e820d8e1a967e2876d31974212fb04fd857160070094f943c732d9da533ff1a9

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a3a4adaf220b1e88eabc73a865a0ad9.exe
Size

163KB
MD5

0a3a4adaf220b1e88eabc73a865a0ad9
SHA1

ddda74c8a62d475eafce2bcbabfc0daf99e4811b
SHA256

e820d8e1a967e2876d31974212fb04fd857160070094f943c732d9da533ff1a9
SHA512

7769a962f8d73c3e061934ffbefe81709d2cccd1dbb6c33a8aef94d678cfba9bb0630046e918984d73fe91469249fdbb3e05e25fedb47bd2ce46b175f0cbf4cc
SSDEEP

3072:OQIURTXJsscv/q7pvh5djX4Qxmxh6M/g22nt05o:Os7cv/q7pvBdxmjFtqt0i

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe
2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000747c4d151fe6dbf217cb4cc13f0a373b844cfe2827b2f1849785ce36634d988b000000000e8000000002000020000000b360cb689724beda2b1fad1a71a2c41770ecd12c55266d11d12ac5e18d5f73b1900000003cac18ab5a9fe60a9d36832010fb0cac487aa1765b04523457f940c865044092ed81c3cd04b91d39319b9f882578f3e00d8d33b951d700bab80e0b52d63a6b81fcab66d6ed424c828a3310fe8463bb702f8be82c0fa9d145a1fecf34f55b0fcd9921101e3d11c1a3390ccd537348ccbc523c81d398b3c72084b4529ad8255b574fa8d5c90d2bf8d8c30adca3d9eb52f040000000bdd187951342c93ccdb99b22d6d8fee07335cd08c992fe55d56e710a06660b2263d2ba50a86e819fd80cd9087ffa9c5a55540b73c80abf769b005de538c2cb4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409645206"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50415321f636da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002f9c1802c49060af8474d27b6c916767381498648e9fa70c758a662cf89b5654000000000e800000000200002000000024de5fffccaca516a204610370c77748838dfcce71055d1f3558d1a39e66bbd1200000002c4c8516a027a6a47fd13cbd4a90ccab50cfda77a9dec4232e1e22779b8d52f9400000003c16533105b2dd441ba69dcb85e8f1598c45a38046512b6111ec289dea042f934084e934dff3132e608a474bfaa28f4b49648e0aadae553e39c131cf187f2be6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49F041D1-A2E9-11EE-9278-CE7E212FECBD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2544	2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe	29
PID 2824 wrote to memory of 2544	2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe	29
PID 2824 wrote to memory of 2544	2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe	29
PID 2824 wrote to memory of 2544	2824	0a3a4adaf220b1e88eabc73a865a0ad9.exe	29
PID 2544 wrote to memory of 2476	2544	iexplore.exe	31
PID 2544 wrote to memory of 2476	2544	iexplore.exe	31
PID 2544 wrote to memory of 2476	2544	iexplore.exe	31
PID 2544 wrote to memory of 2476	2544	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\0a3a4adaf220b1e88eabc73a865a0ad9.exe
"C:\Users\Admin\AppData\Local\Temp\0a3a4adaf220b1e88eabc73a865a0ad9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dl-xvid.org/firststart.php?sp=NO&xvid=1.2.2&s=12076&data=
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3e010f20ed022e73bfbb1b0e474dddd7

SHA1
3c104e27c300c6f6786eab27d00c7a7c07abfc18

SHA256
2f043b9c49ae83a333f413fe17125773b17f05ef04ce38b4435eeca549c54923

SHA512
db353ac4ff7deaba44addc197f4663d272e91ad76ad135d4e8ed9d4119dc1799886ffc1225665194cfd61db9c5c7223f4b807da4ecdf1f5d63694f83a635369d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0299d0760d45f49bbab24a22aeaecb70

SHA1
e833dcb18868c9d425794054ef2f47bcaa48e8e5

SHA256
fb92c971e91911492d390bae51d2371b8ed8dd0aa148e84ca720fb27a4cd9726

SHA512
ba72b5147f385049a0654b61aaa884e7b0c9f271fe171a1da43145f937633e0e7cf9523a8d4a3840f67166ac3216b2d665302f9d088db0c4dd762e939a705022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb2bd9b2f019b25edd71feebd084660

SHA1
41c283b59797a615067ed61dbc03fa130ca45563

SHA256
133159520f2ae5746ddc65c5b0e64b77b695e071626c1a5d5c561c638f414d01

SHA512
02d1ad79c51529d64945d2d83eb5bc2464ffa0f66fc45ca512f5ed2080402b0974e1437751acdca1b07ffdd7a53448604374b21128e6999c5033a0cb5c5c8e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27259429a3b0e303f221768ca33850b

SHA1
305e2ad79461e945cf6f29e76f1d2a150f6baa0d

SHA256
f86ef0ec0b6c3c139ea4faa130011e9f8c4c49058856fbbfd0a7680f79522444

SHA512
24a0494d76d55dd481ec7555e764ddf6122f940b73cd47ae96adaa48c082c52c0543369b6cc74a1672eaeea59fab0e74af2ac0e7f0fa2d8c92e73d389c01719c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde8c74d00b7acd3e0a4307bc4cc6f02

SHA1
46c44d443bd0f89b1d9359eac5e2d4926d01a7b3

SHA256
0c294decd0a02cb9ccbd427aabb485b13192731861bec238245da5e1edacf17e

SHA512
37e00565428c5175c406e1f07945373fcecc772128ccd4e23d098bf707777f061de8596c1e959aeaba42a1762e639d3de219567a73e1f9ea158a646d94e5cec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf62757cb40b05e0ab85a036baff29aa

SHA1
d51f5455fdd0dfe97b0d7ef3f936d93efc32b5af

SHA256
f9519a4f5d90a1d0280e7f1348a309c600626de834fed10c486c0efbf8b17c1a

SHA512
79501850fa599678357436fdaff031d7814d41530d923e4f9b2804ba971dba4674949ec593f70124d19083f28559c8d595d5c2696fb4d77865351114aac543e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a58c89f33cf5e7cb3d22b91295f44f09

SHA1
b2763b762aa1b0b644ad4b4cd7961b50029d3ade

SHA256
903d85c796359bad762e2e1428c7ce4cef3feb0a065c8488f6d477b13de373b9

SHA512
346f5eb2e30efae83d6fc5cc35ba8f173f5c7e411a078579b0aaeb73ef9ee7875ff8e1d6274100164e022882acf95da1749684be1811607c1d2e98717c5f7ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F9B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE36.tmp\NSISdl.dll

Filesize
14KB

MD5
88bbaee1059dcba83cce60777e90a423

SHA1
a0369b986bed181c9cbd70e573754d48f7930119

SHA256
19add6d77910f00709d52d1118765d9117246beb3d40ed227376e3a8380f8307

SHA512
9d6160ff34c6a7c9e91102374abd6611defc9588c7ce7dd8238d4023b2db79ff127aad9dbbffae68651de9e8206acced33b9960ca4a21eb7e6dcd6aa8c39c805

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE36.tmp\inetc.dll

Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit