391ca9f54962dcc58280899f6b1d16a0b220adff95239e3ea38010b083a183dd

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02843aaf1ee356e8c24a7bcdc1e1f588.exe
Size

9KB
MD5

02843aaf1ee356e8c24a7bcdc1e1f588
SHA1

0fb245207e78b56a0e9605fb80e3d775ed3846fc
SHA256

391ca9f54962dcc58280899f6b1d16a0b220adff95239e3ea38010b083a183dd
SHA512

f6e0f0534a1d82c7c0b78ea896569bee975ce89931ffa6d9dcc49492fd2e75a3d7c0a03fbdf4867e9b4f5228673c20bb366cd1f02309a490519151ec56dd1a9c
SSDEEP

192:SLn7K+UFg//ZRmB7xx9chH+2KGOaqWVzGsIfyUnx:qEFg7KK9NODiAfyU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{383D17E1-A692-11EE-8A73-D2C28B9FE739} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410047618"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28
PID 2212 wrote to memory of 2356	2212	iexplore.exe	29
PID 2212 wrote to memory of 2356	2212	iexplore.exe	29
PID 2212 wrote to memory of 2356	2212	iexplore.exe	29
PID 2212 wrote to memory of 2356	2212	iexplore.exe	29
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28
PID 2660 wrote to memory of 2212	2660	02843aaf1ee356e8c24a7bcdc1e1f588.exe	28

C:\Users\Admin\AppData\Local\Temp\02843aaf1ee356e8c24a7bcdc1e1f588.exe
"C:\Users\Admin\AppData\Local\Temp\02843aaf1ee356e8c24a7bcdc1e1f588.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c04f26a8e9ca957a2fddbf49cf70cc

SHA1
0e6fab06e035d4bdd82138fb22530c9e68d281fc

SHA256
6eb7442b19844ad416acb80e5a1508925976d2bae829d643e386a146add3d130

SHA512
7b05dbbc5be3b8e200409016b568638d559338ec7d8b7586d32308e7c0b519bc42c5aaa703ff5f8e59bd375c6429c5528e287517ff8b7dc540bb51223a1bee8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d37377025c71ed56c8a04c80efd8ffb

SHA1
5af1926d1d862f3d3bdd33afce1ac88834b513ed

SHA256
c5ca5d8292788c86331c2cdd29a82d87f0f09def44671783abb5186d1b011b29

SHA512
a3640986ea3f9ca8f56b3390fc2dc7ab89cf861bad20248b8de939354b8b804712b3e5b90ed3a4b934b003a4b8bca60a11a24bb1623bcb927e38f0160355e20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52cd92c8f832fa1fe780bf4843ffdf2f

SHA1
d5552a6b0ab9e517b97204c8ccbf18b4803c689a

SHA256
a2968810a6b2b3eacbcea037ac658a0d228756a95c64ed4bea8b42b5d1af1081

SHA512
cb1d89514667b55e37ddd58ec28e3c4919d6888e93c29c92d99d311f85cc6f5d5143025f991171e134e4c6fcca11c4e8f0ba75a52e323c8ecf82c29bbade9526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3bb5b82e3231922ccc618acb0c43d4

SHA1
95561621bf327453674fcc30ceefe95f6f343f4f

SHA256
42b5c40102fe68f49eb580ae76a3531efc7ac36b6ac59f060c64507755c49c4d

SHA512
14f39c5f4f73ff346b7546c664680853215a7f6afd9ec4aec7581fefe89e25ed17915cc37ab64de68b65ad5e7c1982416be2f8627bbdab3d8283e5cf9899f7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f29b2179e8e8cd1861e4e390fe6b9a84

SHA1
3e05dfcb3df1046a00967a88106ac2e0585ea3a3

SHA256
483546fa4051d21c12487620a08e91b7b4716e5123a12af9ab98eba72f639db2

SHA512
2230987fcbb8d4d597a9e7a7fe2456bc71288467b8f65a1bb807ad5dd39bf5ddf02ff7cff81c83abcd7dca4417de96c2b19b07f29dacbc6e9478beedef19d185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81a2b44d21e739f343ebae613ac31c1

SHA1
dc7e4b351659837efad9ad7ac34eb95f4d624ef4

SHA256
959d1a5c566faf83bedea78d41a512301f63febabf5b851cd40a4921ca82f21a

SHA512
46478f4543c13ec91b1561bcfd4f3e1e69c3e31d2c5f8cf25e014002b7d69b6c82cbf9528dc90c5df9cdc716f3e70520ec0cf4e5f6694eef5ec193c8b3a72458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0653745c2e52e10bf2742d9b4242644d

SHA1
445457ec6d6ad22e3890d0142afde59b3de57ac1

SHA256
372efd9d4d696a40e794579fb47f7b9914e0094ede5c9ba418ab4b31b6fcba3a

SHA512
a0d8ef890a20deef36ed550de9bc5bf47c260ff58bc78cb5a49a0c5e65e957d3b2ecca57a3227705d1585bb8333ac4224576709cf6dc1c2bf52440a3e4beae0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
142af3e83df3f0d9a0f33280a4e2ed8a

SHA1
2b80d59d7dbd003ab1f201c9c066697ca2af4266

SHA256
cd090c26c45d039a1d5880b00e728c531540a63a088b3a1b679b87f9d2f9702d

SHA512
18a1a84c3dfbd1cb36c8bab5b5f960119dc57f598ae82981c95439f4088ebcaf7b21577e7dcd3266feeaee88d094f870938bcd60a228275dac31cae39b0e77f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22F2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2660-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download