hxxp://mi[.]michaels[.]com/p/cp/0a18a5d75e629e73/c

Resubmissions

23/01/2024, 13:38

240123-qxj11aaggk 1

23/01/2024, 13:27

240123-qqccksagbq 1

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mi.michaels.com/p/cp/0a18a5d75e629e73/c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f9b086014eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000809dad4737af341a8f973aafc41013a9a4bcaff643d8e90b855e24c3d4febf49000000000e8000000002000020000000c98c680eb63e3998cc89e264f0fa091ec30146dc81e810af8905f130be120828900000001e6b68b6304ec37a450d36746a82f11a03838e4a2a3a850b0d82b0802b6f963d65a0afba35d5fae6a55017516911298949fc91b92dcd05c83261db6d756af03ff09f1709624cea3713a13b110a961a82dbeddb3c773a8dd86698b6c45a821a2e7f11ae3e248fa4d9e52afcbf87d4a662608170521b9e0735c3219d6af094562ff4dc4febe98599b8d513b8eca240415e40000000084d519b1b36b4e4b7c511d095961712e8e084c7534602b292224d41544b47928261f11feb42e0506ab93eb9642d7a877335121ebc51000cd47d1f939c98166a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412178978"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000065c27784f8be29c9d6b74e5eef9149ad4daa271fda7cfc03e386cd0bbbcecbb000000000e80000000020000200000009353ac246f641e90c116b5be24d1a6369c8ca113a7025caa3147e11d805ab05320000000e97b9cda375fa0f8838c15d83b75a889b9054653f73840ccd1d159a57974048140000000b62399941fc99d6096bdf4303b1c28fa404d63870631c35f359f424294fbe60bef621a4256430019ca0b181d8d92ea56fbd249a24c1a3ca59940a1834b23a70c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1251BB1-B9F4-11EE-9735-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1536	iexplore.exe
1536	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2396	1536	iexplore.exe	28
PID 1536 wrote to memory of 2396	1536	iexplore.exe	28
PID 1536 wrote to memory of 2396	1536	iexplore.exe	28
PID 1536 wrote to memory of 2396	1536	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://mi.michaels.com/p/cp/0a18a5d75e629e73/c
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf0d271921a9b720bee888e552a63912

SHA1
4c1349d793dd4dcc7264eb69f379622a0917ddb1

SHA256
f21c93cd78096a452b364bc47752768a1fa7f5c3a421ea8689f5b1abae55b17e

SHA512
cc880aa7676488f942ddce33f00679b7bce2d3541f28acbff049007c177a8ac44f417c09f25b3bc21abf960d76d42e2c3f38f26dc886035ffb6b98ed86f4b240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53619de317dd60fc051bc2d0f322f21b

SHA1
223207b17fe16bda38678d516fc56a1678b4ff5b

SHA256
302aa81f6d6c1f26c740e4b75a97d27b6c82819917a76a7e3b728417b44b4fdc

SHA512
c6b0b5585a281c14f0da683c5d49334f36664e04d52f342256475de387ff60b575582e00a3b762dfb9d37509f264df12a6660ef8a16bbc7248866cbd3aa3a1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1895ac17ea377fb3884d867fd123e0ad

SHA1
f2530320644ca9ce4bdcf5d36c17f318af3d4eff

SHA256
b21217f4eab8987358641babbf76a6d7847b99c0fcdd8f37cf183c59f0caf8b3

SHA512
e25bfe9b9c3b5060d8d5724f8372a9708a7bde8d0d59b2e54c7db8610dad0699165ea3ec00a4298cebba54ef47015c7bed8089a9e9139c02a037603437a67112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9ad4b6c6d78d948024aff1fc1fe49d

SHA1
130068c1d43685a24cdc0a2b45ee10d6d3a017d3

SHA256
27acb4c7f736a94c31e73bc7a99da08ff763993c17cdec2de65013cdd473b89b

SHA512
68af8a83f3a5da747ee7b2ac505603fe036c2c72cef19e52829ff84c149144cd459f73efcc14901259ba4453baa1ec7d3df2b4eae238f3381963576c76581c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecd5cae543bc39ffe180d9246bd8f16c

SHA1
e187bf5e15d82f59967894b770a79a9bc1b53093

SHA256
dce2a6875c3435d3a029a93b238781ada767899f83579c557b22e726c0a5f76a

SHA512
37472ad445fa544d6fc10d109580ac9aea3ad7309039772e453cb30c3aa54c7ffe844500215c89ac11afb862af78565cf156c0cf1b00cbaf8a7b8eca6b5a1a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2ed661f3ab511b2da7115619452557

SHA1
52a348204890a45deea6786ea36ce9c3cb7723b3

SHA256
b9f0a104b64a25aca8ca507e3cac04f8aacc73c23b772b37d506bcab926190fd

SHA512
dce922af67689f2812b9ced6c637b7f5039715de5d95b420690f9ac402b64681e561e356ae2ccd213dd44b7bea0bd9079bed6c258d083d25daaa845b7e803813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2354d495ba236155890bf334d13ce39

SHA1
ac5604f53ed4f53902d7101062c1f4348c5cfb0b

SHA256
9ac20e0079780137d32b19d864010ca37b9e4719ecb8321f6e386673814b996b

SHA512
a1453e761d7fa492c8417461023e3e06fb808080f5a92a43d734f3448aca85dbe2e4cfb92c1095e056e01107dc7d32204ba9669bbe7876acc54573d003be7181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20bf030b22c984556e3191a0b4f11ea2

SHA1
61a3037e89a9d84e9f7636c9dd8a636f87632c93

SHA256
20c85d5a0d7fcf9fc88e3eba15f5f5b480d3703364d204ebbb42b15a0ef91c55

SHA512
916f34c70890bc538c1f4ae7153592bcfa4402c77996fb869be73204d1c407250b2e7dca67596eab18aac719e3e40009d2aef01007646f756e4394720ec62a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452269cf321c50128918d363de9db53e

SHA1
6a50c9ca22a75cdc0c08901de8e3172089f2a137

SHA256
b62957820ac1cbe1e6e5aecd3725f465a6a6d794847487b9ea5b67c75ba579a1

SHA512
320a697deddc6241956acc220e2eeda1da11df7016b56fa6e954848cc9c5d521fe15e8c85f512dd59d3e4566773737e0cb5aa8588806ade6b6f18f17048fcb7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ebaa9cfa3976e5fb6b9e4bb9a5fa4df

SHA1
fb14328d85970e343887e7d7cb70e980eb2fc64a

SHA256
6540bc9e5e3688e14b0bc2e7a4d08b79647f31e2061e3c69808d78e7ac678a16

SHA512
76b48b4b95ecd1987665c5a1c31f5c2a00c6acc6ce66655c267fcd09453e91a91652bd712cd3288d7e57b625e85860a543db3c58a1d7aebfb0a14669c384f985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bff109e94dd9026d729f4c2f439a8c0

SHA1
854b5723bbd4b1325e33959ce2e662c0ffa7caf5

SHA256
a0af081c7f8aae645d30c27fbb330d5ebf6cf8bb11b2f387875007c6f644909e

SHA512
278df29ff30863566070d530970700ffcc590f1f04c6444fc7fe76b83927820429a15725f9174863476258e82e65fad3de5d635b889a3cd79dfd15229091628c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251a61f2d3bf5139e4872e4f38abdae9

SHA1
0224a7ebc298440c5a6344a74ba872ce7c303888

SHA256
6473f504eedf81b546584546f2771055fd5b7d39851969508f71bc55b24dda05

SHA512
1e983e74e6310568d1410a63241326f8b4229d37ca48c085a825883aeded25dc7598319bdeb069f151cf79381f013b542f2ea35aad3377c44bc566e1d077cb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30fcb5aecc4c52c86ce771db3e8d2f96

SHA1
973a7873ed866ae6c2a73be4c2304fc5e58180e0

SHA256
84835de7804777090c6b09f3f6250cb283ee989b894a12190e717e3c44d2ed17

SHA512
0884745b6bb499b0d18fe22619c592384b90a2edd519f52d051da1b5449dee2fc88f7923b160d380fafef6bf72ec346e0677230a357aa994c4263b64b474a61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9247ec2188bebba3b9aa598df7b83dc

SHA1
6102163360c10058133fcddae0ee9161019f7065

SHA256
b3fc85284056c01248b4dda89c152d420784acd0bc5824696aaf084c54d96e93

SHA512
b1237f2ee2bebf1fb9971185698927b16335b4d4fafb3be210fa510a40c74d55ceb68c7c53d13ac72e698b11aaf4f651064eee238435da2f43036f5027427122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f785eee4362f4f43bccaffba1a8abcbd

SHA1
2fe0726d21c53a93c83013cfe3257219bbee4092

SHA256
c1d47850e831557b090f73493229a4abce360c9e5df57c11c8e0b9e6f1ae25eb

SHA512
7c9e618a9e10410b35c6c159a935b7dda5928f12560d4d9cdb2f79ed12a5f959e35f4c72795583b125995426a7bb9c0beda1d53b44cbc8e82d76cbf200440938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45fd9743dae9d527bc182e62f8ef1bba

SHA1
89c88b68281e085c267d76a394ec05026811beca

SHA256
dc55f001052a923ae2d92b5ede302abadbbe3dfe410dffb694421a62edb22d80

SHA512
600db4943e4c36ffc99495458a5698603f01c01619f4d5777690ddb8225560a00c26b5341e851183f406943c7a6e9f6b39bdd9c72cd2875f840b3b46f85cd63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b24cc4dbc4ced7bc4ae23ae3a36448

SHA1
fa501fc4844a32a5ee0061fe71fb8c901c7a967c

SHA256
f977274a95ed66d57a4e843c6d8afda896bd7c01c167cb0b62a172794d8d7960

SHA512
08dff8c0fadc82d85458671f971f66b4f9a877b9c08ed9f4634d4004a1aab5624f1e221355313679070ce2c3f0a42daf73cf37feeb7d3fe18e24fc4ed6693d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5bc872e569f303230f3ccd69fc474c

SHA1
53d8ca8d532b41bc99407330862fdd30fe6c451d

SHA256
ea29102954f0cda46fccb5bd9c282832762a4ab1d69cb82c2486cfef1ba4a8f1

SHA512
ba6e8213d3ed3e20f5957d9e26dbb7479dd431526266103d64ec9bbe37a2192f254fd476c72b3cdee8e0d52ad67eafdab3c0ea3d164131bd89304c0af3915c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb0b751cb329905ef2ef0332006476e

SHA1
ccedb7a81b2990f3b262a648f21fd3a2d0cf2207

SHA256
d79fed3a140d09923e32d95d8aea909104046109773cd22d349d6b1ad19f92b8

SHA512
c0cb309548ffac4eaca9308d359af214c19c6ea86cd81ae6d69c4da40969a4a532534ada8c2095180998f2bac6f2662dc26bcd3a382f95957d867d0b6a5dab3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar567F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit