hxxps://www[.]research[.]net/r/Z6KRF9F

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.research.net/r/Z6KRF9F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fe5be70244da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDB4A211-AFF5-11EE-888E-CA4C2FB69A12} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000fef34dd2f12829b6bad2e8ca3b591bf1a949a957f8a534ea94945ee2160b73d9000000000e800000000200002000000004cdcd4e224b52f191f23a638df93a8fdc87c0a377ffc9b050070c648fa00658200000001e825967956362b10a75dc0dd3cb4473c43c3a845bdee60049393a6e94f61e8e400000002dae50c163105f6a58cef85fc2316559c666ac3b317b2b352af778edcc88d5dc25cfef0ad737fbdf052bd091ba64afb279954be0fea8193469df72c4a2d85f54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411080049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000005a28ebad6e5747db395dba97076d441de7fcffc0f1495406fe0bd06fd6e8934b000000000e800000000200002000000010042307f11579b0508e7d886d04a3b07faa9e7ebe28dfea7d932ad31ad5959e90000000fa736b67a0e889572c2fa16113df77a0064b8b8d1ed21a4d4cbdb6abeb80c612d3ee3ff0e17b9168e98b54a74e840df53190e37ba7994fc75b25f996e74fd2aa9bd9243957f1d97e8a2dfba2c9860fe7af317be5af863ee6b572f86a7737b79a008a756f2867f6a04681ab3c55255ebef48fd2409b56a699c04b5244ebfb83587a1c5484824b657ec21241f6aa5f203240000000897bb4b177866eedf1ae85173203820ec631d252e65a12907938d8133bd4ec1c0871017a9bed0650479541d9707e3d6c04088425a0cb5d63f668e88029320811	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.research.net/r/Z6KRF9F
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
997bf48bd4553bd0618141f74d0a5c66

SHA1
f3eb7b38039d82a9e4d946f5e0663be2ac994ec3

SHA256
f1072c9184210895aa702d17550fac1080e7d5b4347b5b17295d5302dda5be72

SHA512
6309fa1edcb7bcbd27c65d59c192e36cf91f106e3d74b74853898f6b61e9383d6a2d2f28b6556a140cb4f7a1fab061ac83a9369bda320d8bb80504a042e7fba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6766ee605a67596dd5079c10cb80102f

SHA1
32087ca2708a0be6cfc62ba9af61649975828f8d

SHA256
a05f2548235ba0a96283d0aaa3cd0526d2afbee95e6310a267794fcd1cad79fc

SHA512
c41c777fd41019028ed46304d99b5dd09dbdcf0f09a1abd62ff7a88a84333857a6dae90e3926a60bf9b5d51f2d915cb9b7f1f2532a7b482419ce6fa318097129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd11c65c02ca0bc2241bb712e024e9e

SHA1
6767e14ae4113aef1fcae01787998ce6a7b652ff

SHA256
c7a2137deb1285883d1be4cc5d4b340d2bda5933397474a73a91adf996015fcd

SHA512
9d4effed542c67c0b64a83eed07353432b40fcc3b10137349c91924e4053ea2a8e4de16f982814984ef6daa6c12b96b4f012329a42de53ef0f73a7f931dd3066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224b0cf55258772e4d9da0a60b0e641e

SHA1
5ddfdbc1125631bb72c79b482c12d631e8317ce8

SHA256
1551b16723193e3103f8bc20bcbe3d8a387e5bd000659f265ef5a001245a9b8e

SHA512
4307ef7fac0909e8a3d26fb08983e22a619e8de43aade355cc60803e0d1600020633bcfa680dd42fc3afa9c0e209ddd170000660ac890e2c323c8700034536c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77ec411a8b1b646690de17407106343

SHA1
d6765720696d2af382bc7207d7fe65e380e7113b

SHA256
7ed7d74fd9c64d7f9bbc8bd164e08c95ff5427755f6cefbf030ad348883eaff3

SHA512
d4fc31e97a7fcf1e9e6df7db13047496fe463e62098de8cf8701393079a203ca65ad280f00719d6e8675b4eba3dca1dfa8ad4adac876f6bd60033727354efc9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54bc15b562af685368d69462c955f056

SHA1
4924642c12db01da313d8e50b7f31221a7715553

SHA256
a651ce7cabb9b49d5de90e733741d46d07a1e2b26246bfec8805d7c4fc7c8088

SHA512
27ca69134b29f4c2a9ef8ffd9ada9d0f1113a667cce09d38ffeb13e81ffd75c41ecfacec3187a5a0bae87b06badfeadbe935c0d0b0f96a10ecf259d3700c90f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9190dcb8d8cdcb80109feee90d149bc6

SHA1
23278702cad7d2cbebf94c8b744c57cfbb60e7a0

SHA256
7204d5d9a06526185b13270a28fa78cc8fc62578b8a000486dcd5d9ab5e2bf12

SHA512
6dad9a4f688bed1300f70feb25ce6c23ddc853db8f9914d36373d74721e41313349843337dbf82197cd86aef080ddc53c6366c57339d47c3c783d40d12d7b0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6251f1fe3e6077eef8d71aec4788270

SHA1
3f125c5cd1fd81b964138c6ab6d6e6a923f782b8

SHA256
4db428e33b0e462b3d273c0be62b20edfc3214b5f7f16c6361d5758e8e5a1bba

SHA512
a600e3bc9b58c4b23b44325e693246c583b022d729b721d896d8c77021ddd04caa35019002b2aa33ef47b97f1507cc5c0e7d81cb956c55a5b91172c60cddd40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00b39730982f0fbb0b879ba2e2d85b3

SHA1
3f11d8803515ef9c6f02d604ae5b1250d1060284

SHA256
bc2aae988184c56bec70ebc86eb260b2293422e24deb3c25f1071c7409c1bc85

SHA512
891972ccd556ca4d8b3471292854a8c65533fa9bc64c04967e4e356dd7981bb0021f4fdc0117c8213ed01efc9d891af5cd3eab601890a14ce6247ca2390cad05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86789b5dab7e601ef023e79bad31840b

SHA1
b1929df284edb7677bd65473ba489568b98c9ef8

SHA256
24ace5aefd49da11ea63169f0b7227d75212f78f8d7a27ba93983440a7b8ef4f

SHA512
84b6dde0a5185a3a649f549ae28f68f3a9b50d21b8ea74b56527c7b33cf5fdbf43ee875415b239f04c707d4a7e895cd067dac2275f4091b708530fa73eb96b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65bef2296166f98b156ceeda001bd0f7

SHA1
2cdd3d80496091bcd2b57c3da37c6dcede8b316f

SHA256
b96a9a15d93f58d27e7ecc59fb2f3f4eab136647bf4d3805a6e3cb9826b96711

SHA512
24ba98d39fb30cc5995ef80ccb39268f5ee0d1086a3d70d54a1909242ad6ed5ce53e86627c9297453c4df7f890a8d85a82763e9f33c6b810735bd75189a3ef59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
25b10e457586742033fa0c8b3f3f3968

SHA1
369c579d01edb15e39cc88d09810f7433ad9aef2

SHA256
287279925d2806236b9c7ff7dc9cf31a6149cf9ef57b23650ad7dd26597feaaa

SHA512
4611473ad91bd18bfd35ef6c3fdb892b67b0f26947a34ce195f4d123a59fd308e53a7a6d2a5bcc9ebb4114d6d854f7dfea0bb090818a43854713eccf91b468bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DB8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit