cea35d9fc133dfe5cfb98aadc613ccfd6bb92f0b1041ad6bcc58d6cf89bfb1fe

Analysis

max time kernel
102s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JavaReportingComponent_docs/api/RAS/com/crystaldecisions/sdk/occa/report/data/IConnectionInfo.html
Size

16KB
MD5

63910ff84dd8cfbff785a5fedd9697f3
SHA1

83208fdcb4e2319375940cbdfc86d3e887960f4d
SHA256

081916c59c21735a3eb709c6d6755eb48e8be6e90442d0374131aa756ec8682c
SHA512

1a221401373a803086360af7392701e071004f313b5f0c291538e9eea1dd18a458d81fb517db5825dfc22be85f524ec5365682806b6834254caa6347fd9bbdb7
SSDEEP

384:DK6D5AB5+irtdvkg6uLEG1FYGTGPlcJMGChEpqa4tVtSW4XNtdmdZgWSD5AB5+iU:DKG5ASirtBkg6uLuRDeW4XNtQdLe5ASt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f6715f4b3ebbe82a4bd753dd607b28f083887af3ab4d7487bea02d7e40c8b354000000000e800000000200002000000071c5db0fdda85bbf5211409f5b030d49a5fee8d7fddd0b65a26d9f49f8ea057b200000006ab8ae9c1434a9cd1f275abca7ba40d4475d7fe9809b20032935b7afe17db4e44000000070ebd4ea544ada851d6d10c346dfea39b0f7887f4bf2c3e3c6609743651f6016a8079bb3065c05acd49c60f32114e33bc40a8504c4fbb296972f6c1b413b9ad1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ebede4976a42b87184378ec1ad89819962cf514cc480c3902f7c397fa1592cc5000000000e8000000002000020000000eb99fb0d67b6e36bf09c3a384881147042f18eed8ba56f5c9aa98e53df99a09890000000cd42d385066e3d3bbd73e3f709fe744250991486e44e6e254b9f900ee3b53ee41dd4365ecd1a6ddb31b3bdd65c0b5cec2827c11dbf94f38387140be13e16fd324898a28df34ed4831162a3145c2e49e9b3f468f87c05d66079d936f8189cb28afa247129be8382db1998c297ccadb3cf78bf28f4a1a497696c1f4ce8f00758cbb366cc8f2128ab80c3f32be278addcc14000000033ce00b50552d388edfb00db5ceea03dced7cd261016e7e5a0c3ac7916e24c437f8dcd33721e4b11930d388f856d6bd74728d43ea329bc82b66b6b7f3b0be781	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{923D8240-A79E-11EE-89BD-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0be1d67ab3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2320	1972	iexplore.exe	28
PID 1972 wrote to memory of 2320	1972	iexplore.exe	28
PID 1972 wrote to memory of 2320	1972	iexplore.exe	28
PID 1972 wrote to memory of 2320	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JavaReportingComponent_docs\api\RAS\com\crystaldecisions\sdk\occa\report\data\IConnectionInfo.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88d882745f788280637d5a8da914baa9

SHA1
142f20af574fcf7787a5cf3f9bb0570afbf36b3f

SHA256
2590de60d2b700b5091954087354008afb790136c9841d4eaae6d12cf826ee0a

SHA512
2d12acb91ece1e7b3336952c76e6d3c8ac8d805ec3e7acf2066b8d6e743cda4a2ebb88348085359765689b475a20728d7e9e40d67cc7bcb781d3f6133bba86d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab313cf6db233f8a479bf968c7d4490

SHA1
43496e70cd4a8bcec881f9cd9366f4ad9c391baf

SHA256
584d0d9764224bb2a3389309ff3ea627efcab298ae28787f9b28c59ed30a1ce4

SHA512
c7c8f9cc7168e54dca60a86a1768b9b2d25267722fda631790ced3ee0a64b2822007c65a04c03886a118fa3fba7d691335febd47bed9d92aa493e9a23673dfbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3eaa57208ebcdc9f8ebd4ca2250b866

SHA1
7227dfbd47f1882df21cdf90456f9c15c69b37a2

SHA256
3a71336606238836e438dde240325031ad34cdf6913e593ae5e9140920769428

SHA512
53754a44133a4cdbe7f55d715649d0edf77637a1c6e64de70e746e87568e84bb6016b60a870d83c8226dce0b8685a35c59e84831b90c61002d55a320bb9ef98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173273b7b18aef18e09e72f7e02f1d5c

SHA1
78864e9eb5d62dc74e3922b604994569a9fd75e6

SHA256
da719bdc3d823ecd729aedb1075e0c47ca5b6e50ba9562bf2336dbf4ab68d6a8

SHA512
d705b7ac74d86e24c68ef536e6ed2b9cd1c957749a3e874563f0e51188346b19aebf806c696fe72676f8cff56fa7a0a77089dd70ca7c5efa6594e03cf8d65b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1d9f112f286cd1d9546075dfa61b809

SHA1
0b57d89c60f64b3ec42c0edbe206312a08ace7ab

SHA256
fd95f16fa6f4e54557946a8a23011a5fe63d14a20feede8ca6ea3b7a2a950ad6

SHA512
391826c7e6b42945a9b50d18e83859de7996387994a56707dfb6bcf0f113d6d1cdc6f893fc47419a37287a692b6a9ae07962667e165f4acdb51c6b7ea460c373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2355c25cc7b446645667a48cb20078

SHA1
8dea83bac1a91856bbd9ed4119deede3272e2be0

SHA256
9abff11e2148a5c49765d3e0ad8857e88acce7fa279e4aec560f2958e50a186b

SHA512
65419f5f36bb5d17a4ce040dca55316ff722aa01ceb04e0c8ba26dd7490b36849b2dbe82703068214c38f69c805ebddc61a3bcddcf71c9524723fb65c09f6394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c039c3fb1061c6987918dd2bccf03d0

SHA1
66dc671ee4b9ecdae0265f0ae0a0915fe19375d0

SHA256
7a068b0a4368e51b943b7806b03bd4d77bf8656ebe2b56b631f3d31850642fb0

SHA512
99fe2af19140639f44e0bca2bf6fe3ef18847af8a67c9c783b868a3c4e904ff8c44d51b99a821a5744acfe36a00dd18df16d551e7fe5a9eaa988d10267cffae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a066eef37a724a26d2bf999aff5c3a

SHA1
9dce01c1e8966bd8abfebf586d83a23e2f07a14a

SHA256
428eb2def86460204960f349dee14b11b43e825a4180688639280cbb36e2cf90

SHA512
7f0c3e7f547906052d1626e1ba139ae98a0859650a591e07660b1cbf3b68375ee9bc0f386c1d80299fba8965e10e049ef56213c65ae0a82542d20098f6338ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f530f5b74bbbba480625247ec85fa26

SHA1
8b7bc88437f552c8ceb18bd53b412887f4f4b640

SHA256
84ce4f0d47238c83182a209df35527f1ebf2ac25047f1151f5964ceb31906d4c

SHA512
2973281b986964ade8c3a1a9cfed23ff4d43709b84363accdaa75f60dafd0ba170e90b53691a5afaf384c92623a9240abe71def647956530ebd665df5ed3623b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ead0d2b655e88d80be4051bd926c3381

SHA1
dc2b9480c721b6e9ef6ce82230a9ebbf341ab03a

SHA256
b5e5266ac1b8d0105cf62102d5c340c6aebda2cf15846d32afa732c299cb4931

SHA512
995ec447e39927ebd1056510cb8b661f5d2709b546a27538f89a9dcebd96b6b9909e770fc1b4ed189fe7e6908f2bab949d3ff129265a9f8e2632da1ca57621a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d515e002e2cad9fc9d677292fec15b

SHA1
a024fb882e68546ecad23308e9e282d1aa36ad89

SHA256
e977493fa137b3cfcf491443079a5847f6ca83db987fb2da4b047b1fe7ea173d

SHA512
b4f2ca29198ece83e20ef8ee3eb431aa92b1fe4cbf21fa9a003f917b4cc726d3e2a2217abe7595ba916c87a677606106962984706e6dd0e0202165e8a179a704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af2b9c91d53c893298c324ef3c9f80d

SHA1
23418e6d0aaebbb9632718a28f06044f601f29eb

SHA256
7ecf448385ef39d674b8329ee134fd113ece7f75769d2fb05ee1190f5ae12b99

SHA512
0ce9857163716b220bc9734e250fe7b68011896a66f2a6d5b12199ed6cb0d32d0f26fd1dc2cd6e71a71a560e87d4fc4bb21255bc245fb07fab4765eeddcb1e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit