hxxps://proxv593uu9848j[.]com/tmid_a/Dz_guscQ51x-6Dk3enFHH

Analysis

max time kernel
139s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://proxv593uu9848j.com/tmid_a/Dz_guscQ51x-6Dk3enFHH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 902911d85f4eda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1472A671-BA53-11EE-B55C-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412219516"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
3048	AcroRd32.exe
3048	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2280	2116	iexplore.exe	28
PID 2116 wrote to memory of 2280	2116	iexplore.exe	28
PID 2116 wrote to memory of 2280	2116	iexplore.exe	28
PID 2116 wrote to memory of 2280	2116	iexplore.exe	28
PID 2116 wrote to memory of 1168	2116	iexplore.exe	32
PID 2116 wrote to memory of 1168	2116	iexplore.exe	32
PID 2116 wrote to memory of 1168	2116	iexplore.exe	32
PID 1168 wrote to memory of 3048	1168	rundll32.exe	33
PID 1168 wrote to memory of 3048	1168	rundll32.exe	33
PID 1168 wrote to memory of 3048	1168	rundll32.exe	33
PID 1168 wrote to memory of 3048	1168	rundll32.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://proxv593uu9848j.com/tmid_a/Dz_guscQ51x-6Dk3enFHH
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z13H89HD\Dz_guscQ51x-6Dk3enFHH
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z13H89HD\Dz_guscQ51x-6Dk3enFHH"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4ebced5cc451ab7be9432e31e15e163b

SHA1
36aaa8aa817e85947d156850a931139148458eb9

SHA256
ecc7251148df8e584a3357689d1ac95e180f158434d553641eadf4e95181de3c

SHA512
9d98bc5588e22382913afe7fde0fe31b8150444a32bf8d52fb3e7bab020e985f3d4bd963cc08f92ae86b16240858c70d92fcb4ad17a33a880489bba9bd7b236e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2273f00d5ec6c160c4792ea174994cfc

SHA1
28b6ebf91b8848ff9a277ca23e127ac481012eb1

SHA256
43f8a7e0e4c66257336366216f4a3c452c663471cc4ec4330f2286a2405c4198

SHA512
89fc9a0ba25aaf498a07da93dfce481820246188d40282562f8351159ada47689eaf7fa05e21f65bc2c53f4bb7088fda36c816dfac2933e2b1bff6041a588454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9469f68f610bbd4b7dc07de050460f8

SHA1
1d2252d92b98f502bd697b68817bcab465d760e9

SHA256
5e7e11741de72c55271ce4a74038351bf5fb18cc306cdfc4d533d1f2d385b8a7

SHA512
307af971ecd70985052a44947a5517a2b21dde9c5948ea3c78575ff29754fe0e2dfd36bd1bebe3d210e884c0d0115b43399c19867ebf116aa065ed9d0221fcf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
682afdaee2f7877c524e30420a9e9dc1

SHA1
6d6e39c4c6eeb01fce61eb7825ef0a632b9c5ae8

SHA256
eab3635281a5d065760ef68579fb895c7130defd674d69766017bfe2d279d238

SHA512
1b73790a195e76106514d10bea4ef925be34822b9e2c1133d40b89ecb52e8e4c5ba08e4ad5af3e6cc9293c756e802b6ef017b3bba13cfb97a32595b997cc3623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c12b2992e30468b8cffd652c50dc6607

SHA1
98880889d8b8bb59cd878f9d2a25fa79304e8191

SHA256
9d70633a7b0bc2ec07bdc2dd8de4502d383ec677be245b8a2e2e81aa5fbe89c2

SHA512
de302988cf1965adf08d7d6c0ded3bc8c4cdcc86f99497060ce20d1be62a274ee0b640a300f4482a5144b37644f76075a619c61241ec3244739a8e23e9329760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a15f165285a339baec59b38330e89fd

SHA1
c6d2472262aeea2966d0cc1d6ce9ea065f98a6e1

SHA256
1ceda28ef3ceab607d8379e4ee02549052be206688e466610aea0a81f3a97b91

SHA512
ce3384dafa9ae7d9e794aa539655504692fd89ec1123f7c743d9abd0b29976aaf39c82f0797cde85cdd9708bb6628911fed5ec2e9fa22d54a77e8d0b8884f535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
539c9eb30ff52453575d3e06a6e3ab2d

SHA1
4262b0527af162d9e35ffa37e05b97d206c7d94a

SHA256
efa99a34fd1d0d9271b8dd93b2f708d115b2680b43ea0524f3efac07627f81cb

SHA512
608c5c16490fac3349178c319a3b620cf1a30f598b88e3c4af0d59901462bbce4c6d4d37e3e59a5922be144b293c8f7aa6c3391d005fc9d4c6c21652af51dde8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7ed698b91911ffef37b75d09ba553b

SHA1
af011fa5dc7c1835bb3b891ba09c7dfa0af003b7

SHA256
de543b2a2c0475de531fac38daab932e79a9f8f31403ae13c8a5e42d9021c3cc

SHA512
633badbfd5e00ac8f7a594d2689321780ddbb3f8df023f55dcc9ce538230b8a33a1ed5c626a929f72ed8aebaed88cc32f0e1688bc9da5ea6e8bd530687db92c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb93a280cb16e6dc27a72acb99b44a42

SHA1
9b6dbf4de9a23b10ba71eaf9126a2f9c4fdceeb9

SHA256
b599d0523be101b208670495b9cd28a0a4afb85d6e64c95e003ddd6fcbb782f5

SHA512
01544c0dcf87776c48e534cd041afedbc3f34ef42bedaf82549231af817265c126027da812d127a73212da87d6fd3f3854c7075c1b72c7fd17474e423456fee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba77e35174a134262050b4afca1ce08

SHA1
b6080099085ea74731e1aa148d5b37753638d003

SHA256
7e0b4102e61f3f18b8dd53cf54009d6bec5c1f650e5e9b0f291ed92fee3cf44b

SHA512
0bca018b8a4545a87f483273ea51faf4e98e4d2f4765155c5bc18ea9a6d8f2a950c4d4bbba530f12cbbc2368c5a4c6bcc839dd8b511434197011410f4f405b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
675f353403b4e10beb844131308cf985

SHA1
9350228528b643383b4d80c43b23183ca61c785b

SHA256
aaae3a8070fd57ccf65b93e6e60145c36e455f035082e39e4bf8e10a738b5bda

SHA512
d90ca7299c7246ba4a910bd591188883a4e86787f69c1fc91b5ef4e3321a59a8f3e6c52fb3971800952711fb1cc98f958054b5687a635a19737ee8185522aef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5267f47299f1c7513cf7c27967d7cea

SHA1
e633fbbfac2550554cca7f02cec6caeb942c044d

SHA256
43e909fcc9a138880956ee0b6bb719b922b501b1bbe8aec94e99e97121667e05

SHA512
4fb6152b2fb8df49f372ce8e061f81564fd849da126b57b385be6757296df23c881930586cb23742d1cf912730bc63a438b6b5954ead9cbe4e2d8298d9ee65ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b0f8574c2c035c3e3234dd27e8aae4

SHA1
781fba7bb27e59341a697b99b9452e0e8f1f67aa

SHA256
217b243275b50f3c2415fd2564796f80e31c280ac66ba400417b5ca649f313ef

SHA512
294b0194e91f65b0497c90fbefb81c801222378b54b2b544223dfcc6829216d99b51de3fdf0b4b7203042ff1c4d8c860c7a1c9382d5e6e8f8f92fb7a5eccd890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
21961a84a159db916c7f637426d1369c

SHA1
1833b38772a6dc6810aa33b1f4f5cd0955eb6f46

SHA256
725d19bc9cc4e5abcc013262b0e775f05b2913a71a254feae847ac9dc9de4b4d

SHA512
09e710fee1133d0b2ce96c2d3301ab71597d75dfd5985de0f274d7272919ecb5f4df6bbfeafcfd01b8aaa3a8c0efa9b86419faebc5ca94a4d4bd8e994f33d92f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1KFMG8DT\Dz_guscQ51x-6Dk3enFHH[1]

Filesize
35B

MD5
c2196de8ba412c60c22ab491af7b1409

SHA1
5fbd472222feb8a22cf5b8aa5dc5b8e13af88e2b

SHA256
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

SHA512
84e24a70b78e9de9c9d0dfeb49f3f4247dbc1c715d8844471ee40669270682e199d48f5fbec62bd984c9c0270534b407c4d2561dd6c05adec3c83c1534f32d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1400.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar153D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads