f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15

Analysis

max time kernel
174s
max time network
176s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

More/avifixer.htm
Size

2KB
MD5

2dbd97f120c51917aca34a7e50282c85
SHA1

860fb689cd3dba9403c586e4f1cb67ef4322b35c
SHA256

59c5375383cfaca93746b9e0b760f48a8c6de5466cd2727a813b6562644648e5
SHA512

657eb668196630066cc3c9c3f86bdc8d1519345b7bcafff6886e7d123d39cc230db687da765e1527dc16b53655ef2fdae847a86e1e6dd7458c1d8d777f057c9d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f44b481f6ae1f3c07f6cc0b3ae947cc7933872ddedc63d0fd24a1688065af231000000000e800000000200002000000038733c28ae784cf0c231024e763f1e02a7ba3fb88f988f47110e9dabbed062f620000000eecf919ff0c2cf07b1965cea79c1411bfa42551e565a090c35d489a8c7cb3ef94000000076154425ad9f9465e15699f64b78d5318a0afe8aa82df6d2ee10d6ef48c78830a75c68d6558dee273c7c38944ce85f276c1605e97c911f4ecb6ceec96d50699e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1ED411C1-AB1D-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0de34f6293fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000099d40adf3bb87845195221cbf25203c6a452a66b3e35ac8b1bbfc3c495cc8a79000000000e8000000002000020000000122eee98a2e62b8527ea7974c94aab7d9829368fdbe069bc29fe59ec4f7bd12490000000f801aea7d8ce9d30d7f3afca268c16242bc0386f908068c827274de847c5ad5432d892f6bdd699f37b3fc6abbe1fbe57dcb74c2e11e8ae294e7d6c37a4af89ba3d909f18937feada0bfa4a003943980b1816462c5804c32724732e1aec598be7d18ed992585a50e1bd85818d30ccaad9cc981cc9da293910426de62cdf3ba84b596130ab76663f289c2c9148cd011c01400000000122f1e9e547e15c837fca276a98f00b6726ab6d27a7dd0d04a1a862e754b72a57167906ec003a7af8813f22434c1017878e5f19d800ecb1e5646cded6ba99d0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410547079"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2604	2480	iexplore.exe	30
PID 2480 wrote to memory of 2604	2480	iexplore.exe	30
PID 2480 wrote to memory of 2604	2480	iexplore.exe	30
PID 2480 wrote to memory of 2604	2480	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\More\avifixer.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a41ab163d5dc3f2694dc234358f327e

SHA1
29a97115fb9aedb5d6d8cbdf9f1ec19d4bb8a975

SHA256
3474a902a50949d775c13589bab37e3acae5c1622a9278481fce25119f809770

SHA512
32efd4a72ca9fa83c0810fa8cce53ab2b4fee6b9792ad358288b9ad22a8ae874d42263adb5b3fd921def98ddf783fef356f4dfe1cecb03c0ca6c1da86bf172fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546f7a0b533ac08ac736719a8dd903d1

SHA1
5201b54440fe34ffe078f02d6d4e7f3f35b3b45d

SHA256
a85b995068da6198a655755ba07c00dcc228252e7d0fbcf97ae05c34ae48c640

SHA512
96836878c142bf83d31fd23705f28ad02afd36840431560b4e4ca4dbad2f4ca021541a1e392539d45d67b88cbc2881a7c81311c377e289120cf67c9e88431e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeda92c7b6cf1d14e75726f0a2483228

SHA1
885c79f5c962f73e68b754b67a2d1ec1da3bc99e

SHA256
95f8b50d18d2310cca7d540b0924f021430f3d749e744f3723f90adb2b7af1c3

SHA512
19948d57f5602e323db62d5025c2be65d1936e9cb8e014053855e25faa2ce3d2330a1c0a2af7c9183a8f530ae2e8f7f040f6fc077c9cefc53b29793a72d85ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea60b38a05eb961d3ebec2506d8c4ee6

SHA1
4ce8789f15f002b93a93e1b75ce5b264d88d6be3

SHA256
e298827ec4006432cb08e10d303b0f850b82dcf7a2b85a7d3fc3a7f3a6889386

SHA512
166343a284bac4c9f82a02b52b537c2537a25eb68f2d6cffce00f89d92b8eee99c4d97ad46b25feaf934532ead2f8ad79235a6a6584efa552f066de265002b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
873e9f214375606ca9023e1507c268a7

SHA1
d51cd0b5053867a251c65f1d0781da2b1cb4f63f

SHA256
7442036442955ec62b5540b7b9141ebd0a55f5d5628e68cfff42812b14517205

SHA512
42aa298253f96f6f1149497ee8b87bc88f08a7a627a20ad4493c2bd66a4fe5ebf26c5280bfe904b708c1757fbc4f1d57e0100ebfe63f1b95c96170861a6a363c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e72ecce43f134da2c295c48808311871

SHA1
6a1a4c7244f2d6a0e02e448c1daf602e513ae8f6

SHA256
49add0e797c74c4876af17d1c75a21c226974721ccdc037a6824e4e35b712f38

SHA512
b76a6c065418ac9cae5de6dbe349d4535a9a1b71a137994878a745a3301955b0a826714d8bf9c34eaf928b1f4b74f072a9859015e1723da58982d910f0bf7650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d4e8b0863ef41bb0c965edffde80b13

SHA1
f25604f8c23dedcf1fb6e7c2fee46d8af160fa5d

SHA256
1f8ad04d6be116055eb15169c426ff6f962b6ee5c2788af6cc7a190277c41182

SHA512
94c5e984d7a39079c7ffa09935e961a9387921cd23427f953e44f8e32e0b74d944a464873ba2a933542d5b9ac1c91c6c0c6a55d92cbbb484acd91ef5ee725d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89125d7489a6ff335ad8b723c26e4037

SHA1
08532b7a4b527bcf619b6d371e863f10db11c1d0

SHA256
be21450ac80e9700b6807c6608b6260991d8316a5916fd123d6db4c58d01825d

SHA512
083e2374b47d2d9566ef6552859f4e8736656d992816cf522e3cdf53615a52b993cb0c1a662ee43b3a5dad253abe199214d1c575a00abbe19dac9755cf92dd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c614d39b6cad12efef33208cb12eeae

SHA1
e65914cd1e4f9f87717862bc24d9c580e9e00567

SHA256
289f7d24f5185eb48ac81571ed22ababf9beb12fb1e7db4303ab277065356410

SHA512
5141d43b308b7a791bbe2a9b2d941913efc9f4ba49f063e16d514724b73b94cdfc7376d5022d01599068b5e735f9369d71fb16484f294d1267b0aef95ec018c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb7bb303be2c323892cf7f7159fdfe9

SHA1
21d17f05d8ebfc83c16200c997bc91876be6af0e

SHA256
fa9ea88f8f8fa95df9775034e3b57cf0fe7ec3d03ff48bc04d29c5354a973533

SHA512
3f70b04528c52cc3b6aaba7dd480b0cefe0c22c5a3b27d2edb42f669ad2a9fb223ee5fdcc2976b6a80ca004a02e2b8a500c754d292eb34c478477b236c86de82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd116c29e2e1bdbbed84eb3eb7accabc

SHA1
d74d0feb642a815484b8e4317c014c94a8294f9e

SHA256
6532f41472f0194f25305557bcdd76b32662a8bbfcd40e32c215582d87cf21ad

SHA512
0f9ac76f0b0c1427721186f2acb2dc7655e5f6e15b9cc009e1e8f992d46fd298738056c2de99851618f7afab12658f2ead65130aa8998cc22f6085d79b9ac859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968aac5cab232b6ccf6134bbe12dbe72

SHA1
f82a194ae63ab372d15a11c167900197de26ed0f

SHA256
b97d1aa76d36dc8c0097ed93ebd5fb85fe0333f5a87d4e7c1429a5f6d753a250

SHA512
3b7f0eaa2a609865a8d44e9fe5b83583d7b6ffcf14656ea35bc65fa4a26d09c52a7db7811fee0c5a02e637d5396a58079f6c10bf7c812873e581d31ffd970707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0572d31514934f9cc83e2e0540489c81

SHA1
231668d14c27faf11ef959d976620e0745241b32

SHA256
14c99602544ba7e540ee5946e83bcc8ee94878f560ad9cbab51c36a9a7e4febf

SHA512
b536bba545e9b9950047351a42f829d6f8391d1686df545710b8da99827747a3bd26c06f2bc7e850cf38ef9d6195ce18b4c1fe20eaa47d408b954e68ccab59a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
149106ead162a1efdada19a16ca88d74

SHA1
d4a3023e7d553be5bdcc4fffa15646ac73fed8e4

SHA256
e54616b19df0390da510913bf3a7da79124b91599caf383d333a2b0df8678b5e

SHA512
431cf0c30a57bf6b7e44dd2e54e626deee3c6e4eaf927237246a07302d4b7a94bf48dd35ecc47e8453f71f72ffcbc67a6b61c67b00783c0cdbb7c24961240c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a2111d87102efb2ee3028438521a35

SHA1
9dccfefee9c1efac7f7c49957a73986535861e28

SHA256
3d9263aa4d52163612904ac3272ee0e3dcc686996573724907a2997cbb53c1bf

SHA512
676ce3d4d9db67c00cfc1ff788d7eed26830f70db8b2655ebf483a8bd88a786f63393e396eb00cf72baf41563c475fda07481c94e84c3a6fddcf7e99ce0732a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA02.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF04.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit