hxxp://aadcdn[.]msftauthimages[.]net

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://aadcdn.msftauthimages.net

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B94DA31-AE84-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5007f3329142da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008f2759956b27089d6dfed6aefef6c32e32a82e1758b0c6bfaca1ddec2cfb62dc000000000e800000000200002000000042d72fb290f2ce58743cb29d30e3dcca5a9e3547acbfca01990cc20afd338fbf200000000735141980d65759a99af2520a1ca22073c34f7fddea979775274bf8f2ad993640000000da401eda160fc138f2df697860d526a2df5b4e8326956dd0cb0735d474eb58196c283f51654fd45e0ca3e39370e746502766a87925f25c363c823214371c92df	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410921270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000610ee5c4d831c8f2c40954d55dff2acfa9514e99a6fa14c1ddeb36501f26f1fc000000000e8000000002000020000000a274741a12e16fe7a800ed165ec3de79ee3eb6faa1305ca9cd86baf3ffc6f4d390000000b25feb951d6841f0a464d51f915c73763fc8ed804679d1cd112f865763e6b3a895f50c0c49bc68c0ed0115eb60b797b1509182ec7d09550421aceed049ca8c11cee2dd0835145d4c5d52bfd2c02ef00858ef2798fa7a269442100f65a18244c43d626584cd79f27cf53afd27e36e99939afe7a874ab939aee035e37239c80b4fefef1feadef35dff21598d0c8ea00e69400000004f32f49c953381542784c732d47d3251b86a2c6cdf2518e968f7279dd8b0887f6d76245183aae62cd38d0adcf9824c7fd336cfe3faf9a0b328ee46f45067995c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28
PID 2084 wrote to memory of 2316	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://aadcdn.msftauthimages.net
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28a476b9c58afc51e483a21ec62b943

SHA1
14e677ab795a8c6d66a55c211ffc789efc15158d

SHA256
ea41e48664eea663bfcee049a5849ff78a93986179b9ac1231234eb2542d1ab7

SHA512
4939bac8049a74eddc1aae16e662ee393b8ee68fb0e5b8e6c7ce31bec84b55c11cb74486b9a8025d02fa49f85a5e498775126a5101796f025adaae3f4e7663ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a4feaf59a9a45a8044cb6bcdb36faf

SHA1
72763d2fe8f2c454253b00f61cc3088381ef5c01

SHA256
d38ded6e166da65a7475774e405291806c99411fa5cb1812976549f6aaaf863d

SHA512
e926338513aac8120aeddd3669c3ba7de7b0588fd442f2571caacbfdfb018f1e12b9a1611fc82e22b404a412256ad134afd7d85f2611c6c504380ca7da5d4f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b3e0f7f0871097c3efeaf825c3741e

SHA1
fa47253e9a106acde0e96a76591d08e5a684d622

SHA256
cd15b4c8659868d01711638e9bb876a548396928d87f18b5924cbbf271aee140

SHA512
49a74416af9d443a73b45a1c182b74208e8b89356bb985a74d3242d1453b9b07150a0ccf4b1f6dad0f9fcc84d274ce08d355050f77ad711d86f6fade49f62993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b3b03d6bd11bdb0106308ed7d54c66

SHA1
667f1a3994277af8454c0d629605d4a3f09e9ef5

SHA256
d43f4cd35f48055d3e414652ee539818688d78aa84c8716f81cb0bdea380a791

SHA512
2eacaab5ee542fe8933996e54747cd8e2e30b62dab0320067d58e694e7b42fbc98d2a325056cf287d99a43c9695683ca26fe4fb818b624cec70a0a9029fbf9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
896b30f314efb828e8bfd08c7408d951

SHA1
2bda467e5caeb343e184ca2f133785a648471d94

SHA256
c75c896ccd50530d41bbaa559fd9bb47bc2d1922004e2e6e0802f198ead48910

SHA512
d8078816bcbada663e62412d5b6cc1212c7ea00909c0437d380f27d2f7df4ab1de085972068fc5bf2e40a6fb0da7e073c0ceeca7fc4396d17012fc9dbe1c1b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b14ab042f6be66a29ce0f660b4bfdac

SHA1
4c7a480cecc24849bac58321f1e6bdf98c0ccb43

SHA256
9cccf4222ec01921370ab73d4400f0232d623159d1aa1af2a0e28c030e751568

SHA512
0fb9ec073e52fede1670293839649cec039bfe4c7be293a4206f775f6cbffcdabe684b9826b19aceb5f22f18b63e42f3546cabf6e7640bc0694458e242c2103b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c643d56252cdbf6375095fa46c8f061e

SHA1
a686bd21ad16e0327e390bd73d5cce9c231aa784

SHA256
26353f9120ba8051548499156df61b14573abbd127d8631049d96f18dd8e3ed7

SHA512
bb2b2ab6b5807508d1e93e10d15ccc260a8b9c35a241019de51c51125c7f9aee6537fe3817150477ac80a5d825ce652b398d6c043091ad420024f77a2d93e601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce07030f14a84eac09a9b24e536b19f

SHA1
4ceeeacdf2440dd377cec04dbb5509e11200da5d

SHA256
de8710e407cb7d223614a8fb66734b902b04084c71127463d35af433e14f107f

SHA512
3e33854daeb1860a11aa57191438d21ae5cdeb1f0e2cb14a875fd5ac532d95a95b7c1eb0744145f2c6db8fead0cd9549a4a4dee9a949fb9e877e0f23d44f7f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a97deacb4cfd50c1bb6dba79c8ef3840

SHA1
0806056f7dea92c4b1a9f3d1042f813683b66b25

SHA256
d69f462d6198b23303a32740c87b2d1dfa63bbe8b1042db27222a9633e2c4c12

SHA512
afb4d91e15f7e8fbfebb192d59d5819edb3055aa18ce89aa5c86cb8d657bc272f000c95580c93a47fee341308398fc26547c220bcd3a79f90c103b7c7f2c1cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
731c2e73772f6907f55a4d38c138d3b5

SHA1
868fb0efb5c747db2ab4854d41171bcac17ff604

SHA256
c0ae49f32b4e175817aa330f098157da03f21c695eeb026263c203ce1e4e2594

SHA512
42e12b333bdb45f8930c7f9758ba59e1dde05c4dd8227256debb6499f7698f951304d4c1411557f0217caa31ad5654c08b1f34f8134ce3166b91e243d9735993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba088cd25d85f4860261565aace1559f

SHA1
72d3241efbfe2ad461afbcd92e78cda8ba921878

SHA256
31a3e15b40cba8be4dc618451dc775c38afabf2da50121736ea244ffb3b3596d

SHA512
25019f88b93ee085f1974886bd90312664e56b8ade21a765e090ed6c1271655866dd2c05da913e0807feb4d38797361b976a464cb95f8fc335dfed1ed3e7c5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41c72d9da563e24148f56be3a448e693

SHA1
17f14aede340ca58a38d9c89e0c96a752d7fbc07

SHA256
7682d0ac64af72976bae354b0e5a29dd362c089702a4bad71103cdf798fc7ec5

SHA512
507318972887b79eda5cd2f9391d1765b6ac4d7388cb6880c855df76def95cc8b8a8c4ae423cdd7a766e7ae9a78cb32a58093083d1f8d01ca0c2e1dbdf8ce1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6bb49cda1c5176d1cea4bae7c986795

SHA1
f90d39176a261940930fbb2b0e1c0d8ea88edfd1

SHA256
56c814fbd794cf93e12b3403cfc55d1a5337ef2e193297d3a089ce8e4f3fa28e

SHA512
6cccd203dbe735cef9d442afd532f900f6c5dfbf18bba01b98dcfdb3473e5c4e1e141e10330637628cbab867f1d8b0817363eb860c4bc3db6d48d18ec6149a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
971865b03fabbc7119209bb62efa8a91

SHA1
2955077b0261d0afb1d8ebc4376e9511db96c819

SHA256
1bee9a892ec1935387f642c4a477f071e8274fee6be9637810ff9dadc0e8a257

SHA512
f4c8479c4777b1041434280895834dfede793ad6d3e760290672ab66c47a901322f44b2f54ec5079f77b172fab0be377f7992e69b421ca9301c252a6b7627a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eef5e14e8e2e5592a3d302c46af1e866

SHA1
829349a57cb2536059a0928b04f2d7645da76a9c

SHA256
8aaae90bf459d54f439a6a2bf38725669e461f0406f941c3bd6ab1209f46fdda

SHA512
fa94b884a9eee396d37cc1395fb5e6f2ff561a56446075d2a756e1f66c930b56c43fde7504d63e6b415b1ebc6db034ee4989315c567eb91f96c3411cda76de34

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA084.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA164.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit