f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15

Analysis

max time kernel
122s
max time network
187s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

More/Business.htm
Size

6KB
MD5

e841d5f1a5e3fa959c9967c2362f25ab
SHA1

0785d61964d001dbe353205dfcf94480187bd443
SHA256

bad94de18f4bfd9b31a5adde74cb5ac03a81124ca004640d53d1b26a5f07e346
SHA512

baae2d33b40c7f8a78387b782cce0820221ba4667260f577b1ef14bdf92612dd237496f3577d336591fa390cac77ea3217f71cab9162e3f971cf166fe953b353
SSDEEP

48:bpIE8S2+bS9/L+ZotqjldAzhQabMgokeXCAmu3xTcx9MoGH+RYxIVW9MkBNiDryE:IShShIkeXCupC1q+XHIEd8ul/8uqAhv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000096c5d90355331b8bc5a94644e9bb6d9ae5a45fe4a144bf8b96e0622d0fb5b74f000000000e80000000020000200000003177eb75a54ce2a6a3485cfec668e78e89b304bbed62d6dabace2fa8e850daaf20000000aa29a4850fe9778988da2b6583e8e48a6b0943cf3d89fa7debc2792f2a797a99400000006afd71c256736d3032fa98724a50f97c6156f00023776812fd380b273eabde4d84ad3fd099ffef918c2384e9b646212bf5f1de4e410fb9dac901e108b7b3fe08	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410547015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004ff64cee6555c88da85b2c82c8126ab651d1c82167f216cd6f369e5f5a6e7800000000000e8000000002000020000000f8c64ec89780b355da0ba5fc5f40347733bde1e0cac337ef6a9e60c24642395090000000de4a9bf43b50eebc9294561cb5b250e0052f72cd79238f7a27c604d216dd94820b2b781e76ac634f9bdba3d6c3a87c7d2d107e36e7e15d889038687f190d9c5d8f4e65514128bb7572e5f45dbbf81106ced04cc46fab5a8fc3d681d2bf8493f21305ae3fdf6130548b3bdc1beb82b2562ba43f5207090e0b389a703a7f91251876cb94bc16c943283a50fb05084c83ca40000000f5384e6b6cdb24375a20717b980ba258a50d64fbb0dbc2f6565490ca9052d63d9e94b8e50ecfc3ac21e38c940eb032693cb1bf54a4b2b3191665ca3f0b3eb358	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAAD6E41-AB1C-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e4adcf293fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
856	iexplore.exe
856	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2736	856	iexplore.exe	28
PID 856 wrote to memory of 2736	856	iexplore.exe	28
PID 856 wrote to memory of 2736	856	iexplore.exe	28
PID 856 wrote to memory of 2736	856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\More\Business.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06d511a78603eb26ffc9c7686d51518

SHA1
7e6b32ece5f93f112e7c6e63b363176549c27ac4

SHA256
db7deadc5f497b353fdb5d30e897b9c433a910b2c14450b6f698b7605e146e18

SHA512
7eee99046355c9d6b13f7e6bfa66b768a3c8393150515a9043622d6afbca778f379422e731054382ec677b5920ad1b3a8f0bf3ef33022cc88c66d2ab03486127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57c465c896ae5cde25abd606b95918f2

SHA1
6a8b32d1559d68e14f2da8853321476968fb9f81

SHA256
6dde8252a0104a44a2b7c40968cf3a0d5f7c6067912f4c31864fe416b663fbaa

SHA512
5d5c1025810cb7df101e0ad8ecd4df7742c2098d5d7e5eb2895130983747809873a70170fe78528f8e443954e6966ccf3dc11fa53454cb9935fc6b5fb516b5bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a82af4db0121a94a04f240d4252081fd

SHA1
d4c2ff9862c508d96dbe1442a762fca14878c3f4

SHA256
f2130de591583c564a95b06366f48f37b0399efe5b5e410fa19abe53fbfb7aed

SHA512
8f605f5f8d31720cc4605e38a9dc57909b0a26fcc985caa3b2991c36779c995118f200d85115f91c83aff6b1b42ab3c93aa958c6b99b33e1879c33b11b3ce011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
351dcf16a6fcfda11bbe74e8d3bebf40

SHA1
385180654ce81204f04df1aca6bf1f8259da90d8

SHA256
2496b4ab93c7ed2e600a54b0145b28abd7916d6b4eebe12d12828c4a2660b3f2

SHA512
739f52e39f850be4431f67596924e4d2d6f15e9dc94de1794e6b375c8790b6039e7992f86750503b674f5805a93080866436ed4ddd1b40534ea457db8429cbc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6119ae707f94c1790bd30ab79f2a48d0

SHA1
38ef92f5ffa40c84c7e66ac8abe6162f8593fa98

SHA256
41396ec5e2ac27d93929e8e9d24bd21ea4631fd3baac9789c330cdbd9c56e3ef

SHA512
89a19372c82e17f9988340b657a9e8a76eaa5b3dc36a4b7a51f26c4d14a9b70223589880a464605b313c44c0717a0b748ffb95a74b810a0372c6430897e67688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604fd2985e5769dc10b044dedd185b64

SHA1
aa5e2b829a4e0bfe1f133c11499143043739be13

SHA256
46055ea05afcb4bd4743457c1e1e3d16b858c64eff59d65002eff927f7cf8591

SHA512
b5c057592862581f1927476a0cf9900bf58483afe095407268c6daa0d443438478818730881eea3d03bc4edb485e010fdfd695b4d045b278c98f67b52ff7997d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0102aded172a1c367313f5bcb1248ae

SHA1
00b20271ee6a96bce309fa51e2430b77131f92d4

SHA256
0da299313c954d7db7cbdc8ed29cf0e3b133fe9509bd637753105cd2ad85f2c9

SHA512
985553f2bfd1ada845d73c52b65babc7064240a35469324b8ba6d646a6f6683e0caf33d7567aa6d30f9824415efdcf1393e09d430f0fb008ad1ff88fb5a9ee68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2e892183229a12b25f7d33202b42b38

SHA1
75d610581c2295d5c7037468312eb4bc011d16a8

SHA256
30c35f3c17cfeb21f5df3473ed82d594f08e620c6d6ffa9ad4374f720d011193

SHA512
2557a8905337331c26b30cdfd3620d99d1e826d5cbcec1f150f91b16399804f079248b11e3746c5128c0d99edf85774cee8ee3ab34344c2bcab9b77da2e5c18c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26bc9034721e030505b307891a6845f9

SHA1
136c12a12a2247485aecef94d1fbddb4d51005d8

SHA256
17f5346f09a52ea3ad7c21493247b5e24799aca858c466671493d82143b413b7

SHA512
2f2eb50c28c98dba1890f15aa4290587f2cac9c4bdfd410e377b8a4dc99c26e5d038d044a6a304541b2388c74b95c764f44ae165d45e0ad481307ebd2dbedc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ff313ad7b327c93884e959847141932

SHA1
462677598033a32a53ff07ba7562dff654caf788

SHA256
af51d813c6ac3139b03041fc568066ab77dfb1c972de1d342ccb188effce91cf

SHA512
e020df40027fab910d9fb565b7ba941c95e5cc4b457845ce04a399e598d91b3e82a3eebee36f9c4af0031e0ba2f0d51d5445c34c3bf5a458841e2a7e43d32ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c686ee232d472db0e2f8dc14efe8482

SHA1
4ef377f09aa2a8a2811f0c99d7a512045af1bdb0

SHA256
bb62541768412a97bf7694132a35f44ca69b08bc0da95ca7678c00f429e66ec8

SHA512
8147eac6d09ffa001c113bfe4e962d6b3f5427a6231131d94fc88743ad4300de78b96660b9003f8f32f9d76dee07103076eb7a19fc7d0eabfdda6c35a24ddc80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3fd316662ca417ac35151eda16b6a9

SHA1
b53ac6cc39affa1d1be79692b6a70ad147ce6ea5

SHA256
f1c01ba6e2379a99c6de296ec581a492abe8793b40ec968bdbdc4b991edd639c

SHA512
ff78fa7945090f616b38df97483c38692c25cfe1e9373face8a82f216358d59174c35052d730494c6b2348400c1da7248755474c530ec24dc8a8610969e339b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF603.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C4D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit