227a0b91b1ad2a17c05f5386bb98bb1ca49827470a84fb30e96f872ac4c9ae4f

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

uinfo/upload/system/application/errors/index.html
Size

114B
MD5

0227cfd904e99656279202032b98d4a7
SHA1

7f3c810f643e9c100b82520a7c11aed6131f7674
SHA256

0d5819fed1543a314272c42a0b0ec512909f690cb9835d9631abc2f83f3c3c86
SHA512

a39d6f75293deeb537e26a4b7c1aa077f1b27e3d008e99e560312e5081206bdd7856c974aa5cb2b0b20f95d34fbe39bf1941fd62abbb999988293c8986202b7f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09297b0eb43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000040b5dff6a24be5457ed4dc5721db97a6927e21194d0a5c5ade78066a52cd02f9000000000e800000000200002000000096e1803b811816a45d89e99aa634fc2e4b758dec897a47890a6c2cafbdd4f5ed90000000ffa5facb7c82430c2036e28a589932c4651408968a45a1340545411cca5db62977b7d59497c09dfe5c5f8492922101b07148076d3eddd2f5c90413b3eb33ec097681a8d56d16386fec65bc62b6fc42b1f01a93eb7bbb99886d682e83f1e03a6546e5697e7e2a21bd4378e950d31d92aa2ddc906395f2cf23c574342ecc092cf8f4ee1ebbde64ef202da744b70aab013040000000e32ca30fa162ac8fbe8e7cfdf8a292d3a198d50d5b3719e422d1d6f6bc1e3ddcfdebd2c16bd6fa070d250d0c795125d325364bf34cbb70fa057d18cb3f2d8304	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBB857E1-AFDE-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411070101"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001a7e154670a0302672be62ef495b831f71eba088d3eb5eb8cfec6ad2113e404a000000000e80000000020000200000008f449754851830211522a2038196ff01b25e10078ccb6f24b40fcdc4bf0b87ea2000000072b8203bb6695ba2876d262f4c6a2da4f926212fd97d8c02325967068f5abc1640000000f49159e2616cfa29dcb239de2e5e60ad1dad74ab89304fb7522265795bdda7d508fc612041d2d970e143182510182c5136b89d991943c2f412dde243e80aec56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2728	848	iexplore.exe	28
PID 848 wrote to memory of 2728	848	iexplore.exe	28
PID 848 wrote to memory of 2728	848	iexplore.exe	28
PID 848 wrote to memory of 2728	848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\uinfo\upload\system\application\errors\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc6986a8f551cc0dc25fd95b2bf6a689

SHA1
2539b779a8dc59c029b87d11fae60045771ca36c

SHA256
cb1c79c694b68cdd0980010aecf3879cbe0702454bfd6853e46cf588c4bc5e42

SHA512
511636138f61d78f4fc6c5fc7e4e2fe3e9561fe1d2c5e33fd854896e5c6c9d375565819aa68f938daf2fb7480d0d895228fdf454c3ca4afaf78cc1e7806de4c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843b4aff7581f97d0c255530a03dd137

SHA1
7d403f61732b8ef663d3d0b093a062d7fe42cdcd

SHA256
46028150e544634ce40f6b077cbb7a067906a9609825619b75979200481608a7

SHA512
3c2be54520461f3583ee20c911e4e2fd8ddfe4a0e690c1d7463c8206ac13514fbf91ac96c74948db6b7e324c40575248d4c6f96c0aa4b353a842e07d6d5b53f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803aaffb3a13fe0082bd1913efe2f686

SHA1
6467079f8f23b10a77d14d588ecdffd310f8bfda

SHA256
4807e8deab1dd315c4bf280f40467ed7b32f90b8472f890b336cadde505dd405

SHA512
ed65a625a025aef78631686b0e5d023bb3855bef7765d713f5a0e91a19809eded232926737949b7532988fdc009a81d734b6a1265bf593ed421aba523da6a40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e0c0c04c79c4c826a9bde7648e1e21a

SHA1
1b6f15df642fe6c46f29c8ab2b26756cc3e8033a

SHA256
bcede5b23b119684fc34ee00f1c514b593b3789b63788220f9267327328f5dd5

SHA512
56b0fad98db74eba25dd6fe97bc72c2d896453cb3515d3372bffed9c4818bd8bf3557e384c9f1f7407fee05fef93c9e98141ba3a78f9dc481ae15d3ae208477a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa83d8a3284dd9cf1b499f587a3cdd8

SHA1
9d6cd5f82a6d6bf8808f73330513be37bc3322bd

SHA256
113f2f93d8926074d6af137a20d134341c01580680228d4d58622c6b8175c377

SHA512
6a8dbe65e2f7358c1fe079296e732523ac8be369d59d34049af3ca67ca5502e4c8f13970b8a05b7aa6fd27cce2d8933c48b2af84aeefcb3a349b3340e4a258f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f2d47e859e31e3af0074bce5bc39d8

SHA1
0b96ad29b2f98fb25a8cad6260b22388c112a766

SHA256
389aabdd517a5c5284b6e7e57330e771c4a6b71dd0f121a95615156f9b527015

SHA512
dc777137378bcd7b934154efce5c4dc80adc6a1d2449600a2751059caaeab8c711ec323ad5311af17ebb7894bc3fc40d90c385a38a4a4b24a1cc34d79db473b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c19add67f0d50c15e4331e9176801bd

SHA1
3e1386f188f299e1b2ffeff9f5443f653a93d47a

SHA256
9d35e8fd42619e3600ab73b4bb1b77ef82ff309148e9b26f18dfe9a534c6c8ed

SHA512
61bdebb8a1052f8514de2265bcfd66399d5fd7e661ff0606c23d168a99699a982dac012175f898b4b238335df14577734b95e6ac3e5afc1c6aca64c19b522461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a65f5e773a1ddd1c59b85b2daff6b38

SHA1
39887ebb804b879c4173f05e8a79c7922bd3c51c

SHA256
ae3e6348fc3818beadd01ac91b95a0a277d99e072006f679ab3c0956101dd62d

SHA512
9dba707e427345c45af282f20a034a1aab0a4c72e7a7fe9f0f70e5259c4088d717f1271fad63ba98bb5918ff9ecc52074e6576a14b2b8bb2dcc24fe91269d955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743a6eb7b4f04a68478845c6b091d3ff

SHA1
54c665d210748640a0d615acc504700a59d47079

SHA256
b89be31cc56b26a60c736122e7f745f1a29e198a78f8b7f12beca8c5597730ed

SHA512
4c9fb501b4b5ea58edd82091da8ef34190ad8aee1cf55ab3233b8d797fc3fd2bc8a60afeb39079aa916411259be728910126a207aed7659eb5eb9cbdf7b00f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe44919399be67acf4850c2904081acf

SHA1
efaa3de13c87a24fb864dff0c36c24017eef84db

SHA256
39b77e56daa6ddb9a6e9cf3bd88cac6fdc9ca12044b21f7b584832e7fcfc6d5c

SHA512
d950c53c0be75f377282481b9d771d4cc916c65f7e927e31c97371aaf0a320fc9e14479733f2f9e56222ee6f76aa88b97a1f1137df38f0cc848bbf568706a138

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70EF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar718E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit