hxxps://www[.]hybrid-anaанализ[.]com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.hybrid-anaанализ.com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412455827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48578CD1-BC79-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000014ea917261716d4db25b056e63ac8f1678b425d4b96dee57f33dd2aee3e2bba2000000000e80000000020000200000002c7fe21d4a81c18735ea3eaa51787defc7edde6c40ceb3199b83c2e1f4a5fe14900000005f6335a03873928b1c7a6ab0a4919ce5a12afd46ee3903c23d9ec6bfc978d6324906033d1bb4bd3371e30984fb8edf1eca23b2fa3153e7ec0ebd6a8d9679f7553abd258d4263fea4152f12b1a90fe223b0460b0dab1f02d181002d41ab8433557d86ab60c36d4b88d066299ca21830eeab598a7c4846ebc3e220c5a8f026e1e819612f171d696ea3486061fcf4fc593e40000000e4ec17e7f58fb501922772e7e5fdf81fa930eae9ba6631e8b6dcc5bccfa371ed6b3b0342ba2c5d4cc3f3b0a34d6d368a0ce9e2fa119467f3dfe86f1385bb9e0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ff81cedff849f76c0b740110520ea0608ce7904611b4a0c5d1fbe402af82e3f7000000000e8000000002000020000000e7669c474ee69d41180cf0049c5dd9aa59aca4f154943fe467b2a9af063a1eba200000007223b5d7e9f229ff921c0bcb8bd4e09dee7e9866aecabb39345fbed009817d1e4000000062ee2af03f8c6bcc05e0b0be5b545ace7663f994d978a0ccd2639b30c10c2045ed659d45943f431487f152fec96eb12f672d3f4ba824e4456e88ee6ec687358c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004a721d8650da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3056	1032	iexplore.exe	28
PID 1032 wrote to memory of 3056	1032	iexplore.exe	28
PID 1032 wrote to memory of 3056	1032	iexplore.exe	28
PID 1032 wrote to memory of 3056	1032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.hybrid-anaанализ.com/sample/171562a0b0680e2fd9a 0c358d8c13d3f28849e51e7d62c106bed8b8ee3fdde65?environmentId=120"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11ec70fb9d892b5e6f1168f3e90e6a1

SHA1
4d77136486b8c6dcc21c00e71a7ffcc58a8774e7

SHA256
fca4bf6885ae6156d8d502235fc6c699d76edea98b9470fb7e4159610a711adc

SHA512
d2e29994cb8ac902ca0b5693930e69025d2ef3a6300aa9f6de6306e5891b0ba8d281e28f9dbc285df4bfc3c6e44014a55af8c8f503aa06902e82b98eb1d3af75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0346bd5d32a68aa8badefbcf5c7b1e87

SHA1
14bc8c6f77a13e38a542898ae7e44677693a4a8f

SHA256
9e21a1c79993dcbc4cb968f38905a215662fee59186467958b5277e7c8596097

SHA512
4df6dbd4c17c3cbd29c8729a5a51e3779ef737944ecb76dbac00b9d5fefa7e66d8991163436006520baa322909ed919be641910f7d394e744d02a9aada70566b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41604a78d0272eb5f45c7650c95a3f8f

SHA1
be096d6b0c833422df10f07c2e9bd1defb0f2684

SHA256
883bf3f605ae71dea9db76a678429208e755e1eafc4084aaeef482bc684e3fcb

SHA512
d6628cf92bc46669b82188d2af11a8587ba8441cfd4ff4dbcbed1e86302b5ed78d9fc6db7b99007aea6279bb15492b993d99242e80ad585369c8c0c09ac5bc2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a60d4a6be30c45282b8138884f0a8f1

SHA1
cb6f3ff3ae51054662814c9e7b12f06ba1e90d35

SHA256
b03d71453a68fb409d15b39f538903711fe6ee97021da60938923fce37853fe6

SHA512
2b98b8e8565f0cc0bb7b252f4379a32645487d12455c6395a0aa10359581fb17ac4629435aa69b82d4c4dbc896f597d6039dcf33d180c406e2a305be46145a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4822ca36db27a357b0a543a163dfacdf

SHA1
0425bf6be1c1b80495773c85a443bb06485c2eb3

SHA256
b0ab0520e9abeca755975c48c350085aa6a29b42887a8a7dd3bb5cdbebcc1652

SHA512
10084336cb97d185aeb4acb5f4d5e144f76231e5b72dab441a43fed46842bf68e278ec21196fce6497d2718b282a577b492b3f31c74c0b27124c9ec3a27b2046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3e4bf2291db29f2b3e2d40cff6e4abf

SHA1
32bab043ad18c101d8b3616d8df80dd02d65e306

SHA256
56ae9dcf961ab80faf300fb1ebf104686d9684e041a72ab925a8b57d1365bd71

SHA512
2bc319aa5f89790683aed8a136e9dbd0f2c426cc44b4a6f683b9ddffbfae6926fa7fe59452c1aedb7334f22a87127e057636bc304247e11e42730ad930cb3a17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50412151e2d11f18d6ff8dc92d7a58df

SHA1
563d1aa0595c2568be46de5f14c5ab92d7422694

SHA256
30218f0eee0a4e1cf78277cb857fbeb0e3dcfa28f641483343e129eb585be4dd

SHA512
f0c9d56243c14e6224feb8a7e70198e88d1b2247e4c3d8b42bcc303947eb14b589bf92f8d9db39104002baf2df51e4f9e48e85646f3180ade4287124b7f0ea76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71826cc363a4f1c8202180a2ebf29a04

SHA1
d5b4ce52fe843a5988a3a79bd3b83d00d72d55aa

SHA256
d904979389ccd07e05309e7a75b96cfcd0d76351b38187dae1a5c9e9b63d0ad2

SHA512
86e9d6225a116ccbd44f8f7904400a71590d36eeaebf5015d286134b3f582b05f609408d4b9beff0365163e82c6425285cbeb8c34329ea3b71fe9d5e47f61c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
393cd4f80879289c75c737d30ab0d794

SHA1
3f6d99c90ea1446a0deae0da275e042803952296

SHA256
e2050946a3fc6617dec72fe50ce0ed0b3015758d8308b61736bfacdd67f4d571

SHA512
8c766e93d90e224c7161b81dcec2dac5697429332c04ae2e629f23e8ef7e809f9a4a48a1bc5f30b2995fce7e407d35e705d9692ea9736566e47a3fa2b52dcaee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452a90d24c7c033d421672a3397d7c18

SHA1
348879e6b401be2fa5129a1265f3af0e2b8ae81f

SHA256
85343d6fbafe5614e765e9bb371958aca01af31a465021615bce60b6b0ff40a7

SHA512
939c12aea96158a6d1b6e5640dbc574936d8d9db2ad0f7551cb3760be7e3515214af75fa7735fe3bf32775b2c910178c5b692d7f634fe41ecb7fbae6c2a3f834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84f61083b06da325713a3eaa6f6f5d7

SHA1
9bbc7c6503ad2b562af0bd7be8d8d825174266b3

SHA256
7c2ab1d5d63dc7f017c8137a68d9ef20ea3223701229e2355db034648a9f8a3e

SHA512
c2b7624208616d4bbbec3392daa56bd394e8c0aea5332a2f44b9496223e43555da8d66c93e551014dee41c574e9f07837be1a5559a7957b037de1c029a65031c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfdf3901ff69493ab28ffdc816f024c7

SHA1
cc13a1d56029f95bcdc1ade38d1928adf9a6ed95

SHA256
9bfccdcbc2fad3d6cf3c74c39a24886eefe63766c982313259a242f24d2a2ced

SHA512
ebe6274c0970dec31623e1344dd1d3c8581a4ec8bc406304a8dadb6e452f92ddbfc480085dc6214381a4050e28ddd2f8c9454987b618e7f055168d40d2433b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d54c67dd1ee373ccf3dd9069f078f22

SHA1
8401a9e0252605da37499e8767c254c6e3fb33ec

SHA256
4d95d39d2d6aeb4fa3cd6ea6955eb4661ef626c4919329b18b638a9ccd8c8dea

SHA512
24b08e8c672d4ed95050002c15efd3bba94e613d0ac18c5bc0556d8781d3de9c852a5d1353603e86a50027574fa4d9f825bf6b0e923b263980006ef2223e0612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b093658b8a1f098e318aa77aca2a4dd7

SHA1
05d6452b006aa4c93788aca6c499d2a031fcc8b7

SHA256
7220dd8f4b53f32f35d4ea21691c5ec95ad26d5d1aad1a510bb0c4c7d23c3929

SHA512
113382324e250d6f0783205b6804782dbb58d1f7b7792091b899666d6f5c5f69444e4c82f3ef6d69e56b055b7c846c93f9b01f62862c49cc8fba6909f4c42f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287f16cdca50325ba1e2362c5641f418

SHA1
eb1d5eab9b51d4d82c29e74fc5aa9b173b01f340

SHA256
b762c1bf5d01606d03be6f0d570497e963b9e629a28f0c6bf18d4093d7b2f839

SHA512
8ba051375b349bee0f7f612256f91d72fc99c2d6c89e855ae3ef5bb500b8397e0bf7a32022bca6976fb87bd81eacb341dec276c0e16a83672f3fe4c38f2823f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84987f70e78142913ea4efed804ebf63

SHA1
5d00a5082f8c9fe04ffb583468390cda46ea9737

SHA256
99b4b790c22ba45d4f594bb2cb293c79f4ec98fa5c88cb406f78dbe017d0d85c

SHA512
4f6188de0c0c365bcaa05a4b57e2fa56fd75b26566371d220b0542d6df43f4089851c471cbc8d26127ee352f88fad3951755c014b5a2279a835b16690aa6621c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f936e5013b5c60e09844aafd89eda148

SHA1
418f454c980e7c80e118e1c7d9acdce32c847691

SHA256
c996c40b82480f5088e2d53d9fafa8a22d1cbcf624f423fc220d57ef99f8198c

SHA512
ab92ed1b51390791d16c2d33d588df41f3c60b9b9c79113f585c55e600d8c009e3cfa7925532a5ef54dd5677cbd050888eb58cf5716793ecdc242f74ab6c1803

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA78.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit