2169ca0e64a72930740f76f54dd56d0130e5ea6df1f4da48d6b37ba84d17ed4b

Analysis

max time kernel
120s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e3bd576c2aaccbb8518836ad76ddba7.exe
Size

180KB
MD5

6e3bd576c2aaccbb8518836ad76ddba7
SHA1

8f74c51b7f2080387b87daaf8f64ea3f60a35df9
SHA256

2169ca0e64a72930740f76f54dd56d0130e5ea6df1f4da48d6b37ba84d17ed4b
SHA512

4e8112db30a348b75087426ec34a56966ee688fb5a44e50ad3b8a3a5962ee669398ac5b107989c4d988f89550e9e6f489460a30a8efc17df6f4d4afe77aae965
SSDEEP

3072:dxu1k+15eiiiiiiiiiiiiiiiiiiiiQiiiiiiliieiiiMiiiiiiiiiiiiiiiiiiia:CiaGTP2cBPVaCAcBKs7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB566DF1-AC99-11EE-8DE4-FA7CD17678B7} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410710518"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	6e3bd576c2aaccbb8518836ad76ddba7.exe
2820	6e3bd576c2aaccbb8518836ad76ddba7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe
Token: SeDebugPrivilege	2628	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 804 wrote to memory of 2820	804	6e3bd576c2aaccbb8518836ad76ddba7.exe	28
PID 2820 wrote to memory of 2688	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	29
PID 2820 wrote to memory of 2688	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	29
PID 2820 wrote to memory of 2688	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	29
PID 2820 wrote to memory of 2688	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	29
PID 2688 wrote to memory of 2704	2688	iexplore.exe	32
PID 2688 wrote to memory of 2704	2688	iexplore.exe	32
PID 2688 wrote to memory of 2704	2688	iexplore.exe	32
PID 2688 wrote to memory of 2704	2688	iexplore.exe	32
PID 2704 wrote to memory of 2628	2704	IEXPLORE.EXE	31
PID 2704 wrote to memory of 2628	2704	IEXPLORE.EXE	31
PID 2704 wrote to memory of 2628	2704	IEXPLORE.EXE	31
PID 2704 wrote to memory of 2628	2704	IEXPLORE.EXE	31
PID 2820 wrote to memory of 2628	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	31
PID 2820 wrote to memory of 2628	2820	6e3bd576c2aaccbb8518836ad76ddba7.exe	31

C:\Users\Admin\AppData\Local\Temp\6e3bd576c2aaccbb8518836ad76ddba7.exe
"C:\Users\Admin\AppData\Local\Temp\6e3bd576c2aaccbb8518836ad76ddba7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\6e3bd576c2aaccbb8518836ad76ddba7.exe
  "C:\Users\Admin\AppData\Local\Temp\6e3bd576c2aaccbb8518836ad76ddba7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2704

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a651fd08b2f8997d4283a681ee0e8d82

SHA1
2db4137e2fc358bb8510300de81ad305b4dd6d54

SHA256
546f184359e5e29655351cfb706f8b498e84ef5cabca624965426e189450eec7

SHA512
eed952aab88e377b08c5a74bba6438b605230e7c121f0a640d70e23eac797917435ee3277b09500681849eeef0796a73db945b65a7fe06f9fd3dd4f9f98d9d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
adcdc92142c60a7ed5c32c71546602f4

SHA1
49d963b12167aac546d930909853026c46d6e9cf

SHA256
5957dfc485efe80be45712336d37030752bc95e89541d1df641ffd6d03cf20dd

SHA512
bad4644b82a8c8bb5e332b5ff64b26531ec5717f6ffc4056d523fe34abb3a6be6e082dde4e4a69785f2140d1626558cd04de5cb388cee2a43a1b25c9da2a4759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3849bf6ad26f59372d97a66bbc3abfb3

SHA1
4f579c29bd1a256ca6271e994cf326dd98ad8328

SHA256
c12ac6a216beca0428a5f079ff79fa15d861c27d7e2ff631a16caafa71f0f516

SHA512
1e3cdc60738dadc7bf72ef4fb9353570cf62a109914efec19b793d04dfa68865d3740813cba1eb55681464594a5a2b0cc2fed7e92e2fc25c182e27929a72d155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4e89b083286d34f588f4ad2e1208b8ee

SHA1
c6ee04a928c8dbc0883d382a898f08ca6b2b5cc0

SHA256
51aa52841d64368da97ca9c6b8895ad11e459f0893f653b9910bee3c49b5460a

SHA512
0ee85abf3fc2989f42b9a577ce13a9da8e7e9398ed84af9fe013fbb5cdca5cf121117bb231307aa7ef3952c8fdfad3ae39dfa32deff663e1c28f5d2cf0052ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1056c332e1d319eeca581be17320a049

SHA1
70cfbcbe00f4aa99b17acce761855e4352d163a7

SHA256
211bf4eee8a0ef911b169a9b9429c9fa7e387e36442b39c2e3ad1a48e99bb982

SHA512
2998a8f72e3edf1521f04cba8ddaa2bbfcd91212713367693eaebca0fab470426c6b0763e2d098b44ed0685890803457f0bcc997afb264ff8319f7acb2986bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8092373fdf3961b54c761822dff8efc3

SHA1
2c4c69747ac56f93859461419a90e15de429cb58

SHA256
48ddec5e43030e19e9d526625c4e7de4fc136629299c61d2922ef5b775a212b3

SHA512
2e466704919dae802b765c1bacba0263a692eedc34f795db6b69b39a6a498186842d3838ce5dccbaaa63e006862d5ea16e7b5ca5f8e46d67601aaedfc704b3d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2c6e3bac0ea42aac60e84c15f3744614

SHA1
1fffab3eeeeff4c008a923dc0c96eafea30284b6

SHA256
7a9b7afb04c8758ef4d28d687edceebd7b6dd6af80d351d851f38d15bc3d63e5

SHA512
c4eab9aeda88d610b6018a71555895024480ac3d24183a848624b8da8a64dbcb1ba7fcb93fc0d5a908990e4365cfd048699d3d4fd6486b64416000029a0cb487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
356b07baab286b282c9b3d153834547e

SHA1
8f0a3fbeebb1075791040e209e09f344f03f7249

SHA256
4fa247c7a1cbda93e882c02d6d73da9b29609d8bf16e5d258669bae901d57f45

SHA512
e0763c39211cfc042fdd607309653295c6ac2e82487776c324c2670d577c75f20cc8492b39345e726b9a2d3d9168e1bf6083a9ec548beec1a42369ed589e54c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99B6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/804-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/804-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2820-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-20-0x0000000000360000-0x00000000003AF000-memory.dmp

Filesize
316KB

Download
memory/2820-22-0x0000000000360000-0x00000000003AF000-memory.dmp

Filesize
316KB

Download
memory/2820-23-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-25-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2820-18-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2820-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-4-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-10-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2820-17-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download