8e96fb10eaea6aac4d09d1b45d13cd259b55d180f0a3e80ed2466c4a9bba0b64

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Data/Registration/reg_eng.html
Size

667B
MD5

9bc65eb37f2d4166c91912d86c11ad14
SHA1

f7dfe6225ba48ff1f93b29a0039f806928fcc38e
SHA256

623551f0073ff7893d41ef7791f5da8b270d8dfcf9eeea0eca6256829cc54b10
SHA512

bf1b0e7dbc6fda0eb2867241a3c48f25e6e291c45b8e96abb115969eb771acb001b3de5eeb12ebc0845662021c991fe4bc0583fc538560b5c731eae7898b2a58

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b66c016b3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245166"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f82180ed955af1769891333eb9de4240a2c4b41a2d7fe8af6c399864efad3f5e000000000e80000000020000200000004e07ab5c8873263ccbb3a73ddef1ea700103f73e64caf8472a1f9312872a579e20000000f8625f4400901a0ea06537772565ea61b162c880ebbb79c726f19954b1b95e81400000007c5d83f7d2f2351a49d7dd3949568ec8128d0ba1331a0b03a14968c45190f1c8e2887ae878e0c70b605144d858beedab1ded9938a67000b43adb7ea62ed6cb47	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CB1BCF1-A85E-11EE-A03E-DED0D00124D2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000000bfe7c3f1168732e6630e15f1c9042c8f23bc091ec315761fee7a370b3e3142000000000e800000000200002000000057d152c09e5bb4fb822b97167832b8dced38d060132a603243d5e6f20cc57b1f9000000042856356d9f17d0f0c7fed0bc7d0795ff96881f130e169627bdab16ef8f19be0fa9136554c416cbb1ad5713450f1d6a4b4571587d01bfddf152cfa17c5d7f360f6db956a7fcbf50c0fe157dd993dd3f74c434a9b49b34a39961bb51d54121242db8a9a5cbaf7bed647643926d9f7d404255e38db3d8d2fedd908d929e1a9a1f4a5451a5a32920663001b3d42d2bd1a2f40000000a4891a80f3262712811d7e2d423bbde20abe41b52c50c7197b095eb3e50eb9a1d8e422bbee5cf018d66775803399ed31226f736e49082288e0482a01fcf0a461	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1192	iexplore.exe
1192	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2972	1192	iexplore.exe	28
PID 1192 wrote to memory of 2972	1192	iexplore.exe	28
PID 1192 wrote to memory of 2972	1192	iexplore.exe	28
PID 1192 wrote to memory of 2972	1192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\Registration\reg_eng.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc2e139a7a4cd312a35f7104561b5430

SHA1
812e9ffe335dcfebe7191ed2552e9388db280828

SHA256
cb32418f3b2730b12d10ade942770f0c61ec0cf69b7c719ed014896dd52ff664

SHA512
089b086b6458090ee563b52fc0e3bcf95b55c5b765330ddf44eec3cb3c5a1bffacb99ecf90091159346a3c60a406d126c97b9a0e0d17eeaa33de46aa250efea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a50a6983f9b6630154fdcf346f47b4e

SHA1
edf814388c3e32669545801fde83a069ab8e1de4

SHA256
afa270cd835954ddfa59e9ab37ff2df59e22c0dd800af9330b5157190620ec01

SHA512
1c14001d927ccbb6309f9d7b3c27aeaa0bb1098e6b37ff62fe61d20a8c44733e3bd3eb14058baedd373a3b1cfc1c9eb7e63c2b7eb6c44cf06f0bf5a48f804e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a45358648fcb0184014d9ae76b865ea

SHA1
95f2989077d47c5f43a9a4a6dd4c55ff342ce775

SHA256
16736facf738da0b19361d0e02d00a6911f78139ea7feb14871b19f498968760

SHA512
3239e79021ecbe5e783b4cd7ab2e09e3e36311fe0b1487fd1fc78c23c138a61dc1d79e4158a0b0efa559345aa9b6c9bfe6c38be9cdf55f4ec005ffad390c37a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80949edc2204b7000e82bf5fdb1f2a17

SHA1
b60009716ed5d5f52c9c9abf34faff6b8f7c2461

SHA256
ebbda0860516c05d37e775cec0d4a6f4699b2e5875bc19ed9df884822b7602f6

SHA512
8fd60071e4b7274a83a09599704ab1df9bcc34223be3f5f9bd6b708867942103065a26627a1ffe2d744e82a98a82b50f475a852909c3d72ec65b36abcecc59b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a109798079dd7957bebce83b9740e4

SHA1
0a7a224482fc99006da6aef41dac8d8c10a813ee

SHA256
8e74e2c2e99401d86bc7788e26851b97904143b3ce63fd839fdff9653cde349a

SHA512
39c23a366847d7097858957a1a185f5e18fb72af5a14ae759230625e499f3aabf3615c48839833ba6b22acd9a800e3afb8ca7f7aa5a0375f44048c085fc335fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255cbadb978e451dca840e2d773f40ed

SHA1
8913d03ffde0da327bfdd8c651d8f3edc282f43c

SHA256
80ee7a671a7a142080d0c623a87d8496ea09bc5eea915551103ffbc32bec229c

SHA512
a34a1b1b0721b61f78eb71104d90521c0601f2c8e9ec53f34ad140c31ea5fa255158c9a07622e3631fe09d5deea83ef2424e3a41bb848af20732ee5c59ef0ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5595aad60b00fc8b051fbbcf6bb6c29

SHA1
73da0f882152c11c8a07c3d925c74020e579757a

SHA256
85d7cc6aa41fa96287b6abc2cd4ee5a1e87b69738bbe1519ca5e08f563d09f8d

SHA512
ee0dbda051ad7f95d3147adf0ee903cf3f6eb8dc5d131e6215011c93a3487b7697c6a15c2e99883d9e183fae9e0c72d4a6de8ca01b20fd3d6984a8e11d895a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ebd0ad99ccadc216c490416b68ebb79

SHA1
7c3087ab657b0fc59fd68802c473320036c7e9d6

SHA256
f84f022b64a46d856ab80a621bc26f5461fb77969e15cd7a2bae4d0ed63aa28f

SHA512
c795a07ced14a6db43c9963d1d4f2e830af676c5947bd8954be7b9f363172169a6bfcd047e6793f564f62f77fa2f6a08954cadfb5478090bc59a3b5ee28f0cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f53f8aacb75630c8eed2b060a795b661

SHA1
ca552d4b1f846d304a9e145d2842fe16c48e8898

SHA256
8bfc339881851a3f75ddb65833accb6ee44badac8cd1fb828649f7992acddf72

SHA512
4202e22f352f9d21755410f50992311490e3575d95b97cd7e9056fcd00e65d747010cbcf092ec29071a1e4f0969a419d83129fe83defdb0396547a3cb6c51374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b69d8bdadb83c694735eee220b42742b

SHA1
5268931cb20f686c27242b4598359b1fefe736b8

SHA256
8bd78a36618b34daf3f01b96942f26271c48def8479b33eced3e28fbff721ae5

SHA512
713c50c499e93011ea5bf42db94b9a3850f0fafcdcf8a227671ca935dd22d668ab065562ce31931f913d20825d19ba4b8bea972c8d6b569aa46c1577f311594e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BDF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D88.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit