0a8358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a1a8c647a2cb77dbd037df56f8ab3c9

SHA1
0d42adae006516beb5e8a67006b7b2460bbefcd0

SHA256
3b3d7bf57e6dad23897f320131a71b32c77739e8d4a35bef5806b60e8d296d63

SHA512
f7c0e3174153b0cc71cc36900f4b4bfe97367e9ca394cd4cdb4ab769f7c6d7b53c84cd3589d8e1416e6cae56f822badfe87f939e0c5fb9dd031a47d2178f2ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f30e6c796710472813057d3a30e800

SHA1
b4933b17d22d2885514d59ec465057ce2bfc2723

SHA256
9151f87fbbb5d7ea3293b0afa166ad60941c48505382734d5924adef6c916ba8

SHA512
41063e3f8e11947a207c3293d596ab3f4ed99ae4cbe4f7e263e8fe73e78c244b98a0b5872ce470ef5294a01bb7e4b9c6b78bc5406c3f3c306a760ba0cb6f11ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d2d7000eff454cf285e5cfe6e5f250c

SHA1
4c92d08f14b76257328e1e6da241cd339f236867

SHA256
e51234462679e5b55ff7798cc9bbb487dfc6215e98c37da6203754e06b415009

SHA512
93f255853749662447795f110634c8ed07881905a2c595fe2d439bf9893af6343b6da0709eff801341f05dd3124fb3fa0a9ef5d1569243b6be5af8ab0438368a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dba46101cc472f19f2be99a0d0eae281

SHA1
8d9b2db9684bcd288abd6cf7a562e0af22b35a0e

SHA256
e50c4efc39d5e36158d9b2e3bdcd41c1f0f10a7e3a2c46ee680cafa07f218334

SHA512
514eec423a0ac8b200d79585e339ae1c5f63f180f6d29601060cd93df05779c57862752701d5d6a4bf02265e049a85c66c34bb650fe0b46800eceaa0640e12d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d7c06d43a62c956274cf9d12067b54

SHA1
e1bf3912868a955f70f6aa30d2de77fd2f69b3c5

SHA256
a8d689e64655f64951e605aa0f99b3bb7a180f3b14a5dc2ad079c513882c3c87

SHA512
21cedb95d5452f88b2dbad6d1c9554b8cb1dab687233425414573f943d7c6db06ab3d6049cea6c060eeeceb9e9061c40853301aa92361e805b54045a45ee68d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
def7814b88dc472e3f1d2305c2b6888d

SHA1
03c5e0f5e72f3501e4ec17fb45ec2123bd2d6012

SHA256
416db1376702e4eb977f94afdcd30d43c9cc4d27804f79d35c12128779d1317d

SHA512
4707f820dbe8875d5ac15b80d7f49cdac38794680a70df570c22a6ae20e613452a1a2f11317fe4b7f3bd923a8d0e4a825b7567fbfb1eda974fa2417d1be1c698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b6a3eef5301fef0007240ac551b7abb

SHA1
12bd1e0400199fe5d8917cc32343cb3a37d04062

SHA256
0d01bc72f9bff1ca3221a9045eb56e8a8851aa71485a9221c4dbdff19ae060a5

SHA512
d168d80591c65caee727e911a524b81169ac7431ffc97ad9f51a117cc540b38c482de33f54f25f3d400d291eaf2356c268bd5e6b9c6802d264c963858401c58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab2eb280a01c1b9b0e4db0135c635d7

SHA1
b909e0eac842c418af01f04c4a0d76660721ce23

SHA256
ce0d71b46038bea37d7bdd4020926d65f8705d455709c89fcba128a75fc9b3b8

SHA512
d1c441a569c131418449fd392878e2d9ec40302da1e13447a4c31d03c73cefe496d0b62a7f95b62c46d8311b888d9b6805fe278a51f8c886ed718a816e4b49bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cb8a6c8e5a3a0bdd45df35224250f11

SHA1
5777033a6587fba9ef8bf6f8121af7ee44f0de0e

SHA256
d8122729ccbbdc8815b5a03e0432a8500f6fefb98b330b4a7afcc9b98dcd97a9

SHA512
6e24d8daf618d803abe8b27971d4dfbcf7f5482f1e2176ea41584501ac7348058e1d4b7f75a9899375d8ff4a97f8bb2970de1d98309747345469270a34d1bcfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53fd60f993842b44c3ec0f5a23d4987a

SHA1
ef817ab6d5e842645f8a7bc733ad7ff83a1f468b

SHA256
b54337a7badc79220dbc2fc3cebea22e51c02cc3c748fe6ad47bde026568e4d1

SHA512
b018dbf2596c46fe4de589ee95d7c3f046760a829d6d0d7ef0c893365001a8ba14cbb040aa0fc2459619470f0ea5b30521de925e360418b49c1f0f855b6c55a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3325f639a502d08730ce7ecfab87d964

SHA1
923b2fec1b54023531cbd5772a192ce0ed5690c5

SHA256
f9c801ea9f4eeb8976c7ff708c8ef4e6db23ec2a3237d7eaac1ed4daa2036ab5

SHA512
81f3e84908e6be5be7d6ba2d226195baaa015e0a17be314ae94f909a42a8ca7b83ba332a1a9a9b5a224e3193a4ee56112e11053028c17f1a35dc744fbdec017a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869ddc9abdde7d16a64abd6b7a97db44

SHA1
c73cb11e1c961707db6af0bd3782c5683155e79a

SHA256
dd66219fc2f4bddd63c9712db33356dd580bee2122c42af29f69de70916486fb

SHA512
094b217888b2170c430e96643f176234b1c08246d15ddb95ed3905a8de89594b1d7319c54f30922854cb23ec5dfe1ccdb2186e5e7773ac93b338a2de7957a452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e291ea8d56d96dabf005baa94c3f4e

SHA1
6a05c01cf5e7b923c2d57e9b14bde10a7af54f7d

SHA256
c3be74718e8888d1f75139b154b51544c02d29dcf15547cab68f29b485228df0

SHA512
50aa396b427ac530027efbdb8f683b817e0ae211f470172d32f8daf238ba6ab347784b25877e37f0b03e3524a6689080a9a4d402c9603d2d6a136eea6e22dafa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8aacf74b641ce46a67f5cf6047e88b4

SHA1
4d80fcdc661354a6cbf4707b86193bf627242835

SHA256
e1c52cd7b6d8f551c22845378c45a87a967eefce9dac4ed4f8e3a1326f104e2b

SHA512
a4a588ed479fe18dea84ed114ed9926a5f616616e774042f80dfa49016a4690059fe3174a0ef5157ae15182b1f62c906f37d4072972495245bd517d3f35560e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCB6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA5E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit