9fd2b76822e41c1500573f6ae5680915943dc7dc17c9f7240a0686b1df2c1cc5

Analysis

max time kernel
118s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Readme-˵.htm
Size

2KB
MD5

1a8bbc500c051a7c3548643ceff1e9d8
SHA1

4809a35f50d25818a8ffbb295d45399a65dd2acd
SHA256

733208a0d818e837762ae667c2d8ef0de8ecb5552c1f16561862a7bd2fc3ddb2
SHA512

e0f699dbf1c4893b9a09dbf3b0a0caefdd508d160ab6655dbce3b56f5ded0d1ee57f75e352890bcb982790f7c5b30e57fb2a5bbc1c0c7de4ecc3970bd31af61e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000090171669defc01cc5898d57adae6eb4a7a9907a3696adafa20df5a270c025878000000000e8000000002000020000000bbc865e556eb3345b7c140651998b5f935d244f8ccae52e41b6a9b02cbf1779a20000000b1b75ea1d28fc4a1553143707db3c6fb2e38d52da65e42efd592035fc479b97140000000200de60abfd49c00bcfe9469cd6cb7c9c2c5a7a8d22e9ff8de0b9483dcdc6c3f35c81b392c3cf1b850d05646848abed5eb29d1af744340ce9321fdf7baf81b16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007fd99e63abf29775fe3b7b41b65e66b5c20bb0f06b6779c155addb94582f321f000000000e8000000002000020000000ec75d5d06840c9aafa0821640e61c069e93b86d61a6968cec3ad8d8d79094293900000004a66637d8068ff4b72abc6e618a055d0a630b06cba5068947687d37bc8550422dbcd11f52025a3e46f1e2991993cf54ad835b2f24655e993373cbab0656d7a6fb659de74dd1c34550a0de3825d609a0e077cc7577dae834af9c7d8f62ec21aeff2b35b2c5aef52ac500ba981e820b42eb7e49f39daa5fe194aa2f39cbceacb92f53a0f9c27b772edc7c1ab70a49633144000000021b575f72981227d1eb73ed41f81bdf1028dbe263b8136da0b60e25ffa5f9cfc861084e0d37e27f79def9e983c2294cb09578bccabecbef6c82d05ffe076e3ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABCA7791-A5E6-11EE-92F6-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08e9474f339da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409973941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2808	2548	iexplore.exe	28
PID 2548 wrote to memory of 2808	2548	iexplore.exe	28
PID 2548 wrote to memory of 2808	2548	iexplore.exe	28
PID 2548 wrote to memory of 2808	2548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Readme-˵.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eea8591812dd654da9cbb073855a759

SHA1
97a787e0628f94b42e465d8c9da3784f87798f08

SHA256
39bf12f6a822a93192189e88676220b6b3ae5c7903777a80a977718ca3bd94c7

SHA512
e13413454f9f694079df50affaff376d3b618b55766ad6472f1c3907ccfbe6087502a644c79f7757e0d52cee7e9ef2a3ed2075e3ef24ab1c2894e4b66df4fb56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b724aa5003463aca15e6e02a9f0659

SHA1
1c7aeecd2cb962d7cd11b8d33b743f80ed3b2046

SHA256
f0d21026813f33b5ca4a5c9e2e6ce6e7bd6ee5cb94b521f48e954155af4454fa

SHA512
ce2c514de03a3b2d6ca8720779d0cdf8a92466a65b88a2da563a39b384167b9b9d6b16abfaf77c903245335f9dfc1acfa3414f2242922ae9f7a959bbe4844f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668033f00752e5ccb731b582da13962e

SHA1
c2d9c13e810299ae1ef2b665507d0180d19ed5ff

SHA256
59d2c7bb09b8c326f4f4f8d0a10e66f1c5341caa611705d905be88a10f62a44b

SHA512
d63341cc817f3d101548eb6741420ba695bdc3a95abb0f7d28475da096d33c4f7167c44cfef044ec97d4690b692515b257f54323a16af43790ec3e874900b6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3b1d01eff15bd57c6ac7ab889a47b08

SHA1
2cb19f5aeb8b31d94cc75028b6191fdbe74395b2

SHA256
d4a0e536256c4b6387d1e87812a02e07f8ac762496816fd12110c673d5ebe275

SHA512
19cce4079d7879db2228c070640c4608d323995adca51d8a6dcf7b3007d474449a3b16c02d510c172bbdd67c35be7fa3cf810f2798b4ddccdd4b3ca5b9bfd7c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
278f3eee547c13661c52bf965b4ed6f3

SHA1
3435cf89b616cc000407c44746a06e1d3c8e8462

SHA256
58538621c858dfc85d4cdabf5b9858ca36ea48a9dbcf3d1ffaf1f7b9cfbdb026

SHA512
8fb2085849dafd8a462175c81e0aa74b4d647b5f5e7e0273f192d4c27a980ef2a8f58ef63812d3c94ac39f4bbec21fd9a5bb02e13e054c56bfdb9c84c8873cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f109b582d1fc62e54d14d431b31706

SHA1
e73b28ae82004447e992137d608124d011e739a4

SHA256
abb31b2d6029fc1c479efcc2baa3fc3961d362953437afbc303d59c44fcd2151

SHA512
700cc24e229be50f558984b95fb473e27338d144a0df5e685968517dfb59395e6afc9d9f85a3f834b6236b23f5f9e8315451f233162d1038c6d4d1d3f08f1077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810dd242bf59b782955a0b2ad9b98f73

SHA1
27a1c55c0425e18cfe2fa9a1ddc717a5efd2858f

SHA256
63d4d11002fa9441003ccfdf0e8f4357102ff30ac9e9af59a0bb459cd54e8085

SHA512
e8eadf08b19bb12a8d4627eab1f9871ae93d5c4657a4d2e4115855c59ba45175710a44d557488dcce84eedb45c19521de971939e226da5fdb8157e0bd538b895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24d2b7a4c4fd515b90a55b7f3872d4e3

SHA1
d9eb5ce65302cc8fa1f12fc2aa198459fc9db0ca

SHA256
45a88840a89b9cb60efeeb9f8ee79bce0d524387fdc20e23e51c89944b05b4ab

SHA512
804b53c6b610f2953b1da9ca4ffda077dad54c4faf816ba9d7802f78d9e5ca65b03b41b9f710243fe777d23eb756c4acf421518c5bf32263f74270c561618032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82eaf0ccb3d6a83011c997bde4448b36

SHA1
813f5e1337a436d478f711df56e6b8c184b2f055

SHA256
7e8e9918a93c544a9701fc144260e24dc5a30d9e82477c44521571b07429db16

SHA512
f3e022c527e82f3a6de72b8fbd311e451b52956877493cf6c2eb1a93a63f64708358403d5f0775610f07b790e9373aa39541b5c6c5b87facfd60b5f193376ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b2bf9b1816368629ab68172b157c0a

SHA1
4614a9db89000da475178315c6df55b516cb56f6

SHA256
4a55207d720143eff03f74b7b8a40b875a79c9e786f62928eaeeaddcc1626963

SHA512
d6bb957c5a28325f02ad1b94ec0a4daa73cc4f32dfa774be0f7b3754c1826ac8af4f6cb8ecf3d52a633c5e5dceb6fb2dac7baf5704b6487ce2404cddcb08c814

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA8C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAAE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit