8e96fb10eaea6aac4d09d1b45d13cd259b55d180f0a3e80ed2466c4a9bba0b64

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Data/Registration/reg_rus.html
Size

2KB
MD5

70daf5fed66dda8114d3ce1cf175cecb
SHA1

208167002c5d8276a7ec3f6206f038428208e752
SHA256

5de7a44329b12e7fb4f931b969580876685a784328c6574fea630f3c88b1f38f
SHA512

67931a7740365ef0abb37d47d12947c7c1341f7ffc003fc72133e9bc2b88b533bd68b291cd4def41ea79da93d099db936d2ac685b4d2f3478b0e88d106dbba82

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31CEAAE1-A85E-11EE-B735-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001104ca54b0590ecad2dc2ef05e0a9e114476fa295dbe09abb7cace4d1513072e000000000e8000000002000020000000c9d253f7bcffb15ab59eda05cd212cb85fbef1e5e849e1aae9a33fb390f1663a90000000ec995ec694e96ef1210e2a114d0f1fd2b426592ed421f8625f471592029d4a47c0a2834e00e7db586b86163f2f44501c25df397e707897ace0ccf8787ee283a384bd9a92be6e6eed7d71c567118754130b810bed342a8dfee82b0d0fdf9d931768fb376327ad3d706bb19993acf480c791bf0de7fc0c28bd9fae9bd9aa057cb6834696179064caea8aeea6cbb41c8b7d4000000004b4d729cd787493508ab8f9365d1f31a9e55055705c4176b613bd0a76a78295a552d8cdd4a8ee29951b1e1d96bf7e8efc98616bb2a1de815fbe90eb5562a871	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245174"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000000e63d8ba28d3351419a19fda6ec4131b791fefc7cc3c5bd8bd3e88c0ec2cde4c000000000e80000000020000200000004a77752243d6e92a09461337e8a7ea5148273dd26841542790f0213f1cb93f292000000099c53e5daa4f71a0e22926a56cebddc7766d643797ae41a216b7070cee89e4fb400000005db314ee42a0675c0ece6c86f20cb42c7ead4f3dc7b1f13aa360e26c8f7d5391fbcb8a0418291555f78f82f203d8bce36d8da1a1ba316438690ff15c1121eb84	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b7d0066b3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2708	3032	iexplore.exe	28
PID 3032 wrote to memory of 2708	3032	iexplore.exe	28
PID 3032 wrote to memory of 2708	3032	iexplore.exe	28
PID 3032 wrote to memory of 2708	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\Registration\reg_rus.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31a8e1982a170a88f3ce0bd4c7aa74ac

SHA1
c355b255e3e825d87936f009f0c37ab011660702

SHA256
c20d9c22adc7648b666ca52ea453cd942872fae60d5228a0366074514327ca47

SHA512
63b719b537b37a3d0a43385e9b1e5d1b6c81852023540a649b8853f16cc92a2bc849832af4b920b2a5d08333069a95b77daeac134589e23c8556d7e51aa9dd81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2796430c7c4b149eed47329289fc038e

SHA1
1cafd6ccb81651fb8a9f2ddf58aed630dc90dad3

SHA256
dcd6da860cca1c7693672c3fb39649a1a745d040be8d4f14557c269eec853a85

SHA512
d8602eba2d599a5e82b3191c33309b49d12401db3f121f76100c0e69b9b15823d3236f6ff95dff5bccbb2e5773c4ac91f26ff0002169671034700e6f01dbbbdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f20a474d5ccd701b11c232b3a966a1

SHA1
556b05f32b1c6d57e4988d006136fc4eb1a42653

SHA256
e8835e1df44da53d4666aa2d6b4c156855aec0ce1e3bd7540f763de5a757549d

SHA512
40c508c5b3dddb32f117a3a8fafd6c8aaec5ff9299f702a897d2aa8aa4860865be1c72b967b682f70b54b9fd1a597cf571dad07bb7fb587fb46247768991e28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa8ebb1d610310611919b52e69692906

SHA1
9ab4c3d82d460ab5aad735f06670043ad609c53f

SHA256
1c144d8b01ccf6f31e246704bd59d66db6280ff965d1dea589ad04fe922ed070

SHA512
ffc1472ca6df42aefbfa43819e0296727015c748ca3ee71910a80e99f1f037fb34301b50768da0c1b89b95883f2d7b0b27c080eb8ffc3a8bc7ad39da22c2a571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efb11207e145e18244a92df3020da55e

SHA1
4d9b9ff632273bfdc101cba06a6b285da9434dab

SHA256
d73cc0a117e08b93d3999e189bc082dea996852e8babe92723a2123524d4c13b

SHA512
0d6e10eaf2a12c37ece7f32badb90440efeac5538e53d20683a1ce5d43df2f346a9d094b12b1ad81154c7c67e6812b6c4dc0cccadba9ee40fae03350d38c5519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ce4375c4f651a50e4e9d3c446efd0b

SHA1
986a8c80a9d21e32bea323bcbca173f8b9aceb65

SHA256
527040be745c96776f1d1c83a99a8afab24a2fba0aa770e4f95d69ba0689b2c8

SHA512
6e6b73a84c6c31e3065a110580a957753361dd24b91d819e2c9ee54c3095cbdcee5686dd360feb9ac53017f87e0ad2db640f96bd2399b0fc99757ae4cc89ad42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cec53154fb4512e030f51f061f3fcae

SHA1
ccc6704a29bae8a7225c9676b17f8743d0a84044

SHA256
55c4e2b14b41bf833208e454a27d6be293f0d19665a366d12b93e5d9393745ce

SHA512
c142ca81af5f6e8ef350203ca4ef5286ed431d7e16f63859d2697337ace663dcca421026f5d8c44eb62b1ca861cda4fad9ccf7cef196dd41b914f24c65318a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67eddfda24bb885d5c7f85d7031374b9

SHA1
a920063f47d54c91d09ed825b3cdbbec7abfb9a6

SHA256
6e287c69a107266c2452fa2dc0b7631df5e8c581b356e2909cdac80596f49573

SHA512
5f52f9f20cea1f3c5d6a01fcde9da7b3121787a43526d849e42ca007d4adfdab63ac6be90dde266e1f8e9e196470f69d9f2f8608c8ac980c47130ca24fd7b9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f021b6831d7c42bd2ddc8af7da2c246

SHA1
4b94565c221978c958bc3f8f650776f2776d3e1a

SHA256
283cc7c5867c3bfd0d885bdf8258da8ff3ce5b7e09225223ef82107671adb9be

SHA512
6c05e5875d27f0081c3d18a68b53b3d8c0466303ef5eec1babc9baba73de0ccc4b744a2d31cf5681129cd9b6abaaa78e79296f5161f1e5ecd05aaab0380aa2bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c69d9ff7eb92d9a30bcb9a2c0a836e

SHA1
9bf9153177c186d6ffb206fdbf97df7736431998

SHA256
818de336cde2811c5dd4822661f02c137b267476a6e587a42b44bc470876cc74

SHA512
86f65ee8b253b69fdda6694e899f2c8efd7ad24f15f5ea71366aa1009b3b54fd4f251fec3b7292de530ee813e5f217d0cda031b927026b59f58fa3d053af787a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69a648c6f30f496997aec438bf936bd8

SHA1
3bc4f8f1213ca8f45ce1eb12da54929d1ec108e5

SHA256
0cd6eb76656a103ba4acd2ba95524b3321a3b65f75318fe2c22518582fb33f1e

SHA512
9bad40f8f1bb70f88b89c7420466f848dffbe44a2bad48cb7ffe949d44e5ea4e0badb4310ec607a6f17d3749c998c50d4b976f4003c528207917e34892ebc9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f96c3d18816da35a9d47dfa8c6e897

SHA1
f6df37326dae5dd17c6f9b947b39b5d0db5fc30a

SHA256
da548bbd20a982771a56b7911569946d365a668f2f72d1769dcb9276e48a2d53

SHA512
1d747ec3b7227a3b5e5ae5d4f22af64ff0f63fb88e1c1a3ca01f417fc7ca12ed43ebe8c660893d8fc80689b9449e71606a860979baa7521ad96ee48fdfae4ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15fe9550485f9075a53621ac1665ec35

SHA1
ac9d7675197f5fa4ea0c7b9c73248531277a2e14

SHA256
ed4a724e377df6d740433355b86cfce718b4b1c70ddfacaadbce606daca6d54b

SHA512
3f523b77152e1f8c1979ea41ea86f6b32a22ab590e264cf3f5fac7362989e0c4ef77f9013a31681f1d3d4859c6eb6f3802ff4f0974f23c6bed0272db9a540534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cec7ec98b06f4feb1dab834d815d8cb

SHA1
1b4624be147d21d26d342e79646895da44075a1a

SHA256
83c0dc0a162553507d943a396636b75c7e4a1583e1931f81e7dc2384caa79e75

SHA512
ba2de716f42ad250448577fd6be0c16226af1fbd248d72c2cae796516fb40b974bb9747c98176bbec05754180b40489f17855df5023be987e75fc21012fa87eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6944.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit