hxxp://b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a

Resubmissions

08/01/2024, 20:14

240108-yz2mtshcar 1

07/12/2023, 20:50

231207-zmllhsfe82 1

Analysis

max time kernel
10s
max time network
836s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAF19091-AE62-11EE-93FD-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2920	2124	iexplore.exe	14
PID 2124 wrote to memory of 2920	2124	iexplore.exe	14
PID 2124 wrote to memory of 2920	2124	iexplore.exe	14
PID 2124 wrote to memory of 2920	2124	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://b9e62ce10d663d3d1a9111ad6e186af024320d2af46879e20ff3d3508de30a5a
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b20076a58da862b6d9342dbaf927150f

SHA1
66527e4815c39731231641e8aa5be11cd836ae04

SHA256
9fac37debd67c16928df7c84661c356f9e9db35430fb6834e7100138278d8885

SHA512
b668ac529108bc10297c3c88eb7d0360b5bf45d6d0ed829fe33c16946be905cee820bc7745df6e698e4c248029d7c45731079ae6292499225aa4d361e44e48ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32b497f5c2a4fb5be1672d62062b3f6f

SHA1
1f1f83bd1b2d31da1bcfef6e2d2ebcee985abc10

SHA256
0b0e4bf2ecc4770ba3c9863a4c6ae9832b223e0e72dd137d9521138667e8426b

SHA512
fee50b7f0f4ba07e2b3b6d66d4bdad2807cf0400747191581eb653eb9399f02891fb71b5b6d16d128597d126a87c55393546beb5d77aa3f944e32ce1d0c00331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e8e368ec3398e980ebfc8436fcc73ac

SHA1
a7854e8eeca8614163f6900fcfb551eda775fc4e

SHA256
030486bcaf375dfda3023c75470500ca79351292d95af5a8ef636b108eb00057

SHA512
1b35dfeccee07740c4810349f6343f6e375fea0f690ecf5bc410cd90972f2d3e92fa3322da261ada57bdc5fdc3959cb286ee32621b0ae2264d04da2652cc6f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9259fdd85ee7b8bd8b797392bed147c1

SHA1
ad553eb6d79f65c2431c1f68061ba436047213e8

SHA256
3423817ea2a9b0485ec3a8521f89a3f9f00d911d89c6b21a25c232ce7acea571

SHA512
26dc78e9a9cd5d2aee0514d3dee740d0d255ba8084725c6fc3975d0df9447eaaeb60f7076317a5492fc234b9db047cec870bc2c0142cbc12e9759fac1fdcb569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb0f579c66e30b349ec782d28497566b

SHA1
e45a16b1d41f3cd9e660151866da8b502c893f37

SHA256
77e959b3627d9cbff72b06ae68b64a06bab4fb5a4289323782674070dd98dc6c

SHA512
9e70ed39dea3d182c28a45890c2274df358465056cbc88a46b9eb8c8fe9a8a063d816b9c9c2fd8c2669aef6511d77ad6254e2252bcbf06c2694ca6813cef508b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8459479ce81f077fdecafadb7f47de04

SHA1
0065cd6af3abc564ab5a7bbb8cb4086f0ad49970

SHA256
44e667b85d03b9c307af93738c3bfdf34fc2af082e7c98ac9eefd66058dbca17

SHA512
0f95e1ba2346ee0258765f306422fea3bcdfb58d7bacedb8073871abb870157b20733fc9624a61eb33271f802c5b21782d4f294a716d53ae1278cbb08a1305d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d13d4008a61ef4bb5948753cf6984606

SHA1
3cfff4bbe21655fe133538f8266c02f5f9f4bae9

SHA256
7bd72325cb1b35587cbfd1eafd4d2e9372e4b4425bcfa6dcdece1d3fcc0a8a3b

SHA512
5318e5d11fc8bb0d222552c51afe1331e1125371b2658112d5b583aac47d0aeed82069851f66145b7177aa25f56ef3e3e3a8e076f97b0b828e65401e9bb486f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EF7.tmp

Filesize
29KB

MD5
a2c1256fd42218f0d460728edf928873

SHA1
2e5519be6fd0226c3bdedacbe5d93045e536e233

SHA256
7f4f67c184d114c1095314ac08e143d978394a9ad07ff4d7e83a96143f31259a

SHA512
a00335e971421ef68cbc562850b974f8c97b762c8825bdc0543937182a4384bfdbbc3e86e96cbf4aba0aaa2f0cc1b9dd974db3e60f9f9d769c996596b3f8a329

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F98.tmp

Filesize
11KB

MD5
82be5fe42792201dd5a901ebe12bba2d

SHA1
3dd745d6d022283628b01a67a2312d1e5648a5bd

SHA256
8ab300f12b28732f9e2648fed9efe68f287408672fd14c6bba1e24e72cde11c0

SHA512
8dfce038d015b20009a3a6c962ac095a51f70b3a9f9dd3960ebb5646fc81fa4773761f50b2a733978fd5db347e6c724945386b5b8cb4ffad7cc0cf90f89edf6d

Download Submit