037541fd2dab6b9b0c962a30642e32e577c586fdd015499ecc3dda169cd2a86b

Analysis

max time kernel
121s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad697404f05b5a04738665c697fc9f1.exe
Size

17KB
MD5

0ad697404f05b5a04738665c697fc9f1
SHA1

a6baa60412228433d26b99ecc1926f7b474fa19c
SHA256

037541fd2dab6b9b0c962a30642e32e577c586fdd015499ecc3dda169cd2a86b
SHA512

4fcf54ae49a03d496809af7463dc828e23e6f86234c4da5b0ab2c0777d596796b80591c861d7a10af19c1bc73ede3bd171a81c699d0d6856130da0d21cea8233
SSDEEP

192:ndDG5p2DELeZAF5q+Jqf+0e16sYeMHse5UWS/UM2iszlY5rZ19N7ScwnvYicePor:sckeZSqE1CS/1sza9FKwhteC9THz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410166842"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D07026E1-A7A7-11EE-B683-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2952	2072	0ad697404f05b5a04738665c697fc9f1.exe	28
PID 2072 wrote to memory of 2952	2072	0ad697404f05b5a04738665c697fc9f1.exe	28
PID 2072 wrote to memory of 2952	2072	0ad697404f05b5a04738665c697fc9f1.exe	28
PID 2072 wrote to memory of 2952	2072	0ad697404f05b5a04738665c697fc9f1.exe	28
PID 2952 wrote to memory of 1244	2952	iexplore.exe	29
PID 2952 wrote to memory of 1244	2952	iexplore.exe	29
PID 2952 wrote to memory of 1244	2952	iexplore.exe	29
PID 2952 wrote to memory of 1244	2952	iexplore.exe	29
PID 2072 wrote to memory of 2952	2072	0ad697404f05b5a04738665c697fc9f1.exe	28

C:\Users\Admin\AppData\Local\Temp\0ad697404f05b5a04738665c697fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\0ad697404f05b5a04738665c697fc9f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\program files\Internet explorer\iexplore.exe
  "C:\program files\Internet explorer\iexplore.exe" -embedding -nohome
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b904c33fbf111b520d27006d625b3bac

SHA1
d9a73c7101f40866f8a34c36cc5a740dc50c5650

SHA256
d8a37200103e3ff597b6ead0c61b2ebd00f69399a6913d260b1a68e9174eaf0a

SHA512
34314b9d08bdf0ab4e7a1f166fea4a2e111f71f3bedd710a91456c37442fd6e0a74d6a350e18e02c1ac37f8b0c096f65a474b7773ef135d209ad337ad59559f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d7a83eb4ed19edac455cfa5c09f4e4

SHA1
1c964bcc2c01252c91d564a447b5507619c2e9e5

SHA256
b9ee99b20db15e71671f1dc9984bab4b7988404476faaf8eb58b1f539f176476

SHA512
cb54ce4432d765b25748b713758956c9e76468d218c205395dc905be6dc5ad9c96ec82a6f2906b0e314a2b4510e2da43aeedd9fc35a8b3f4be469500b329e522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc4e319da616835fc41839627900467

SHA1
761ee83b9a356f80384b8211692d03e5f47b971d

SHA256
2a3768cd718b64b9d5996f8f075ec2ff93c817399b7250b639db714e961b4ea8

SHA512
81653303ae29419fc70fea26f0bf0f582622d1934e5d9a5a8043b0d5bdfad03fadaf89c8873899e3b7719f509893c5888737de20b410369d04a8b51f70be96b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5638a37dba408dc49dfe70d3a179016f

SHA1
7e0110a4ee1330ceb37fb97a0bf2810afb97e8eb

SHA256
a75189818d573fdf8adda0cac784365c976a6171d812465f772168c3ab0cf0af

SHA512
693d04600ea5fd29b9f377f50f26303cdc40d6fd615979dbae46686dadef9fb2bdd88696897f7459566fcbb62f4af501d4a39abedacfc1b9412bbcfdedc5b0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e0fd7cc6cfc46b03e8d9ea5d9256ec

SHA1
c406770269563fe2869e681feb5a8036e900e8b7

SHA256
ad7674118ef6aa569413792fbbebee23197bf709ced38678d50fb5d3106db1a1

SHA512
53e8173971c07368b9c7d2c5176b4b27f1331c8722b5935295260aa119bfac9ad2cb6c056751ea21557f4c4bd784d0096e9e8a16c6abdd1d87c907b9e732538f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0c5ed90d3d05d9b46754f5b4f39c5a

SHA1
81a84ec0c87739e3889f7808a630b2f529700e35

SHA256
1b276185a96927c58951938c6c37ab2bb376ba8a1bb4e9c7686e8a803abb6d9b

SHA512
67fe763cead08a82d899cedb3b9b828d1cc1d05764ade6b372a4de5603cdeadcdaf9f3176f460a4ab8a2b7132b8b5e87aa187eb0e3197ffcbdc67a8af035f3f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b766c6d2a1e34892464d673c50768a18

SHA1
bf25b7831f7861bae3930b270c384eb12f9bcb28

SHA256
edc74abcd734f1db26e6a3ce216bb9a9f3eaaf32b171afe887c6adbed7721f59

SHA512
d5838d8bdccd7b95116bab085644e0ace4dbdd442133bb3d49e7b7ebdee739f2d826c94ff5b4d5987d12c28d1aa6ab32aa99d1b13dc6ec3b030b901a5ec3c90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba39299d0fd1496c3649044fb3911ef

SHA1
bf561d7c69bbb72e3f20133f2d83d899ca2e6199

SHA256
fba77144ce9785deebaf90209f703583ecce9649d6aa0c341519929a63ca2a86

SHA512
9162c69dffb67316f8dbd8fdda9dd29e4eaec53ae78223dbe6106da82b03e45aa655edc194d9a72606845bfb0831560dc77784caa0b49da0858309f34034b734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FFB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88D4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2072-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download