f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe
Size

8.1MB
MD5

dae051fd4ab62bb74035eb67b4607e68
SHA1

ec1a59a5bfb51398913e5cdde04e55f3252058c4
SHA256

f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af
SHA512

6e5c96b6b1ef296edc1997b136f4ffedb56bc531c429f576d6fd92d5dd71dcce7c661dafc89362b565fb036f60c9e205aa9c12b7c46cc4726e9415854f8b041c
SSDEEP

196608:YJ0fN/+MCkHI/wEHZqxYj5bwOE1Kj3UvIzU:wS/fKNNj5y1Kj34T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007a5036b112771fd22c96c9312aa385ff74b1dabc6b45f681c66c62d952ff939d000000000e8000000002000020000000a91644f79ce9895276f8f870bf8196f7bba7a6c8b1324133b564e290118855de20000000cf8e3670fb58fae2919ea40029cc176de0559e9d85d02299a31513eb9e0e7bbc40000000f3c7185231be5827b2f4dcf6a14ac1713704fba9cd4ed8f5350d4cc3e53e1d0b88fe886460f6844b0e8eeff457f5499bb48c194cb884f6eb635cd68a446841ed	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409745712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0552a23e037da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001f4366fe5c94698619151e5a8c42d945034a26d113620374117102edafbbe020000000000e8000000002000020000000b3a6cfb514d325767de3782ad073ee8a14e4dcabfac308f1f1fe245ddd5f336590000000c22ebe324926526143a3ab0df1b6db6969432dcb3e4fbbc827b1e00bcbba1b2ace93d43772f91e2bd3ac021ac44f2de9f53b9e01528aecc6e80139a0b890e471ab0732cdc7adc24e1294541e3b654ef80789bdde81fe8143b14ee70cb9afc69f5987ac00d7b958631d27ca04b9ebd6f228b6178b38d5cf246abab441f4f0c8347b6f25ec9b117c877d8e2649f9bf8fa340000000aec006b6d9a2280e116a117a439acedeb81e9093f5d51f6d96619f6e489dbedc211da35bdd62610f0a552458d73a0a958e87005965c3648ec75ded189ab1445b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E282F81-A3D3-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1404	iexplore.exe
1404	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1404	3000	f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe	28
PID 3000 wrote to memory of 1404	3000	f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe	28
PID 3000 wrote to memory of 1404	3000	f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe	28
PID 1404 wrote to memory of 2292	1404	iexplore.exe	30
PID 1404 wrote to memory of 2292	1404	iexplore.exe	30
PID 1404 wrote to memory of 2292	1404	iexplore.exe	30
PID 1404 wrote to memory of 2292	1404	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe
"C:\Users\Admin\AppData\Local\Temp\f31534824d32484e6cb12c5510024fcd08f4a1e85ec768f0a6d2e03471e803af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.25&gui=true
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d871e499386c85700753221f27193731

SHA1
97e65a0162b50715db69411f4f62ecbc165527f0

SHA256
3d6ca62fd45aa4f5621c5b5c1ade5399b50c53d3dfd2c796a290a05ce1a152f9

SHA512
7bbed45395dfea887e88ca5da73c63e686af7298fbf12a8b8787182c3721ce3471ac046b478d009a25782c126f70f7fcb2a42f4a3b7701d75e5ac4febf2fa6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d07709bfb932eb803eb2c0f525b1af43

SHA1
9af30237a6ae8c2d409b338e62fd887803f32b24

SHA256
e19fa3df94f3aa0b24def6ba8a8decf1003c907cdb19197e3aeb66b052270254

SHA512
afb4115e2a0dcee53e68a36c2f8b8c270634a88738586e65224499f9df677dab8834716443f6046bf8960105829c694ba5a8655492647c5a6685400a6bc30320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d704cc8fa4294698085c67090405f7c0

SHA1
42f9711c4b13db894b1e03ba0b1cec6b0c15317f

SHA256
ec0b493268ed4594b07bddcfc0794283813581bc74dc2ae2e3c8618c6585cc9b

SHA512
59b288df90f25f87252a8bc0d26be18e612151936a37f0421944ca5d81cf59cde1723a16d7d709cc42159dfb0e930328f34a8772aa1c0f764931b4206675ed8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9961dc8dea2255057fb616681f4a838

SHA1
4f0286d1c48aabd341725273ec70a0c5afdcd76c

SHA256
748d83dd2c29dd9d5f464ec6499709210b572b94f888a68bfb5f7802dab97b75

SHA512
54aa3ead1bb5c83ad645d86edc563b8205682562e2da55b051fca7445c16a4b00cbd9fb4980d77e3cf6ef1a14201c7b9e7375e462619061deeb4440e534cb3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b63e04ea4c35925eab7101493534a3

SHA1
7080330df3b81870cc4dd6648807339298415690

SHA256
7c07879497d0e5fa14c0fb6863489c178eb43ac07e79378c59404527ed33b371

SHA512
0dba111fd9d2fa621b221074a636a5bc47089ac7e718b7ae30e55fdca8d9b6fac56eb33b7fbbf9f5361b13a3c5a88a1014ebbf98167357adce6eb82c8ec0c03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42261f9e7b97e3c5aec1b6e0313f8215

SHA1
aaa9faa78310606d6259a59045d78c77aed48a1e

SHA256
2a6740f71ca9992e30cdb1fd566cedfa91d9b449b1a56eb6ccd6866098d067a3

SHA512
e50c51802ac1da84fc95a589294bac34106146785aa50a36a9846045f449fa8367f7f6bbe65d45f11baabc54fba2b233415010483d02a08465668404514bea71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c07e8c0a74263bbb03832c57af7070e

SHA1
6173038c4ea20799d93a7eb29e587f169d8f4c5f

SHA256
395f3e80552d23251bd9eb2c31162c39864f591f867006051653cb0dd0dc6637

SHA512
027ae0e1f6eeb3a2c7ec5b219b021389ea343afe71930b754e47d993a9c8d600aeb6ddf9a28d81119af15d5dbe94d7d3c46011c6f5d7934b7e699b31300be6a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a09f938a1d271340f87ada8b1e7f1f

SHA1
5771bfafc05c08c7d2f51c5215cf44912bf25bef

SHA256
273084df1e93e6ed95f48cb9f7124ea56848c2336dc091b7f00843fd660bc554

SHA512
b690713cc6afdec565d69720862748dc903e50bfb6e5df9557cb3d268c111837722c5f5ce95870734f7fb0893782ff6afcef19b689f372ef483070b70a454daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc9decb54309d9123ec7c907b7e67a8

SHA1
5533f284eaab8ea89d9b675080ba0a727449e66b

SHA256
e306b8363259d83df24d4b18f47e7a91c0c889fdbcbbc09c442dba0799441391

SHA512
24e800028babfc8bfa108c88e59a9efe1d5e0026a9f3f8db13329c00307d701e85d174b8f59d5e0b054ac113e0be78a1ba4e1edd6e2ed47035a8b7bae4725dbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e4d00b451359e995ba315adc8f5b322

SHA1
4009cb9ca3e3a03384320db20a47b85025792c23

SHA256
ecd6a98232e2e8676e8e021e896eca2d744dc14de14c8372aed6b825965bd3ca

SHA512
a599e3bea56343d105beee0c12c8e06dae1ef9214e9a48f41de13a6cda9702dc6aca78735a2cd4993122efae2a0a843d3be805d920c7b07006b5a31ad577c4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0d57a856459f9cbfbfc1519eef04ce

SHA1
fb37091cb0a8ec57ff8b7dba10f091b91921570c

SHA256
922f56dc587a5e614d2d354f7aa55f97c39b483980efe2ddc5395b5ae5cb6044

SHA512
f5ab9e17f31f3e0d949955869b71e8f1e30ddfca0a97fbadf6aa453cd59e33132d288083dd337eab19773fdcc56aa557bfb0bba0081afe96a49f418ae3d2fe5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17387a421a26f0dcdaa502bf348c4b76

SHA1
3e5a18360dc8a9269ebf8abb0fb76463bd7d28ba

SHA256
9da1774173727edbf9f30d20fb415ae434ae75168755f12299fd0037b1516d6e

SHA512
f8b98c311a7eeebfa603bbb0f4abd67e4befb2a8b4adcbbf79721caed13c595cec93e72a1f30c3f4b189abae69b117bb0f54e90b32a6ff1f1c675607e149b5ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c067e27e95d53f367aa4bcd1123872c

SHA1
52febced33aa7cfcca102fef442a9a50bb664fd8

SHA256
2be1658dbfd2b8f31b62bba2643e4491df6be9f6391f9b1ba566e1ade0f9d4f0

SHA512
d340f4ea53f135f9d1b9721dcd03bb8111695d68a22d821a3b20502dbc7fb8cea97336d69b3de4887fe1eaa89f02eafd9204ed6f4e59544169c2f7a48f9ba355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c367ed4bf7f33041b59f7c9e04c81d

SHA1
1d05cab2233df0d40dc537590b6c2fdfb9458745

SHA256
0ddd344372f5122dfd62c1409a6d19f7362b46f4713d8b276df0cccec1992a06

SHA512
1cf54a6ebc75ca64ac3bddbe16286cedb17cbfb4884e631b65d265bfc8cc6fab3502c1d66dce4684fbe5eef0387b2653bbef42820ff54df41e99abea070cdc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b854ba7634d953ecc41308229f1216

SHA1
dd8cdfe48e8fac820925af79b6cbeb7edf613064

SHA256
1a3c9ce8030c5045712d770714ad0e1a4c259a27e25e8d92e8bf0a82ad1e51fd

SHA512
7ac3053a8d3ecd2a8a5d39c7b05ab31f566c79c72b807c6c1c94c7215b2ed1d85e59dd6f9bd9c7961963f30e204b572c35a021ce20cc1d44f2970af4f080108a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE64C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE67D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit