227a0b91b1ad2a17c05f5386bb98bb1ca49827470a84fb30e96f872ac4c9ae4f

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uinfo/upload/system/application/models/index.html
Size

149B
MD5

362a648cc43551584abe596372cb8da8
SHA1

3952c66b6ea349bdc9565a22c08d324c8be2ac86
SHA256

8571ca84acd58a94590d5e73a651cbf580967fe36e13b8487e3e1e4d5f58bfd6
SHA512

ed2528aa1ca2a408bcfee90eee1387e9e344eb1531c39d7292666808d63f7859fc150c0646071bc35dacfd16911bb53ba60caffe87f4ea198c7e586fd4aa93e1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e73fc0eb43da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411070113"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9768FF1-AFDE-11EE-AB4A-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000278fc387b40b605870eb726debd93f2f1921a5bce08edbb83af3bb8aff231a8c000000000e8000000002000020000000b3e2c7b00e7011f6c21727a5ba31a23eaf80cc9e8eed4cddd07c4776f9c11b1f900000005718a53a14102ec7fd7be807ede5525577559bcb894c0d9092ee1c177b1483b16783ade6e8208b64ce14fda4148ff8ec71e42ed043a198b767e5068e4735961b92b7a06d25f65f82cca34609e502d183c146926d6df5da052568fd3671dba6b48ed3fefb68e070da128e52aa04f7a5011f560660ed33e30426f0fad363484483b458434792d4cc117451df390a7d20b540000000879b4422956c3b3eccacec2d5e81e2cdb8d3542d3ad42630d2259cf16e248ab6bc6b4eefca3fffa5adf7178da2b9d2edbc5178ffc8ffca6e032223c779770f0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008e4f545e64e13c98d256f6841280e42a2b6b8d4a4c1e7aef7e7d5179384aa542000000000e8000000002000020000000c3db604ab9772b51095239b086863ecccf002cf92290a6b90f350ff20c59e54f20000000863290d06e7bc6e6f69d70f9ce924a91a1377efc362d36f3be20d7182f4cd8c34000000092f929810c99ed65eb233c8a532be88f47f7ea1a857cef9640bf80de9952ae367e76cde4dc6e963fef354d7795789a77738ed0d247ea851a2ac0233942bfca68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2360	2516	iexplore.exe	28
PID 2516 wrote to memory of 2360	2516	iexplore.exe	28
PID 2516 wrote to memory of 2360	2516	iexplore.exe	28
PID 2516 wrote to memory of 2360	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\uinfo\upload\system\application\models\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12259e1c364072e3fcfe3c290e754dff

SHA1
e2b7929e456064406bd7b33d16dbf1160ade4f20

SHA256
b20641364806338acea66fd53bca769a1c5e8e999a642944e58f682d6850e13b

SHA512
97ccb6b745b52ef0878cf6c18a92ae3b47c8848682ddd79f5f9d05f9227fc552d54325e31f4adcb035564c7f6674f4e12ee76fffed7443969ce11d134a2debe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7012561ea4f621e11d137fb405e5b8

SHA1
e035dc5a557fe70a6e75fda2d82ea22a78d82bb7

SHA256
bbdbe269ea3885d4f3f1ed0e27fb9153858690caacd7057f452c1fddd342dca8

SHA512
417e060878583399c92c64486950d3628f0f4ba970d0ab21e4ea645ceba6a4bf17867726627abe185002747424be452b63fa7ba228e773a345c3fec38916ba2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea234140ab9773766086da06d63bb11

SHA1
a937fa72b78ed75f02cdea0f9ffca813672dcc38

SHA256
a35f6197bf721514efa4a4f4da2067aa124ac5265fe1c010054987cde6173a13

SHA512
cae0316749ce7cac3235795ccdea33e29a277b348e276d627cee10904b2b4d818ce8c9b5521f7f2520481a20a7215cbcb8b030903adb1f9d6b6c1db52d986d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a7fedd08a729701e4c280923cdfc23a

SHA1
2f6dce10585828351f82fba83e84bc58dcba8a6a

SHA256
3e44073cbd14b5b5ab9136374ae72b42c7e3b934c68b0f1f0edaea0f4145438d

SHA512
9e423dff3a320a25cd020654311b6349e5631f8a98065b7c0983061dbd8533cf162a32714810cf07e72a75cb7d66bb6d5d7e188744b3e28f1008fe0e5b7b3150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5baef8a3f40093e5580a2a5c18187ad3

SHA1
66b81a00193e9f003d3e2e025af41a2041f55f78

SHA256
571168069414c429ff6ce0b5479ecebe4e43016c2b4954801b99b9e6aaf01826

SHA512
8e937190d8ff5f3444ceceac28673fd791b55d3db8ee489e2413defff56d2bd7215f1a82107cb6152ebb48de2b162ff0e289180c80df07a28aada615a21d2a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c71dbb1e786afc5302d89dd6f398c2

SHA1
2471fa4c7518bdb5ce127c628625aba6c87da88e

SHA256
8990983188eb1b833d635ec595389be554973af907006fe059a49825bbe17891

SHA512
948420185bc367e242d6881a2df34ab7ea38dc50b60614a1ed960b3528b24f001e268b22dcdf018b2f1bcd99530af85f3d43d53c129afc07824547a47dafdca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbe1c81a9d685f40c9dd254c26db90e2

SHA1
00f51ce83edd3863da5744fb93a6714cb594e532

SHA256
f54e16c93468076debc7d6a31707ca479a1a63288a048a021e307f4d8d9bd8ed

SHA512
cbd9df3170baf4062f3ceb4ffd187a358746730c1d7e90474f585de45855f6f17e13af9fb256189f6a5f0ff20b0cc67d28fd53e94d5786f36ae1ee06153ae9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dadf975a0d2b18d7a730c0c8eb74b61

SHA1
8311483565e9a95214bc9f67dda4441341709101

SHA256
903ed0bece2cbc73d2ac25b81e134a8ba2e47c3f5569e93cf162ef6b9d999d91

SHA512
3b0c144eac497d2a3b2d181fa7129dff1016b47aa4bbbc38bd67ad8343f0c49288c2b0ea1826fe808bc2f139e5d7cd1e4891f31910755ff6a347823b2a12dbd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ad8148989d2cb8dc4f245813b8ff46c

SHA1
6924e5a3735c257e7b40778d4c70d2011b9a375d

SHA256
9c17a3ab333837d7ffaa1fc98b1d2791845284fcbead3cdf2b2d7881e9fdcf62

SHA512
bfb4aac3a482ad42647f0f0d5944303fb991369e0987ae88ae583de3fd8379d9a3ba9b97d33891e3862c406b25c9263e1226a256bb9ac773aa943445b538c2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab3e5cf56e79181808573e959bf5eb0

SHA1
0f4ce3a7522e99943b269ce7a4f0763c47ea1151

SHA256
bc21143cf2abdb74c31beb856192c4afdf5ddebcfaf5ac0429570bec4e97bcc0

SHA512
9a23dfa91f3659654016485a23dffaf8737f87a8ccc387ba1e9b6ddede34289e10f209f5d9e4eb159a78df779a1a8d6a0382c694fe530843e7b83653d1aa4ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00597565a52d6aea0a6d7637492ba74

SHA1
783fcf80cb8e707c745f453826334f678d60d7a7

SHA256
3ccc043ed23937db832e564682c11dfcbb7da92de22b6e198618c24b93f4c507

SHA512
cf22c99225c3ae0187f2526bd0cd1609762efd35db1f21757be27c3d6f1aceb123cd59ae6f77694a4d305e9afb74abf172ebed6aa38b7624d2caba20abad6c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1053a728e6725f12ea1f0708d7409e

SHA1
3e627729a3d37f204ca5d698be424bc5848ccae4

SHA256
6c749903fe7f439c6847908127a6407c27f658643210982150ee8ee81b618877

SHA512
da726c5592e6d8872ec412c7a05d040877d4c2d14c3f50ece39b9c9c37ebec8418aa9f3536eaeebff8c16e041246a622eb48fbcca109922d46663a895dc76c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f127d44cea125faff0c0395e94dfee4d

SHA1
a92aa94309b3b56e0271e61561228d55af09502f

SHA256
85504c63f8d7cb33727295717ea73bd544ac6123e1fda1f8d42f82c57510d4fc

SHA512
a31ef41a5b9b56a63d803f0904e58ee04be9bd5887f6dba06a9a0b44069ce14e1c13b32bcdc967ed2a51f51886a2ec23000a05415bc5761c41812a839c69ac02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85F3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar86B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit