413f890121c68f5b4fd9d0ef8bc410eea486aa4f98dc987a6ca317fd64b69ecc

Analysis

max time kernel
139s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rederp20/REDERP20/Admin.html
Size

1KB
MD5

96bf675a5ee1d47bbddc05a95d14e230
SHA1

c2426cd89528610e8c5be54235f4066865f22a96
SHA256

c24d882b2baa45268b579f2e92ae91b95d32b8f2a446d904fbd87d36141f2225
SHA512

ae4b9937b27d3ae07580a9b77f66c58247c4b2b64b4dd7f8d8a6aa3a9bff8fabee6e4fe86d94c345923201dc4ca158fcfc8658eb20749ccc0e5c5932bd714f7d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ece09e254624aa43532347f12ec4df6f655889728d17566be45eb66534abd606000000000e80000000020000200000007fa585f53fd6efe416c6fcf6eb1e1123ae889d74f215b40b1b274f7099b4613f20000000bbe50bf6f61a6dc4d7795d8b0f4a2e4d6375d82946354b7af188e460fb0a17584000000085440a66beacdd68c5624c84e3def3fe12790e68314b5115efc31619645602dacde2ee1bb8d60af3e0ec9bb295f5f675079a8d58be96490aa36dc9b92c1949ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d058b94e2d43da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410988324"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000af01e5d6de72a2cc3ae97d6f10e368f1af62fbeab986af00a70bea97c10f2c5b000000000e800000000200002000000027e269d523d82d5b509857b04bacd745438c2030462d2bb8ab63b0a0a4b9bb389000000061c3f02f4e6aaa867ec4b933746841fa51ced86fb28985145f4fe9df2a35e29292447014cdfff9528e0a9eea813ed982f3e2eef11e1d6bb79ff8deb04de35aaba0f055195bd3793039f7aff6be703d6c4063ea98a23f5c567ecdaea55581164ba0b35684dec354ef96f42b1c1dd90182b697537c26c55c9593994d3d6a42e6a8a00a9c6e03e1d23c69f37b3c7e141600400000007c0cb1f600bdb0de57610f4ffa3b6a25b527dad9ec37c1d2c3e796dc2332f3182e3db0dfdc374facbae44da32c52f8e0a9de832b3ede6c93e6497572c45abfcb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78D53121-AF20-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2516	1752	iexplore.exe	28
PID 1752 wrote to memory of 2516	1752	iexplore.exe	28
PID 1752 wrote to memory of 2516	1752	iexplore.exe	28
PID 1752 wrote to memory of 2516	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\rederp20\REDERP20\Admin.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdf6dfb127100d618009efc57aa39241

SHA1
03b0ba835f88a1d0e6c9a8acbd1cd5f001310158

SHA256
47125045fcb9c430f24a486958f2a05f515d716665b19ad8b77b39813c3d5955

SHA512
52084da7c0ba45fda944696c58e48a4f3478f9de6bc9852012c37e5a14f3032ac263dc0adab340ab7cc9790c45baba08afc4ea6b85fc80ca3b4ba98e1609c4ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a7e1780b8801bdbd02029f3124e95e

SHA1
4a1c517ee95fc4415ef36a30b50f2f3947de2c24

SHA256
a6e8075caf72c7c74e8eafcab05acec5466d4c620e956aeb5708b4c8e2defc4e

SHA512
591ad103410bdfab6b65c086fa87c83b93564de420625bfe5b54d26266c97cd98df3af7abf1a68ac0d5994f0733768e83416e1684003ebdceccc5d1e5d9006e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6662fdc7c8f51c9f5b8afbc5864f428f

SHA1
73668f117f7105102df39d675603727eb1cfeabe

SHA256
a5c3c482bae7f1e764d628417b0a6260d5d43fe2539cd4b969b56ec6d1a9407a

SHA512
a8da6c51a7f285cc2debaf03507b0699a3594193a6cf3da105a8f74448824a94bce741d35752095b515247288bbefa6bc640f90a6b4bb5dcc3fabc8a39f71056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86826a0da137e30373d7713c6f710d59

SHA1
c34149d68c3eb2b691d8a8c6f0ee9e65bd9735b8

SHA256
6a870594cac1f566481c1800613a33791812622580994b1270d7e68b61d6098a

SHA512
08cbbb29af7de3bc68ced4c546db230adb087b69fe4f741d538241d39cd767baf416b3ce60045ef3b65a8776db7804f06fa078e3145abe2f1d7ba8d74042239a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afba763ac39aa5a2290df47c236c26be

SHA1
c4f5795f485a4a4a17a4ab686df5abc2c2ed7db4

SHA256
c8517f23cd27b56712edc83e27b6ae041a5ae0c09d6ff692f97686c3b6cbc292

SHA512
763a5e0321fe76a999b5aad5b9fea692e531241a5456bcf2ba5c9077f05a19d30f02eaadbcec4adba46c08321d6909ef04d904509903962d0f054d3b554ad202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5768050ef7135ea5c5035fb390df1c

SHA1
5a2e04e6656e5eafd3a1e60cef64ca8d81a70d04

SHA256
9b028a061c5946b7762aeef4148a73a171e3c4198b7c926fc774a17f16916f53

SHA512
bf2d12903312cc2b24c66c9dec474db87e5bc8f425623362ea2401ee9cce0093a328b5433df341f00f6b642c5a30bb73c797cf15e4e0cdf3b43fdde1f70bf4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2252748b51ecb32c86e1b7cc8f5877b1

SHA1
252e9df9e1a7fc7112a48c6b74252f968f2efe9e

SHA256
00e474436f1fc4e5c1778c669044f6f86257a48364a9aeb7fae395ab04b84d5d

SHA512
8034084f178a9b1383e3b4fb0bbfe0205e4bcf493a16f758deb724b05394356866e3dbb3168d73609f969934e7ad7ceeb6926c61c7d042b38430c79a1825c9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7fde748137281b56f1359f5dad7c09

SHA1
df455be44d42c21e2917c88d5c10caf906b6fe67

SHA256
8f929a30fce5e155b4960280d8fc31d267699b43d50a917b2f061e89cd3b49c4

SHA512
174d937c48a1fb8e56946d12f10703d1933d6c0cc06ad25a158f2a81dd21b693378e21c03e773e84a669ed961d246873573e14337c05037fcd9ac1284cf06e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52c72fe84b6d3f755214a8840fc910dc

SHA1
5869b0ff5edc593ae80430daa7884b5f1c732df0

SHA256
6f54bbca64feb642cee1c3644a5516cc97593bc5249fb67e8cea41ef67141083

SHA512
7adcd0d879e7e68946ecb76bbc66adda43a1644970d0acc2103bae94c4ed364bd9c58908f6093e36cecb9fdc7ec4c5a47ac262c22aafac68fc5ca42edf29201c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4fb86b8b48def212b242f6e2b929ad

SHA1
b1a10a9cf9cf34851e86917b6f323d09b49694fe

SHA256
3e84e8436794d0159a89d85572e77af7e299b6dfad1585216c67233380132a3a

SHA512
608ee43db08ccaa0da2ae69e180409d179acebb46db7040d745d0a3f2ce1ac94bfba491ec31d2e757d0a29361c114df70f78bac61fcd071d72b63d36f580455d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c810fe828815d7bd44fbaf1938cc4cc

SHA1
d8ecc75c9da4b549eaa9a179d58d406efa4ce5b2

SHA256
b1ba7e810a1a3f79265e1eff1d1bfef75e7715d7b4777d3617585f946acdeaed

SHA512
d508f9be57e8bad45256a196fa9e713e7af4a6d1baaf3967d34d6b50e481270062586e569ec5d98875ebb45f316e6acc2777f51eb2a36661029e5c29725b819a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD85B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit