6b7b24e5eda2f209fd6367d6b6ebdd52bd14e4746e2bbbf783fa8b60134c9b04

Analysis

max time kernel
122s
max time network
170s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

weile/admin/edit/html_edit/New Document.htm
Size

573B
MD5

c5df31a886b6d6fe78b8f0831c2c61b7
SHA1

f487c030e8e08f6aa7e253003e221d3587225fc1
SHA256

8591524c7d7cf91f55895f78246c139a2c47875d30300dbbb930cff6cf883135
SHA512

94af4453f2f30318447f0f0c5d52f1e9d3551091bc05ff5538f3d9c5a0bbff41961b539dc7c99c6bd4b9179a52311e68b5beb4321d7da6006cf12fd0576c7c74

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c9f587e7e4dd06469f7d757ffd50ce5a0e99b677af6168188d0c9bc7b30ea2a0000000000e8000000002000020000000da51b777f3ab37b33cfcfa179fa137a62a5c02687e48be8ee6845c27545f4bfa9000000039f5e8391ebb3b42dab402d4211144023026becf7f85aa46a17cf1b517e7a00a7d609220fe2331cfe367a47785caa16ac4b926b51d8ccc4183e5a109559604823b894442da5f58adbd751f6e2cdc574145a88eac6086874da24ca15ed680b3a584bab8ce07a6de4a7b01c91a6d53b1bc6e7b75c8339e3692342c99ee200e74ddf8ec4297c802cd53ea534aad3170761d40000000db381223fc7d2e296cc6dae224c58f6d7c772122393c75bba4512c0b2ea1da8f288de1840f0af3f373efd547a3b481df68e4633eb74391290569677127460068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE1232D0-A8D5-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410296627"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008df2241743ed3c3bc65747b781d41bf6005058d8c49e6d1f2612a9bf311523bc000000000e8000000002000020000000e411c5f60cf16a3b81b88c3d147aca57200a52cc1a18b591153e888b2446dc4320000000820e896d537f1d609d00cdace3de543a551261a9584e901f6d8065745b4d8194400000002dc00426d81eab1bd3afbc00527d20589f08b1e5969da79870825187efadfb64b60a21d3c9a305136d6addc28e7edc96772a2270984aa2e853deb78105b88b46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ae9cd2e23cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2908	1252	iexplore.exe	28
PID 1252 wrote to memory of 2908	1252	iexplore.exe	28
PID 1252 wrote to memory of 2908	1252	iexplore.exe	28
PID 1252 wrote to memory of 2908	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\weile\admin\edit\html_edit\New Document.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964c44d1c2be315eb391d5aa7907c84d

SHA1
3c1cde67ac0808fed7d0470cc76b9dbe67e46230

SHA256
0bac6c421ec392c814df99a0bb729315836b1b832879e50df38d048d4edf34af

SHA512
4e8ca739056e6fd9c46dcb7fdb426f90b7fd0a2f07d11dea67e917f53e7864d9dc2810c8552f9160546841a4e19a019419187d1d84c4bcee905998e72846c876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de37142408b9757ece6bd4662371a23

SHA1
4fd08c297b0d3de901e7ca4a38d496da355e03f4

SHA256
306cf72db161b110902862fbb73545e62a14e37007b4c884eb9c44f74211b6bb

SHA512
559b224c439b94be83d03016299e412bd12d30b9d8f48b4a06d70674dbde6cb996719c3017365e28682dca7b6bb95113c169a2b360a7719725292d77a68b588e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10b0da92144f2cac072e71f614d8ee05

SHA1
136a91a243ed1a675367688dd6891fd1ee7ddf35

SHA256
c8cc39f9cfc2b10c4177cfc6613e37bbee11f83092cb7737c5044515048f0808

SHA512
ff2a3bdf25f4ae89f55782752d3cf6a8675f092a68c2a56aefad73f0f0f644c68fb8aa7410f676b75944dbbc7f12aef5915c8bfe1f34b54c4637c9bc1a1384d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b9737720b421765a2abe94e60e515c

SHA1
6c7b16271d0433f93a3f47700a12613de6904d96

SHA256
763213ef882dbf4dd76e1aed06f0d5163be14101c836d1d5a7675ef7bc9ce1c1

SHA512
bf3b6cb2b8b39eb00d1e35fa125224e5bd138d5519b12f125c1d0bf370b71ae522761ce9b209558d391f5ba00130e48f2bdd4ef76536f228c09069f52b61a236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba91950a5ba58242f6b678577b3cdd90

SHA1
ec43e2ac8bbcff99a77335d93c854294d91d07a5

SHA256
fe9186a2f0ec99574fa3f03e6f2e4e93b5f25779884b154ea2aa8eb29681c19d

SHA512
863b04607dd5ce2141c79afd6adc9720f611c5e744cce2013eece3d479ff5a5e3de1d4111eb5a287d3342d38a1d289e86bcc0266aa509f3aa4358ec960eb5a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd23ecea2306746443c6425d225f757

SHA1
966ba5c537fbd5875562351afda79ff709de6b96

SHA256
f42e196eaec7d839813be431611badbd80dc75c7629a6f765ed59ff638cee3e3

SHA512
b1b9acd947a547f80b2a9e4ff2cd0c62db0a1a0f8fd106a84eff2b2e3b0df176c72808b3203e00f4d8b3717def676526634d1881c1076c238c9ec8f5a2e7a7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5ce96b0c7d20daa3df4d2061225bd6

SHA1
a3e7db43f3bc19b72f5ebdb5257c51c6e57dfe33

SHA256
1a16557f0f3c87fbe2c70e225d472f9cd8b865d7d6be03f31ec56e0300262485

SHA512
5e2686adb897b24b7d34063a43f9be087a37fcdeb16a61b0eb23141c8f3f4632fecf6f4839cf7f521e145e2befc82d68b1004715c0e45dd637888325aa17a786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b88329476d38479b5b346585b175548

SHA1
37c1450192a08779c2c0c6242b1c26065c2e3db3

SHA256
bf4de0ceebb73a7599f65d59b4c6483d4ded51d5e58a19fc61f55ddb613252dc

SHA512
ace139a4c2edb3b821f09790122faec3aa5a480dceaa3294bf549c07ed0c966d65c484a602b5873b7b7981373a8a2c837b590dc88fe6eaf1c8e57a9a7f734ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC03.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1616.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit