4fcbb75178653070a4da248d3982bd65fa511b458d18993bdaefb14aff019fd4

Analysis

max time kernel
145s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f774534c798508ed6c2e2c0dfe7e0a78.exe
Size

24KB
MD5

f774534c798508ed6c2e2c0dfe7e0a78
SHA1

a7e10212c189cd74e41bc4ce51ac1f6394053e46
SHA256

4fcbb75178653070a4da248d3982bd65fa511b458d18993bdaefb14aff019fd4
SHA512

aea989f700cdf0c3e11b4da7ae02b35c10eadb17f647caf4f1035a304cd1dab43c6f8479901295c15fa568cf4c34ad087ecc8949edb3a58b8ec198ba3eba9cf9
SSDEEP

192:SpR8Ra9HOEjdr0rhRvPhQUQnXChItx8DPs6GZ:S9jd6RexQDPs6Q

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Outlook Express\df.vbs	f774534c798508ed6c2e2c0dfe7e0a78.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7026F2C1-AF2A-11EE-9B28-D6882E0F4692} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006f1c61296e6b3092f47a5bfa5f4bdb737156e5539393cfcd5f4489bed8d8b05b000000000e8000000002000020000000d649112207caf414b6f2a9d1a8c8c4088fd46904d684135c93d4f712a00904139000000043a9300cfa6aa8d12e8b15147e7724e48379b58526f8b5e333f2799da49a3c44aa8a27e36263484b491bd0a6cb408a164551149204f3e06733be1d039e7374fa554b6d966b14438de04dc2d5af8fbbc477fe253e9257adb1b8415ae9652f40dd3b4258d2ff57304bbeff8e2d6c5caccfed9e5ea2793c37892c4202036c47ee2351d1de147bff77fe805fbb709fba770c40000000a56dc0e13980a8c7ec106ebbb09819ce650c33405af23de5e33aaa22eb2fa9f74308aab52e66e57e6b6b6e82c0075e36960bd3a5be5a2b0b0d14b69dbfb43985	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410992605"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d6245b1a592adfd096519757bc900ff5555d56fed2e93860b04425ac1f0fdf51000000000e8000000002000020000000d9fa717aaa4e8f55bc4c5a555d50f8e2fa2eaa8993f0ee5d37840061f2ddac6a200000005e155d4e1a5a26a9fc9cd6988fa5457d98496b36679084d67f45861ff8f1233640000000f8531298d9f122a3a37e9474f40291e819322f18b692a9936a8a2224e29f9474d1426263d733cd3a6a761b58d35a8554809e944610a3bef678ec5afe959ce7c7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101402563743da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2008	f774534c798508ed6c2e2c0dfe7e0a78.exe
1716	iexplore.exe
1716	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2240	1716	iexplore.exe	29
PID 1716 wrote to memory of 2240	1716	iexplore.exe	29
PID 1716 wrote to memory of 2240	1716	iexplore.exe	29
PID 1716 wrote to memory of 2240	1716	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\f774534c798508ed6c2e2c0dfe7e0a78.exe
"C:\Users\Admin\AppData\Local\Temp\f774534c798508ed6c2e2c0dfe7e0a78.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6532f0849b7e68636b7fd4eedb95037

SHA1
1bee969285c595cf05b3d04b46878497918e4eb4

SHA256
3dea8608d90cf8974d0d2e5437dd821ef795aa5a1ac392d13d172a725230af1c

SHA512
97c3bb3e01754c1463818287adec7554dcc6be2aa09e98ab088dfdb464de0fe489f35e7cb1118b3983f0bc4df7b958fa5532c393db7b7c6fe64e515f1a4d4c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ded1a93175b9ca921fad84c90c8e0f

SHA1
ce5c4bf48da81403ca1cad48ee50617c63aac561

SHA256
c23e8e3fa851dc08d9c0b8817714646da452e7ea1927b942368569dbe7b88216

SHA512
48ceef67ec9a8a9629cbfcf775d59263cb0c49a1cb4267ee28aee459c678e4c5710036a1d80c5f38cf7c3461e1ecc2fbd8997ca94b2223fe169d95c0a9cb7964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb05a94488e9f57a14affaf70780463

SHA1
9ba26beb8c7037364a4798a836597930faf1a9a6

SHA256
179ca73fabff485b4522c9772b4209f58c7dddc035a365cddec0e62c59eddd5c

SHA512
d4c014cf81723a3c08e86299c0ff20e5043a0b662563c1b2158fda8b60594a4d09903c8b82414daee7090b849ede17357949a6dbce3f72a73a2843216c4040e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8c58e216f341fed4b71e2f97fb9c9c

SHA1
0ed64af681a2c3195d67d20f35a0c8d9dedea34a

SHA256
c56c1cc66692c017b06e6da3ec6a181270ff04b0a60d759aa338cf1461528a54

SHA512
b6e267e074b77741f5130d47c6acd996b60e7ac7c96719efa4e66bea4be6db2a3b3b74b88f362eb97c8dd08ce7e33057af543a00b3e972e79fe2de2feea286a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d2b1afd1712bd567d6881d86b3927f

SHA1
64a8884385f0a31c8d31581c3571c4d7b8e35cbb

SHA256
816b04bffab73b099f086c285e057cda2a4497eed1728abf6ed366b17c5a4c70

SHA512
52185044d716a30f451dd32307be41b65b429980b05259733e83e59e11f79167320bd2bba8802beccc881559ef796228ee6faba3457b9d85835ed4f2a5629f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ebbf94cb235aa1bbc45df30af0323e4

SHA1
de86de424265cc32ac4c1efe7331ae6b779d2dc3

SHA256
8738959564b510bdfb63d9c347846bd3c7b9c18a5304496d0002a93f495653da

SHA512
8c2360a9f0d6401f98c60ea42d8e60d7fe22b20ada46ad1c60b2c955b4cab132434f249df67c65b896a7a929f926104b691737457923c538c215edf5946ef0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8fda9e8b9524f9976370ac75c89214d

SHA1
4f06c70bc944a2796ad5b9d5b46bf750f2ef2fb8

SHA256
73fdd85e1a1f75e38758d8b251c59cf2c96a1199af70614d41f5e4b71ccf4158

SHA512
e272e0e925e524a7d7cbfc321d069e3cdf19bed9b6902fefd2288bb3e0be1b11120da0aa11b07eed68e737c1a07e3474e7c12c3f8f15dcc117cb48140720c5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049cad4acf2a4504ef6eaa3172be8d26

SHA1
1803bd60a9b917f4c73fa7e7e68e355de2cf50a9

SHA256
b80ccffd709c7c6164cf25692305de2c63946d5eee2e37cfcd7a0021f43446cf

SHA512
6c79c4cca48b2c51d6632410632d6b5e83a63e6b53cbebf82546b3538cbdaae39452dac4eb5a88b6f92f75618b8251374a847b39cbcf77b48e0d390463bb3ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2008-2-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download