f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

More/Utilities.htm
Size

7KB
MD5

d5df3ad04f808c8b16aca80393d99845
SHA1

e77dac88cdbfe90f0eeef497b5305ec27c7de921
SHA256

b93019083b733e094d7c6c51cfbb26614a3b03e43f380ac0b8367d1ce27b2ac9
SHA512

cd6258c88b97039b4ca78d5d2f799e4bfc5bbe3fbba854cf6165e275e1c8fa764f07bcc58c291b52a62a71c42586c76c45275dffc84c225b6877107a69ecf7da
SSDEEP

96:IShSyP+yeXzJIMMJ8D/rAfICnpKhpwbKhgbI:LP+1IMI8D/MfICpIwbKL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410546958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ca73a23a5cce30a86f92b8d82063cebd63c92a8488f526fe291a7811beadd456000000000e80000000020000200000000131af43725f82e37b4b96f751d924dd1c13eb0661cbf9d8f419bbb01d39769b20000000f8233d7bd935ee9915aa8e8a92031fa1c872e92af11874d8267ef3da78662c0a4000000022bf575dcea27a79d10668c88ac2b5ecc7911c80da85f932f27dbd36fa163f9d2842c56532b5692f22b1c25b33ec0b837a330ad1d9d4008c1fcbec014eb28e11	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d814ab293fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6B02C81-AB1C-11EE-9BAD-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001e97f09bc7d95e4af9644beeeb6ba45d2e5b1d7a2d253c0367a5c06856feb106000000000e800000000200002000000061909b681dd18422c7b9228ad2e0aca8524378b8baa8273eef9c6361afc89c6790000000e274eafc3920470cfa8508a01c46a11a6cd2be8c73f72e9d96ed62c741051900c579249f55c0b4d3a023e98423e79ff53cb1e06dcaa071dd79d8a07fa4af12fe6ee7374a3169cc8d9836ef80515466b7d6ad9c23215a1d2b1d12c3bd04912190afd1e6317a3ab6ef3dd8964f860ade24674d7ddc053ca479ee06536cc2c07f208f02e7d11c10f643f6b583adef07c46a4000000061f269437c14c494605b0e3d79766aa2b1cb629a7845a7864ed3c097179691266fa5a9cc3b51e22a810716ce0c75f33ee6ac0078d41d883a81cf155d9e079ed0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2816	2248	iexplore.exe	15
PID 2248 wrote to memory of 2816	2248	iexplore.exe	15
PID 2248 wrote to memory of 2816	2248	iexplore.exe	15
PID 2248 wrote to memory of 2816	2248	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\More\Utilities.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a0e37f5abae280d3fc74fc9bd3a1ef

SHA1
8047292f1d8b21eda2f90799fc3e795d5f98f99c

SHA256
b7d848f3bd8006e319b879a3ca83bb4f8d3a5549aff93a2aafb91c2dffc8a5c4

SHA512
79b2760d3818c7fe922562b422cbf054184feee36c1c667773f546bc57ba4cef9a09f86db5e6243e57d3ea6eb2854a679e09145939f010a13c90d5a4836ea3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ea2c9747fa47898e72fcb261a3349c

SHA1
3dc12c55afe260f9dabcb5db951fa6be5942f995

SHA256
f2ec4892364d082c04b9eb566aa98e5c03f031358b749b84214c007af656a9a0

SHA512
933bd9732789da2d416ff8fd33041f4b86cbfdccde21d160052dd1c92e811dc8899c362e6436ca4e41043c8e5153e5ade4df2c1a0d126a28d467ae8c43dc64d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
376bf0087860f6325e9a33bacb974149

SHA1
d604425797605b5980e7e3565b83c7d87ba388cf

SHA256
04fea13e0a74af612960a18070d70fce84c98c27c959ba95ec81272479d68dd1

SHA512
4dba01fab945c79ca9ab0bad669b013336adbb758e82f9af18fc04f001ea518cd0eb0777b38281807d0406a2d2cfa41ab03787efa14d615fd792347d11800a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
376df081f5303c80ebc5cc0184ec7f44

SHA1
8333f78145038da3115ead2ae4975f66f32fd84f

SHA256
b355bf296413d07d258d47f3d4546636754eea28ef7cd9a601e94ad21f99b15b

SHA512
c5a1dfd8c286d0c347acc1531f99d3d5130993d62d8192922a3a375938105fbe6b0b9103c864345fd4deb3c782ef76e60e7be60aaed1f333f63621bfaee12fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c018c97afa80a5d3821a9be3d2027d0c

SHA1
dbf2310b20a09d11ccb4d24f9c9bc8db5dc516e1

SHA256
329c813723dfd8b59f73731806f0da884fb97d3bb82f9c84d4aa5f6f8164a280

SHA512
b83780aebe39f1749d0bd7e58c8102be5d15320b2c58ee285b1462d8d7d40de86b64ef75d94af7e151fb4a0d43269fd4f47448ead28d53ed00d1225e1be5d03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
381a0d85290d4877d0bf094209b7db9d

SHA1
8d782278b45ca6ae302ad38d0305b4cd15fba89c

SHA256
b67e104352e8b333995dc82fb8ea9454e6aa653208657499dfcc16221a332478

SHA512
6e31d9c4392cf12334451144e9e8e176cbb20694a10e5d3f6cc5ff206a2773e3c225bb1b79c43827248940ede34c86b193b10906c85a2575296ac7d99a142177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb499d9a0ac7a1ba0516ef624a1231f

SHA1
8435086542583aa7d503205d96b043c4044cbc6b

SHA256
d15e6cd6d973d3a805957a0d4c0649a008a4021c244717c4e2ba42592804bb51

SHA512
ce37a6c524f96156d35674852bce7859678bf2fead72e08606e2a408aca54fa441ffe4caad61f3c71d0f10984594d48ebfc3244ef0f61171f7fad65af959a1e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6794803ee8c4aded390ff43b958fdb8d

SHA1
430f93b6c5840b644976192a68ee707fb1a997aa

SHA256
f88d3934c0a682db6e76df68f252ffd4e04e7116da2e527b31d17018e1865086

SHA512
4f271f1ff9060dd6e5d941d112c62efd0f9ce70cc52f4d50c3d78e7ff7b92871e46aba86a9a3ce410e201d1a9112b8cb939ad3ebd74ec66b18abe94e0d6baefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6134649154341f4720790a05a80bce3b

SHA1
87542b433966ee4e53b63f4c7726825bfd518835

SHA256
8ba9e42a4228bc1b8dd5baa6be3fd68cf5f6820d5ee414cfc6f9a8c61c43c0dd

SHA512
6ce08035580c965626e3d20798a79926b2349c71746faad54a201e95f3239e41080f92f2ca391deb2ce99bb284ebbd962b24dd020d982d63769c2dcf08fb5207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3319fde8b08646abada52e9734f8e50a

SHA1
26497403cf97283779ed2a95e4526a3d9410bf7e

SHA256
3bef5b56d6b00c12a4a893d963c7219ce280d33cfae6e36a3113ccd24563d4ac

SHA512
cf84d93b7f8e7cd1214ba6625aaa5bece3931d7cf5ab962db298d4eba92da1fa3b5929be010249ec26d8359b50e5c4d4cad5864bf9de16e37596143a0f5e408d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b8fccd78824acf7f07882c692cc8551

SHA1
ceeacad62108d5c98d6f0fc51d819e7237fdc9d3

SHA256
6cb6796816dffa602e2745fb1c044e7d56c6becf77be18c1e412a7a6d8690481

SHA512
3901fd52825aea7e36b676a69be4ee488db64d0ef6bd736721f386c2f2c41bf97cde3dba9dca87345d641b8447aa950828159d277e56902b6e19af2217200a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16fad87b8422f65df79c9425f774277d

SHA1
ecf723c551b1f859720140d21d9a60f671f69867

SHA256
33b630eb1ad7057e6aed1f5307d6721cc552897fffe5f5ec7fedb968557b5812

SHA512
8f0dce436b387d672177668c71228d8d87afa46e3a84a893ccfa2316de4445e518307988ae4142fbb3e7ae02cca26c291d3f23a477b5ace8428eee8efbac8401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c43d597d09ee7f222458cc09a509ac

SHA1
c6ba2a5a2e9c6733df6813180cce06fc99d7ecc4

SHA256
9f03cedc08dd3bbab8d22714e42877b68f100991b08736bed4a7a09e0cc7571b

SHA512
4648d1a8fdab77676a6bd98c2218737d32670a338c1f43b3363d6ce021d10a1acae93baec6ea1cbd69286b1303bcc1bad4077a0c84bd5536715c9aff84482f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4cd7c555c86d78c33cdb242b8fbaaec

SHA1
630454add25bd9eedcc5e0c6fdf16ae594882a61

SHA256
0f7cf63491bd80dc16c6e412102b7a034784fcdabc341f443fbc5f520ce53db2

SHA512
e86f97999fb5e6202387a7013d4a0f7933d033efdb4fb7fc44fa70e22d12b60b91b937d80daa2c5ee55144580d563371be98c91ca04ad3faf601ec176c4ba1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ebffdcae4fbb844a11e73b35b211174

SHA1
6392af5729551f3f1180ac8c2d6b4bf6d82d3cdb

SHA256
9077fdc6647adb14aea53cda715fac8cbf1d2c7b559abcb7601ab9e717dc3082

SHA512
81e7eb63cd6f417b7d76d2b652f1c166ffe024fa71b6465192561777df9efec95fa7f8610ed7b452a8d66abff83f6ef99259818cd0db89af6ae30fd4c512dba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2742.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2774.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit