834c4b46e8a5d23772d2ef3f59cf00ba515232ff5f29ca1a7155dd78080aeac3

Analysis

max time kernel
136s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cache/index.htm
Size

69B
MD5

b48f668d29cf52a6db9a95f56b3fb67e
SHA1

70d9a5412e54da30dc44868e21e1c00cabf04a15
SHA256

544503741cd48b65bf728ac517f8ed5b40961a7d8d359127b2d2fc24169cfb4d
SHA512

e30f600598f12bf6608a284eec1153720d1f8cc5e722a85928d02d2c3d53c533a1cebbda558066d4965b50d6c57ab06959b5003b622469c99db1d471a65b895b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e0a0c83cd6455ee8463a61072f554f74957609ce67402e677f87eb156c697139000000000e8000000002000020000000fe998d69c17bb24af596411b9408d35d8c27277d6a18eac5de4dd7dc9a49db9490000000fe49bd181ac254756185d424f342c66bc540835c79b8f7477749612a011d3173d0f2c76fc81d59fe074ba71aad5534523157c9990d6b53dc7c10f5f3dc12d6edd29700292123b6dc568128833a1df755cf49111b548398a4dec4cc58ecec2e450cca2ce8b4178ac313e1ec9840a5bc5dd7e9546e1a261e2714d2c0dda5cfd2a241b27bdf7c3cdb75c538543c5a5b7cf84000000087112267204205826443dd35c15273b00239460d2746cf2e0228b4c87a106d34078b5baed108bafc245ffe146a0f358d55be3f8f3262e3bd8c1a245c8313d630	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000059427786305b6a313ca483d81abfcd3d436e1d7be1c9f18b5a3ec81039d04221000000000e800000000200002000000080cbb563c9b72289823a5a2099a965ab0d6665aa1fbed38eafeeaf05375d59ff2000000015d06deea1b2afc73e3dfec34ed70f9ab3760e745cc186b7446f4dd339b0b7ef40000000d67fce50b00bdb029dae5a7f871bd25f11b557da069fe00fcae3443f9f775f5313c499bd18a2ecb0d1e96e5eca88c1b5c7e1457fac5daf61994b14c2a9f4f6fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D79C0461-A7B7-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410173751"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d074d4aac43bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2584	3012	iexplore.exe	30
PID 3012 wrote to memory of 2584	3012	iexplore.exe	30
PID 3012 wrote to memory of 2584	3012	iexplore.exe	30
PID 3012 wrote to memory of 2584	3012	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cache\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43841dd1789307ea6fbbc329139f2fc7

SHA1
97d035270f76948793c152ac16e03bc66911baf8

SHA256
88b98d42d76ef864ed7275b517411f68c6793ea53d7ba0b2ebbc98502394347c

SHA512
3d58fe0610c3f010650c705caf098135d83aeed93740e861a9b452b64e69d8670d9ccc706bdc07656a0d788a3736484b693daaf4de60ea5cefb483358a2fd944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad3480613fa0eb741246bc7e66264d4

SHA1
59f88645b89556fa65078cec867254e52b1a5911

SHA256
bc19fa290d71bcb1844184a44fc87f052edf92976a4391b9f5f6a75461bd18b5

SHA512
6a847c056c08fa3d4cd5e52631f7369761696b99bdab267ac0014d58f96152ef496d2b721ab151adfce02218ada69c3aec2d36d4c5d3295e22a1248dd2f54fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
659c7a94d9854b07231b693e39d5e679

SHA1
b0ccad67de9e8c89aa0072eb3397677f5e2553b6

SHA256
7edf992d49ef16023e9baf95524d786a453b0899600e6408719a491ac1f2b591

SHA512
7cd7a03f06d34ba2081b6695cff4fbcd061cec3a1ef8d3d28168b6938f0afb32373c608b16660e3dbde5aedf79ee071c0b45567aa1cdbaa6325fa7ebe5864aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dda690d223ff910beac2f4dbd89d2a2

SHA1
d434e42220242ea8bc940bc936318cfccc9a795b

SHA256
2825e6291ea754554919cb341d0c1ced507987cddeac7f0110d733ab86ccd29a

SHA512
3e9732a0cec5b489f870e0c2c931b84b8ea47ba726403947e014da3a0f6115b90a6710f8de11d4b7b218c93827deba5b260d58328d7395388b20698554b81b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50bcb972cc059bfed9e6e363847a29b

SHA1
1ff077c04074448079f1e0399df2dd80c4a39ee5

SHA256
dbde0cb6fc7b5880b7ef82fec81c2bc5737301eb44488e1ea87287925e88b386

SHA512
c83386b4a57a7ba1d56b40766684224027e8aace476031cf93788dcd31b2d410ed7071b4d502b93f05c6367ee4b428e56b2ba1c1b8049fe43b087d7e15487b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e9276adf58ed5085d805424bc60faf

SHA1
4388ea46c80aefe679319e28295f597251c8745a

SHA256
652827768359f88131e7b7881389c952fe653f4cf1d121263a6f2fa4a4715a52

SHA512
1e4b8f419a2d8caff7e66672bce73c9e2efe8eab0f2111f8fe24509fa208b8814da204e35f684132ded30b358fdb264e1bb027613d0e242a8da8cd88e073fbbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2s0hu3f\imagestore.dat

Filesize
1KB

MD5
51c9f4e20ee7069537a217a3fac01f15

SHA1
2f0450650d632b03c03ae26e5285dcae52b09f0b

SHA256
14e2dd9699bd5e3598910da6e8e9b436509278c3f374dcde0398989f47cfd9e5

SHA512
cffe5a857550945cc34240b2f28d9a185eb3b2b510a5f9727fdca2570ef130ef3e229bb4287fce6393e7c7e911fcca8dfe138445786220e19f6f40c0554b2d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\favicon[1].ico

Filesize
1KB

MD5
36023f9095bd20cc587ecf0d363d0375

SHA1
717c014504d8f771327734531e672172da35efd9

SHA256
893d5fcb463fc085f6b8f5a7d22fe35dc5de0418e35be89235b24bb832494a2b

SHA512
d3f8db3f417861a52feb0dcb1701e79ae81134f54b8f9ac90a848868dc37f31d81c27be431e1547e594903541212372d8cc900f59241f74b745e7f8e9f90af91

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB86.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22E2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit