b6e101c8592df8f89f7bb6c142df9ee49485557678bd75a5fd4e53421ba5e590

Analysis

max time kernel
143s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04cb50a67dd6941ccc95dbd9a72e328c.exe
Size

152KB
MD5

04cb50a67dd6941ccc95dbd9a72e328c
SHA1

499486fa5078f4ca140f8ae62fc2dbcaa2c3fd25
SHA256

b6e101c8592df8f89f7bb6c142df9ee49485557678bd75a5fd4e53421ba5e590
SHA512

ff604bfe543a93fbcc9dda4d06b4ac9a0acc7cd00ad353123452c7bb3090f12f0aefbe7f0efa3c2239a6f260d29c74f678dc3c7f6b4e7b858aadfdea18e99e29
SSDEEP

3072:3qcLf1+/PMca1dbZmuGblm6orlSODRiYcTBNq:3jkjsdbkuGBm6orl7RiNTBA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E14AF301-A6BC-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009919717d54958cc259e577e249080abc132ffb6e79bace2e21fc2a43f2f57517000000000e8000000002000020000000b92904ec12172823ca44bc62ada9d4965de9a167ef8683196318341408ce489d200000007b2e9ea35600b5d39341eb3c7180355147bfa2aa7f59d50e53647e8bfe11464c4000000034f82d1a3c46520c7bb72799bd2fee1a227e753449f66c9c0df93f2accc5966d0b6bd71e2e8508f21f1b09e047784f1d29ebe0d79b110ab70558a7105464e8dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000719b6a44a213e924152ad22e76fad8e5dc6547f689c760f383d4e32a75e16d4e000000000e80000000020000200000007230126789ad876190fc84de95a4e0f7318e3fe10e584560febc169f7c4b926c900000001c229a993cbecb8c3b5af5853e20199879b3e8ccd44488239298bf539eec83c69925800c520a8df4214ecf7ba6bc899f64a83a18db0da5a29d0c21dec81784dc29ca528c010cb9f809c9e8d5bc2a66a5e5999b5966f2a02be55be82339d535310edda89a7e198f0cee104ab89a53da588e96c3daef3992765580cee23074e53b9d8057752f86f21b7bc750f48e39606c40000000ac3ae4000eb4b783a890d88cce73bdb118efb10248d5aada6851183805090c7db97aaddeee33a46a0217649b67047217e956cd17f9aa1ce78da6ab84fc6ec338	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410065941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0198fb6c93ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2300	2100	04cb50a67dd6941ccc95dbd9a72e328c.exe	28
PID 2100 wrote to memory of 2300	2100	04cb50a67dd6941ccc95dbd9a72e328c.exe	28
PID 2100 wrote to memory of 2300	2100	04cb50a67dd6941ccc95dbd9a72e328c.exe	28
PID 2100 wrote to memory of 2300	2100	04cb50a67dd6941ccc95dbd9a72e328c.exe	28
PID 2300 wrote to memory of 2788	2300	iexplore.exe	29
PID 2300 wrote to memory of 2788	2300	iexplore.exe	29
PID 2300 wrote to memory of 2788	2300	iexplore.exe	29
PID 2300 wrote to memory of 2788	2300	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\04cb50a67dd6941ccc95dbd9a72e328c.exe
"C:\Users\Admin\AppData\Local\Temp\04cb50a67dd6941ccc95dbd9a72e328c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://gxbill.com/broadband.cgi?id=jÅc‡Q=9pc…&url=tièSUZ°åï¡ÈÃA-;º!¯½ãOC„‰¹&–zÊr°õO&nÔ,}g-ïA8 »¯ì\o4¿ûxF+†ÿÝ7þÙ=gS¹E%@ÛÇ‹31=¡í×ë_ä³wOînhE`™]ÎØÖ³/@PcPVÿÊ§tÛZý8Wª“>)Ñ»5[LT‰?òé°×¡ˆnA·/ÓùW<½l€RKiO_)çQçæ•$voH eþX8"’ÐÚÇÎ¥GŒèÆèjlÉð×
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
526951b2293e0ec6201207b4c8b5792c

SHA1
ad3d1eb8c4dc0be805648c35b9963ac651bfdf99

SHA256
993333a776b08ffb90d6a16c09c226c7309a90be7341b177f4388d0be7ff186d

SHA512
a9070204b0574a3965e474707d8baee08989d01980e882c63532bf55b5084f004e9b0b7a8aafa6626dfc400a6936788d956646e48c64b06b2f4711bed1b6ed3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5a3f94835ad092e5c8330af33414c20

SHA1
c1664da21515baeb47d38f068724fb3601b029ff

SHA256
765ec5cca3536fb245a10bab5109a45e729e7c3e57ea9d49c0dfd2a9b24cfdd5

SHA512
83a33ede1e94f323f5acf419c6b851b55046777d6cb34bafd85004264da32c107911fd39526d117b50fc462b3863bbf805fd8d9db2f97561bfe933e6a10eb80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2ad6f117a67958e74a1a436ae59d65

SHA1
68b269de9638ee87a9af06f475c5dedb6d30cc57

SHA256
1b06a9cfdaafb770ce13d34b47384ad0aeb7e2c54a0f461d258865dd7d33bc15

SHA512
14a39028497d0b9f34ee7c51a3328aeebf38a3c8141225ad2d81cfb964ae331732bb387280e712d753e966075f56318ecf00ab494697bffe73761fa9f070e8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28bbf7f833067d4acde53a6dc10e8f1

SHA1
8d3315232d12f2c1f04441ca6648817f76549195

SHA256
b12b9ab4b9fbdd5281d1b7c90321f2e3334acc228a1a1f3e9d85351a62717f80

SHA512
3f9ebd77ed063bf81d33abc811a99a546b011837755fcf8d48862d75011ce556077bc29dff4689bfe072de2184345b14e3a2929430ba3ac5a0d2cc8a42b9543e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
424d5cc85096b0f2277301b496a02302

SHA1
5bbcb435a11c702f3e992c6d129bbf02b00158ce

SHA256
b858310134b3ace2c631ad46aed248d5e22575a0a5e0b92ccb793027b75ca91d

SHA512
ab434989116f0c71832b9af992aa96fdd2f5495eaa9ee0c1b04a81e95c1cb281eebd4d1d9be4e1993022887e51daaabda5a0dbef6246928d9c88b689d81a3809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165452cb0e9bc76c87d2e43e690573f8

SHA1
edb26a632a34bf2d4f351cb7a22f2e63aee996bb

SHA256
1f7abb0f79039033b8c34cfb7dede1d3a59a1dec3bcb3529d80f97ffeba94b46

SHA512
a5b93c6bd7499806cbbeb3caa504fc774a913d2ead68deef96b575ad0c7bd415c74d806c30dbbca1935966c56b08dbaded9760fe440b1f93cc792e08fb56dd82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
479f9d022bfb39367eb3525f45567d55

SHA1
9d1d2329d2140ca38d2da4952f252935a289cd0b

SHA256
44f21f745f3427a6b2b39cf2bda14cb8672868c4bf000e2434a52c0de99d9cc1

SHA512
5a017db1cc028fb671c6ec2ec7c5b0fa44514215287a5359bcc2d120645d85fe288122ef23734619b70ac1d9b9e5caca6d69e94bb96dabb2bb7fc544eac85415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e338dd0f820cb0ce32f8f46967c6383

SHA1
e574fd9100356798f637829ac259dacbb09e80b5

SHA256
215ddad8beb5da13e0b8a9ea4292a447ce8c7b74f7de762b9ef3c2a06588e100

SHA512
0857aa37d3a2e62c813ddf7d25685b64e0dc27acae685e6b7554c91ac9fa154425384ff8023cc7c26c76b1866f19421d45f096687624f2d7b66cb8661d117b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8b11e629252c9f3fe47b1de62c53a27

SHA1
a5e4043f10b197103e576f3cd13001fe30053508

SHA256
b1e9f69e8b2622a41c0dd8487ba2445001e36ceaf2c4330a0d09c57bab8bc530

SHA512
0f798c0ebf3d50e95b9f54ce572bf58a92743674e3b2a700808c46cbbc2305ddba7b858794e57f55d33bc3d92b6034310f2f107358d43eb7e9f538a089f7e856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34dfd0b739987f63f85b78683f50ec0c

SHA1
3172e033110f51c16441b4236d1ac75688b89d48

SHA256
fa73f9460fbddf0938866a08bbb8da0674dfde350f9c15f06890f82e6636af5b

SHA512
bedead996824b2ee3838f413953c8234fe27e1d9b50bf1e4e6aade2c5f935232896547cc41426c6ad4151fb9d81884b5c1b6aeee09d978484dfc66ed917ac2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0DA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB199.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2100-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download