7d60bbf9f20f72559a24f4ca2c19d31b6740ada84d4f0cbc8d02d0f8b19824c0

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChangeHope_B2B_Free_V2.3/ChangeHope_B2B_Free_V2.3/Blog/ad/ad_usercomment.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411503903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70be0dbddd47da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000a963a9534c5c56db570a48e6624e2de9798804fbf4245a42950c642f32444d1000000000e8000000002000020000000dbc7e73076333210f5084468c49b858220c210246acccf7194f85f170e36dc1590000000437836480878913a7772eeec17e924a04a1bd1474bd96e79496ff55c15f0cc0e94c60324b84494a62fac23034970c44e64b0465ca22fef9dd4db4a1db6d0e29c495fc121478e13d96a4380c35bde7598475a8f43828ae178a4521664ba358d8cf6e2eb2573bf668ce227cb5898f56806d4be714076455cfa8ed855de41b32afbd437c111d4df228b5482ed4ad826513a40000000b5851a4a87268d711b031d27f363b2485d29898c0d3edd3b159b4b6838c5cab0a88e2c1008ccd1ae83fbd6aa1942a2782df6f31a7e007dad2a79c7236f124926	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a2b584e0c91de0747b5e15fe4c68057abadf932fbe25202f0163a24add778c08000000000e8000000002000020000000e2741abd941b64aee66ecaebe2edc739b3397d36860d41ba87f311e20990cc2620000000840958500d8bca4fe2f5c73c0bdc0b0690ed273b2ea2c078f5d1d8cb3f26c5c540000000a2e1a15011f7c3eccb364f98f9bea8252f52e692da789d2b816aa0d9baf80c276d8e21ad4e5bbcb98f400439be791b61b23bb92adabf7e9367d5f007ea67b8ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E846BEC1-B3D0-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1340 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1340 iexplore.exe
1340 iexplore.exe
1796 IEXPLORE.EXE
1796 IEXPLORE.EXE
1796 IEXPLORE.EXE
1796 IEXPLORE.EXE

pid	process
1340	iexplore.exe

pid	process
1340	iexplore.exe
1340	iexplore.exe
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE
1796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1340 wrote to memory of 1796	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 1796	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 1796	1340	iexplore.exe	IEXPLORE.EXE
PID 1340 wrote to memory of 1796	1340	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ChangeHope_B2B_Free_V2.3\ChangeHope_B2B_Free_V2.3\Blog\ad\ad_usercomment.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7521a1c7b5e2fa60997fc57641180361

SHA1
507e3bd1bcc1bd8aea9990f12085fca37da20712

SHA256
ac368feca1aa825dc3c26b6df565bfe6ac719506951f88bea4ef151ecd78eb1c

SHA512
3017d4ff25ada304b6881acb4e474e1e5558a9bb1e8b55f3158c02071ab57f585354da99e00ed236130435adf8d025291bc55f5c08469262010a30c17b5a8873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8715d79549714f434a97d8975b20da

SHA1
4ea9a429950a3d069f2d062f6aa2295dd6a0f3cc

SHA256
03233cc7ef373c429d01a5703a79ad846e896d90fcf1529c42c7ed9df61ba075

SHA512
3a768e7c5eac3a56686d66e78f0c62730df8522fcb9fad67cd054554fe4bb016dfc9118a3df5ad65d415e2d53d0611eba8a3b3caf37ed2872b9f902733319531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b9adafdf928adcaddabaa88dd669f65

SHA1
a8b33a3594d832b12f4972edb019ac509ef199f6

SHA256
148983f849be4a9262aa1dc4730a6b9f021ea5a43cca7b436d2dacf448f35baf

SHA512
53bc72746ec4c1244ac8d4f86e7d29d83f1a4270c971b835e61f1416a8e12174b1aadac99c0e76a87dee0faf3360d75d4c1759138a54e1c2780a51c7d0c7f97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25b3d9f5d282c80eafe4066976275094

SHA1
dda99d9804568219817063bcf99679c631b39fe4

SHA256
d08f53ba2868f2c3ec0eb1abc7207ee8e4240cce27ba0df9dddbb2a85d827f42

SHA512
989f9441ebbce3c36508abedb229fc10ce49f741eb431075f3ce6d0afe1f488ae9a2be99e536c5dd5c8ed799c2b60f756130e4084f9c0158dad5045ccb0200c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e434f4180017c6cb2524d8e6e23bad4

SHA1
f0a8b9b60a1bda1d4df114eea686b1ad7ee52cab

SHA256
dd754daa4c242ece44f0abaa1ca66cd75ec7d7853ea779916378b321f7285c96

SHA512
2c0ed52d677d16a655f6768f1d12e8cf947047e5ec3574f0c9f7cf2d9327cd96a5c63de35b731860cefd87a7c998e51f0ae65995fa21a64d349fd1999ebe71d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b49e2f21bfe594097b8a56fa426b643

SHA1
18a8c23e4619beeb55541a011de931c88448e60a

SHA256
e0bed7940a617fe023f29f66d4c6484d3de9badae5a7c1f83d22a0467f9de248

SHA512
caea59c755dfbda6aeccdb8dade8d78c222d755cead9f076849f0b94a9e629f40a8b543a77bb4ea6c81a4007b5139e935c70bc9f08c309aa9d36609be9da21a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b567541640a8d978339cfc6c1da60c8

SHA1
485c7c07413841fcaceb3c2df58996523c1fe579

SHA256
65a73ff92a08cfb582502830295b30ceeaf4f66a8cfa5828d81745a7de54f30c

SHA512
cc0a3058229a1a9d5998c7c469ad81ddb8ef15b1d2970f5eda9a02365584ce9f5648e88127c43d89d7f518f94457f324d9cdace10801b690aa56d598449416f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f5957788bd2404202669a777a26569

SHA1
f951065c09b0b28b47f17504525eb4e09088a2c8

SHA256
471daaf8c15fdf99e9ec12a06d27befe9e7a7200746094201ddb4795196f65db

SHA512
e04a2ba8a857e8e668e292abb75e1a653387bff9672b0e6cc629e61b197590014bcc1466a8a29bda0e4591224acaa7552693240357a44a2a56f91ab63b068b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9159b2b334321bc83a01d827ca2080

SHA1
32138f0ba461ef455b060944802bfdc56e3182ef

SHA256
c6d080c76ba363a1c0229ec8f1ae410325c3a76d86b79c9ca0fda1bf849be055

SHA512
bdca661bf004bc5004da6b1187c2a143eceb6253fbd2037fee1da609ade5e420417843ec02a36ecafa4caf39d515ffaacf5498a6f62793cd05668424f306e768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8347b2b9c2f1b8185bbaf864f2a2774d

SHA1
8a5ee6372a9e6459e523221a2940f1facbd5a38d

SHA256
99432fb0a6e76aa2f74d79a082519218d49bd31d8ef5595d33c997e693f50ddd

SHA512
b9ae46bad85716041d1b9ad78d7e7ee1166c2865d3a03c3f9057c280b9f54d53f4b499f4f84d90f560cf4f4be052a8cf2537f135a40fa3bab714d459f27a1bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e340807ca9553a8454a019d3afe3fcfd

SHA1
5b2dcbc827cf3d5e6eda23a347b942e0798780c0

SHA256
0fbcef3a8796444dd2cba3c6ce75bef1ec50e53868ac8b19e25427b8471e1633

SHA512
860d1ff22cf78459a0ad3575e5522e8168e897fd656b4f1d8bd0eaddba19ccad03f0005264608ab3210c7e376e9a0b222f8c9b9572a5fd5dd93c5e660e31a42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec3abcb5b294e1346e6859db93f032e

SHA1
9c5a763e1566d620050577f58f460a0545a36b96

SHA256
81a416bfdc2b44a8c6f5574f65ab068233fcac891c320ec139a344e53dcc6c81

SHA512
f0379e8da9fb2f9038c75b6c56f91e42b9651cd6bb6ae69a56a18bbe5dc2670997bc32485309b0b41e4a8cb9d0232ecadedd74a9a77ca76ca2770522880c6630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39721487c7a77a9c2ba879106c786fa

SHA1
3c9783b4a2b3cf0ab17d982162e3890ffb68a235

SHA256
147fdf9154bc0c68b31581759e0abc365e3966105445a53a0e096ff26cea016f

SHA512
1dcc0e42515f1220e28be546088f5f8c8809c5cc2ce51c41accf5aa79a17868b4403cc8cd1d67f1e4c3153993d0145eb20507add34bef45425e570b27ef5086e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d7d0d19c88a40fe5522db8b0c6ed89

SHA1
9d7fc20e128c50f86e79453289ca44461ab75ec9

SHA256
9e153f2f3c465e6970d42d3df2c878e3d8a91fedd049d438e65c4130b0b7c520

SHA512
dfe6dccb561eb4283ee2b28e664e8e18e07afc433ce66f48578dcbcda2179be19ceab062bbab56f7bba88d8688efd16089e1e61d951ba474e4958affd11a4ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1E1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2B0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit