hxxps://miserablealignment[.]top/72a3XF9ed39mf0dzXFVAAFRPRH5bJRZLXmQQDWMfHFcMPy44RQ8SHScyHFpbDTRVRT8UVlc1NBYzBlsCEEsLShgK?eidr1703492866145

Analysis

max time kernel
159s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://miserablealignment.top/72a3XF9ed39mf0dzXFVAAFRPRH5bJRZLXmQQDWMfHFcMPy44RQ8SHScyHFpbDTRVRT8UVlc1NBYzBlsCEEsLShgK?eidr1703492866145

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b700cca587d73421550050e993a9dfea106a1e02afe663d2b21fe87108058a16000000000e80000000020000200000002795c2dd0b8f1956eaa442e0e470223f3a1ce4c98a9c3d189aac1eedd40238232000000057823f25f132d80248ec3548d802803307ad97885ebfa2ad61b772741b75af1f400000009a2087f7fd6d6542ea397b382b5982c4206472ef0684a57aba3d2d5874be5745de52b57cbfc4ed12605d33d8f614a2794a6f47dad76967c0ab6d708570b29189	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fee37e79c30525780470dc69ec4ad11f55bc6397bf78dcce331acf7b29d519f8000000000e8000000002000020000000fbc8e60484871add9976773365581e7f5838e1cdaf556d4a30ba77d72a503920900000006779f8d81b3981485f7414a3b4427f8b72d28338eb864646b04c3a9083da182a807989ef85e97db97fa7ec0b3482645bf9fa995f330494af5674d5227ebd9dc73cd9f625a7ef196d510561b07a0b149bd83416a1ae6b2326f2641433f06e586ddd635103641422377973a1bce075491c765646632e6a37226d2d518893f4a67cb254793c5e88b9789dd73aecee4f4c9b40000000e0a6ee632de38ddb1f30ac210d6168031df8c114bf75788c32db4e3ff01a2e8a889856d2a7bc8a4e54e1e467988923da98720a697d5d26f8c8f39e44814c8669	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{412603D1-A322-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409669672"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fafd1f2f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1328	iexplore.exe
1328	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2712	1328	iexplore.exe	28
PID 1328 wrote to memory of 2712	1328	iexplore.exe	28
PID 1328 wrote to memory of 2712	1328	iexplore.exe	28
PID 1328 wrote to memory of 2712	1328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://miserablealignment.top/72a3XF9ed39mf0dzXFVAAFRPRH5bJRZLXmQQDWMfHFcMPy44RQ8SHScyHFpbDTRVRT8UVlc1NBYzBlsCEEsLShgK?eidr1703492866145
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec62818bf6f33301191d9113ae9a5816

SHA1
afa58781e48650d1f3a28980c5e43e6146449356

SHA256
ab86b23dd5c91309a4b128f871e629fa1ac48fb92090aeaec164c8ce16e8f519

SHA512
2c15b2a820070adaa07cc7a8127c41200990968efb26b22d99498815383ff59facacf94e8eb0bd5ef5d3b01b66b743ba51950e45b91460640e62d46b132be9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f73d711f7fe21996de89ad31509121a

SHA1
acac0e23058c76d895dd2c941e254351b58ff2e6

SHA256
360d6f1781e02dcb886d539ad6d77f9aab50a32e0de614570fdea19481c8b821

SHA512
a490366ad2181eaba543a6378c2c9e9dd44309bfacb6dacf155a1d5d4cd9f7e1649073fb631d6688fbdb12b55525b798982f06d10ee2fb91f0d14f9034c0f38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73a2ced78f33a85c5d26e35eb7bb966

SHA1
c5691870a99821280fca5d238080ac31b1edb6cd

SHA256
1193280ab22b6775c5295c6b6f07bd299454efa99e71f69b7213a7330e7df960

SHA512
1333b2029db910e149c7e3284ed4f47e6e32d289b94f02c70ab2da85bcef432dfd260209155d6559bf4c895d647a25272388ec4a307c541c96c71e3b32d1eb41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86fb98a51a2bb91928fdc240bdd21401

SHA1
67db5f231c4d3d521fec128119a2a45bd2adeb57

SHA256
8a06f1b83e4b3b9633f337ae619b4d451ca27466d4afe68541567186b064801e

SHA512
eecd4fcf413130555015436b0446ae2a881450deb13cbea164afac2d423cc3a1bb93ce7b4907e9838cd39b4efaa39259a965e21b0f560d81a7a37d5bad2652db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61bfdb8b315dd34fba4ad66e1fd0680b

SHA1
38cecba4b08f9f942e63d124aab05ec440b3021c

SHA256
a0a271ba6dc192f140693d44a5dc9be506d7e5275e78ef77e112f6d43e8dae0b

SHA512
1681328a17a8e0456480b950eab85ba7e7fb3b95b66fdbf16885433de47153daecd2a290ba6d09c2979fbfec4d51174a65e88823dd630fe5a6cdeb7c90a3f69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09eac9dec13409bfc1459742138f0770

SHA1
a399282f605fb0b79a31fa3d2b52926c0bf9be7a

SHA256
291336438c308c4ded30b836615bbac5514f912c0b40b007e66530d33ee5ed69

SHA512
84dd5a6e2f836958324d11c947ace33e15771d4426f06d290213d3a623d090ea6ce40c3bd751eecbefff61c6bfb5517390f4f0d38de89078a73d410d87f3125c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46c2e77ecc686bc615ec09ba18014d33

SHA1
2489182bd612bf929b9e65d429cd5ca3f11c7df4

SHA256
008a5208d238b48727597741f1e7b86c0c8807cec7659893fe3229d604272496

SHA512
bc0857cc3c7b4f53fbb7b40c83f50487bc0ab0f2b08b2557016aa82e05fbb60d584d2e5051386d529205fa807d379065eb1804a34b911d6b92e5584e23d3b335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810ce41744bf57a6394e5ed84a721c57

SHA1
f55ace013c02e301e75f76c4401aa4c37c25038a

SHA256
2bdf8fbf0a1ef004792f6b253ea5360e6c690c648ebf3fee6765fb62e07c1558

SHA512
25b4de64815a341c67fec4eefe5cc597635ff715d721873fd7c918888990fbbe5f726595985af4c6c291692084fac7ea7921c2753975af7d885e8338f872273b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aa33039b54ac40a0aea3b2199351090

SHA1
c7a18432f6047570b48635aef147d61ac1d4957d

SHA256
41bbdd8ba8869799ef7643f9556066bf525e1ad0b6d808231f6352466044de66

SHA512
8c42353515192b22fd08c9fb76c695e0ddcf76b601eb4b1f077307c91b000ad1b2975124ed40da58796cabf3565609f8f48e86a278b43389d18b6e170917ee8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee09969fc88745a60586b22fdbae572

SHA1
2f61472febaf36184f49258a0646a95dbe44f2a4

SHA256
bba80ce1d9513ac1c9f6bac8870e7fc95f94bd57896a714af694e5e536df6bb9

SHA512
35faa467e85df3b7540d4abb5fc91954597d12c1dc851b41f3c2796cb0394ad2d417334c87c2aa70adf5de6165a529b2458d6017821f7d636bd6dbbd146d569e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30d5859207f9261d708d62356f9c3d87

SHA1
f050e31896db104cdac98a520cf50dde667bb444

SHA256
346916fd24fda2f082a4013497db2f70c190f4ffb97734ee080c17cf13a10f91

SHA512
798c1d639edade80dd00a4eea90b5956ac50a944548324729b16d5236a88351c2d85cc561207dde4b505e386b87fd9ee951905cbff5d4cd84d5c40d45b91f99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bedaa831e610838d1de028796263f45f

SHA1
72c75dbb1e527c26c2261a051a2c86331064dbe5

SHA256
843761792e6ce092161f443d5549167a4d2d01a13a1517e8751e9f321fb0caa5

SHA512
b6c475c6d46ac0fdd969372ccff999bbe3e0157f1f145b203971e67023dcca33dca2ba97a18735e115b1f68261ad1a078884c4c5567f8c70a5425ede95290ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf6c21edefabfd83438cbccf8d3de41

SHA1
153d6b4f6e5fa778655a7028cd6e9f8de967dbe3

SHA256
782f86e582971be4d2f17ba30174733d2d0de7619ded4c52eccaa8940678e813

SHA512
04d6c5b3dc4307c158615a54a6b68ba14137cb5356dc8f330490b76d052a5c306ab21261b0d79ce39911e7e00702cd55086c6614241ace7d68ca68da92c2a9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc77de5b74cc906ea37fc247cf861434

SHA1
775a3f5b51e1c9cbd98152f30172010cb0265ced

SHA256
c6860ebb16f3168685e1fa7b86aa456ec7d0d9e564040125809be6aec892e994

SHA512
540778518310c9e4babbdc91513d26b43bcec9f9b16130042da1f0deb926362746c61cf69fd8490bc05b6a33b94c92247c85968d92098b9d9658883732c881eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e823a5b5ed5fecd1099d659a180aab61

SHA1
8a5519a51e6523a1e9b57d6527b28d1fc5dde140

SHA256
c086983f1cbcb306cda94841df6b21db40134609341ac596c4e20d0ce776e243

SHA512
b4ee41ce70f1b68eefeb6d91f7227a96aceac5cb3df7d14531a2cb4b860abcb8617e289b8ae4e5124b18c02387350dc23b56de8e2bed8d3689b2fad2c16ce8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed1057588a14671d415ae45474b166d2

SHA1
00447a2fe27302e5622707faea5ab47287299c88

SHA256
b7e6a536e4109e5bfee5c3b4cbc53b8d7aba1f8666bfff99420d780398c4df74

SHA512
807fe9f739394e780753a3a88c09bf9b0723f9a396550dd8dfbb3a1db518c5226c00b7f7ae964663d3c2749ab5748b3c5178042cfa020c08fae606dafd7fdbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e47e7a3389198b48b56de195f7af728

SHA1
4f02ef48d47a2d3b718a8bf816028121df20d75c

SHA256
aa5ab257814d8321e9662f5454b80ef286afad70e60e4eccb9aab6dcc4bfaf6c

SHA512
4693d44048e846e72872b775bccc5782dbd273f4db8e1af5cd2d17ae0a0b352e3cf80049d9c6bf62c5ff6108c4d040cddbc4431d48b4ab3d04fad41f7934cf54

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC61F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC641.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit