227a0b91b1ad2a17c05f5386bb98bb1ca49827470a84fb30e96f872ac4c9ae4f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uinfo/upload/system/application/controllers/index.html
Size

149B
MD5

362a648cc43551584abe596372cb8da8
SHA1

3952c66b6ea349bdc9565a22c08d324c8be2ac86
SHA256

8571ca84acd58a94590d5e73a651cbf580967fe36e13b8487e3e1e4d5f58bfd6
SHA512

ed2528aa1ca2a408bcfee90eee1387e9e344eb1531c39d7292666808d63f7859fc150c0646071bc35dacfd16911bb53ba60caffe87f4ea198c7e586fd4aa93e1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f2f6a9eb43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411070084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d65f555d7aadc533b1c6ce0459b4ddfb5927085b68e2ecb5f31237669f46c399000000000e80000000020000200000009ec36df12de8ae13d0663665a8d53b76f37bc0916dc6f56ea56efb6f69dc799a20000000ec3e5f5e69edbaaa8962a46ba62a8bde41b0ca1b8caace9672cf146d39a3f3da400000005de00445ef83f576f74192e2eeb112bb753d0361a5803475e064e35487a876be421987f9d8119abcc2a8e709e23a1a2f160ca0d88e7f7193d190e62a0980f3f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D592A4B1-AFDE-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004202b337258d6c1cac9c9297d4f86517d452dcb0f1bad47417a9d63c8304f884000000000e80000000020000200000008fce642dad96aad1ad6bbf531bdeb44de31ad14c387ce81f4311800e11171509900000001b2f8f38881d889d48c53501ca291ac65e7d090d47f226d8e84824a49b1d77c3fcf7c53f6f0d14d5f16155621b6688d8d711fb1b37ae78a3de08ac1ef1b608158276c87b8864f1235f5fb1257fc515e146c9fe29085e4d72785250d41ad6c3abffce7c0328ff388b9a7570ef0fad40ef6843ba4ee3892e7991057e2d21bcaef59528ffbe62ead785360b9f986bde8b0640000000cfc85f54e5d9180342847e592e1b1f37ee86a19bc8f9cd58bc08aa3ae1f0671125410de13c07c56ca7e2f48ed46d442c18511abaaf15ad07eca7db472ba88f6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2088	2548	iexplore.exe	28
PID 2548 wrote to memory of 2088	2548	iexplore.exe	28
PID 2548 wrote to memory of 2088	2548	iexplore.exe	28
PID 2548 wrote to memory of 2088	2548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\uinfo\upload\system\application\controllers\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27178a2d3ff858b429f2f95727db139

SHA1
32c03cdc2166b9c4afcfe9491017d872940d1f35

SHA256
d6018959b6627e0219305c6250bc3fcf4c0b089436156885b95371b02f351760

SHA512
a511b221ed39020ce6884fc858bdf23aa9ef26dd1c6aebe00dd080e56d280a6f114065be94439788958e5e29912a19b8723a090ba424f53b4c9aa82f985b1121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5296b7061047d1ac0f3a08352f9b2a60

SHA1
31fb9f4ae302c9c1a197177beadfb2d25c7354d7

SHA256
b194a19ab51d87264a85d59e3d3f4447ac2ed3f8c6167f08faf71826471fb549

SHA512
dfbc91311b58030ed0a1bce7100fd82070d9a33ccc4242caeb40ecc3445d0424a403f0616410f9c3c2fe4c5db1f13cca9c2781cbc9a063285bc706e4b13f662d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da517eb56dc972482092e7dc0851ac3c

SHA1
d8abc8e97f3ef65cae6683b380765a7d7a412d38

SHA256
26fc07da3b779524dc031556da725fb876e0d7167d814ce2524f08d5a671dd94

SHA512
301ca4c1ed67d9a7cff7133b272c45e75c12f6a8618baf389febe740a04c5f863a8befbab2caa2196c8fa5c7fec315389d4d5a93c8b146030561caabf102f797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a51ad3457b323d4f4759336f75dec1a

SHA1
6b1103f1c8ff58c0889f7e7e34d4ef45b56c3543

SHA256
1ddf98441808bfb373298b7c33adc30740efc6f5322251a7c403e52e5df1e6ac

SHA512
610ee69b6d27b6ce9a13e32230b00b3f4298bb211cee27c2c88aa2aa963db65891feaf77790f246a0f4b4784bb17de13f839df644c1c9fa682319750d6fe02f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf4fbd89feb89dd17bb20fdebf12f0f

SHA1
9b2b4930b848c2481924b93051f695b09554903c

SHA256
b926115b98ff527b55a3e28a575e0276414c544e0324ffa37ec02391dd7726de

SHA512
29618515571382035f61d202cadc344688bab5c0a5a0236549beb733375627d9df572fa1fe94d91ba68fae2c57e4d6562d5f446596e4117e139b39927c2fc14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3918cd8ee002360e2e281ab0e007f233

SHA1
c436b092bab184b5bbff33809f6ba5b9dc24b172

SHA256
a2cda1a3d0810874bf971163bb5837749f5dc5a5d11bf923b1f04150eb1424f5

SHA512
ff77960f7f3f29143bb4dfcc7485830e55ad71ce0618f77afbd683020bc89483d139342ca9bdb924ad4fc85a42b563d802c9b1181fd22a5e42bcb9357fcbb3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2d94380cd89bc1b8b6dae612cc33992

SHA1
858a4aa4e3a7248d06686692e3072e3ab573f55b

SHA256
6e32826336b1f3947a3434379a7245b6cdea27cd74feaefe8366b14a861a5e36

SHA512
72120d9b253365b75b4e8501a80543041021fb4db973d440e9f5e37ebbb445141ba2ac8cac3efcd94ebe75f445195a140988e14c0e4f3f0f4828b2603fc41643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9db67b7eff61392be028865469fe65f

SHA1
91b1579377e61653f91972dd8d39d59be34faa24

SHA256
56854a87cd1a5c9667c4803388a89a7af39838e6d110bde4675f99b9056ffb60

SHA512
658b8adeab4ccd897810875cc83340b9494eebc032af3ade96d6d991d8af579ef9db987e2d46996bcd869ced9a5fca9cee1d7250d01089b458fefcd66d615db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D0C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DBB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit