d4bfb1ab671d66ad9dbac10aafefe72ba8b25176f9dd0114281b37e9587a1fb9

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/errors.html
Size

1KB
MD5

2135fe2bc9cc6a51cea552113e42fb15
SHA1

5c8f8c983f282b6efbbb70eb737ee8d2e21a915a
SHA256

33c50f6c5042956859053efcb6db867364c790ccd59da81d55c84d2f73c225fc
SHA512

f56e7d07e209309a4653aa1db8c122da925baac5af673c67ea247122ab5f9acb02a6c385fa26c7dd6f72206e0d458ae694e997b6113b8239891e8fd8e03c61e7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410763107"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{189BA9F1-AD14-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000062dba7a9325bd41418236d5f46128eeb6b0ef964f261d20219398c2c28a3582b000000000e80000000020000200000005e7c4ae3d127d1c676d726870beac99ed72dc17647f08f5fafa81055c9c3b23720000000ad40ae22e809a5a08981d334669c51dfdade983d4d331f0c7561fe1ecfb72a1e400000003241d7eb180aa4e9363ba3a4b5308e9f9df4473441298a5b52b8dd7494068dee334fe509652368f46d7eb277572909f166567d461eea60eeadbb12fb4f0c52b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402a65ed2041da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f71cc2d2bb617a4dce1570e5e3ce9555b2cdac0ea70c3f1d9f435f29e3ce1d89000000000e8000000002000020000000269bc81318effedd028cec73fd290d8e683f118f368726ecd3716b31dfb0b870900000008eb47a8f43eb7c8961b88832fd634020fc4df6aae5a6bcdc59894a0a35703837388bcb377041f070ba3d5d297c4e552f66706f33117e7f4bac0159f0abcc03c3ae7a1ffbf6a26018e81d68f8dccde2019691a9a258caa8872a7c30cd7936487b14aeace638ff70e47a69affa2f815f15149b1ac2f6ad27dc392976530f8cfb32a01c7fb07e92e032610d41a2311c290e40000000ae3146bebb617c36f345dd9b38b915c1e3474ea0612f91f3b549aed3b4c87f83460b9050e4d27494d415562a98c3eeb04606ea979c025fc90d96c16b762033c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2092 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2092 iexplore.exe
2092 iexplore.exe
2692 IEXPLORE.EXE
2692 IEXPLORE.EXE
2692 IEXPLORE.EXE
2692 IEXPLORE.EXE

pid	process
2092	iexplore.exe

pid	process
2092	iexplore.exe
2092	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2092 wrote to memory of 2692	2092	iexplore.exe	IEXPLORE.EXE
PID 2092 wrote to memory of 2692	2092	iexplore.exe	IEXPLORE.EXE
PID 2092 wrote to memory of 2692	2092	iexplore.exe	IEXPLORE.EXE
PID 2092 wrote to memory of 2692	2092	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\www\server_www\rootMD50MA\panelcGFuZWxleG9kdXNvY3Rv\tpls\errors.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f7d79e4cacc749e614fe0e55e90e655e

SHA1
62a9b141feffecd119cb982a18b29bd4ccee316c

SHA256
e73c43af56fced7c7610e3d4c9ee944ecd4c0273b50ce6993b1f61912aef1a29

SHA512
26b42a5584ae9895f9e1ebea4427bef4b602a4f2eb6eaec29b42ee12318feff2437f9188b71f54f5cd75650c80969816689405e58aa1617fc137374bc4c514a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
48d0a89cb56905ed9f22bbf022769631

SHA1
896eeac3a4f940deb42e101406f41b55e8cd15db

SHA256
cd12bc45bd5f576cfcee3483b9dfd0ddea9de502b63b8c5ef403e136cce93670

SHA512
5467c505e201f06fe6f6cf979e519e87fb314e846f193bf89ed3c382f1ef8b0b171d8efcc5c98f94eef1fd9df9f92b71b8b7791da3f5500cc8f802ea9dde3bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
21f2ec038e6ff32bc1c113a222abb726

SHA1
f36496e0af8a3dceb2b23f7a33acfedab374d38c

SHA256
cce4b3e402ae7019d0a98c56e2b839db932d2924d429c984411e1bce5e5003b7

SHA512
f1337bf5f29d953d0272cf929a879c43b1794ab0d054df58ea62340a35610b4cdfee5957ca834a0439a58b3dff1dc99f9375ebaf86d247be066821f03d5fe282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c049e76116d02edeb2e7c69f34788826

SHA1
23f2d5f32b7ecc5062bffbbf2f19e037b1db64d9

SHA256
715bd214a762755266432963c72f9d520daf293446cd6343f23cec033ec26469

SHA512
a08b267820fc3cd065340e9ee85920c0cde03a89d6f1e402bd61f8d389133eda125893ca71fe574a4e897d98b6323b89f635be19e6d868524d9f21197313c879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cc7678077969fb8c636354ef26ed1656

SHA1
ec09a241c2fdbd2bd07d937f795414ba77656aef

SHA256
85d5947694612e71a9c653e01952b5e85fab097344726a8264193f86d4b0bb33

SHA512
83ccad35ba4d62d08b13540e18316e69ce32ed51d3e8bba70baccd9a6ae7537324c7d2f27bc6a8b99b514a320509126dab4574b10a54c72d6611b55ed305cf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c83fee953bcbe643f4bae62c4948442c

SHA1
1aab918ce6caab06bb8178262495c27f8d241f18

SHA256
404d7c8892cfad8af62277a0daa66a1e5bf39671b81ff5552d7f29380a94766b

SHA512
5a265296271a741e47b88cfb6c8cf68aa597c5faf18eefccd3f099f64580c97c78d8779763941c92de7460f4dd3609fd4137bf5a98546c215590473a2f4c9de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
624bca3ff01dac45bde4eee3391211a3

SHA1
08b285dcc465b4d4de0f4c168830497d83f3a18a

SHA256
22861da872dab6c2d36260b26198c1909fe576ab5d20bd0599ddcc1eee0bf1be

SHA512
1f044a3e7ee162a9a9e76dece88902f75c2b2458d313fc5bf1329d74dca65fa615a7579cb7aef8574190431d2ccd54494b3c2c73cf61708bde8cffefea29c009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
25c6ed3e36cd4ee572b09c41868a157a

SHA1
01b0df0e052f345146a70c814d6be619f92a13bc

SHA256
ea46e9febc1585ea2fafa3ffcb9b83fc7b0f3fb6d15ee77cc96671f91893f1a7

SHA512
47a83f4d935c2421f8eacb2a5148ccc68ca11454a1d4fadd15992091c588fd629909ee06ea0e7980297a6faecc7b747f38f6a91e442c929b802ee00d924ba012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bc0d026df79e22cd88c7a147500cf5f2

SHA1
9839189615ea8417806baa749e7ff6d0a0e5c1ea

SHA256
b73bfba0b4806be84a6ef18d9d10e8f9df3d25b685dbd0ccd90044e3cf49c7f3

SHA512
f34aed7112229d5afca76027c48b91413281e6470cb97ff81164af2518084e9be259405cb88a0a13abce2e04aac843ea3ac4ed73cd87c5fbca87524a4236afcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E5E.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FD0.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit