3d21dfa9f199f495aa956ac9dab889a5e95db2508dcf65ccc131346037288859

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35256345/chap1/ChatRoom(Winsock)/Example1.html
Size

1KB
MD5

09ce34f540e588593bd92779eac5b171
SHA1

85395103e392bd44717a0d1e06ba8b1f7e8d5a05
SHA256

d7f08fbde90528ff079d96bddfd30b461b11ce93c4eaf95577e56c5b7a640a23
SHA512

27572e6f1b18ddbedc74dbeeba8f4dc655aa8357baec26d8a9c75fde57cf896248e74b6ed1e363da3a2f2c2f86310dc8b95176158d917bfa1c4b4a02bb594b43

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413184322"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71038981-C319-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000fd216a84a13a80cbb489cf7552857868c7f9c8163770789b544d58eb47759b9c000000000e800000000200002000000046142658d5ffe9c292887a5971140680fd50c07e731c936ef34d6c5e147f08812000000096daa0d352b324680289e4d26a15485c326ee890713e7d71853c9b6182e4ab7f4000000045f3fbc90c4f48ff39822e9dcdf84060f9f95936321be53d7aea7c05975e3e2b2583bf239b28122c06d67f187b202417c86167b004f7f291da640d7b30634cc1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bf6680ac043eef7d32dc7893898e1538d631200160e662f381879c7565f2a9af000000000e800000000200002000000059251fd278b1c9d3cf5f4e1acebb00a3cb7c61379359308f11406072e80dd191900000002bc8fc103266f712ac018ff2432d153827e0d0a099325b3384befe150869272eb32e58954d150495949f23b6c2f8308ffb626c09fb20a6db4d57b33cbd35d1131c358ff86670bef4f3a48572542b1a1887f2cf46a044d6a6580c77f95fa9def86448a12737fa174310c7285e7e77817436dc9128a255ac5cd94ab5c3ac2350156621ba8f9f1a1ea49efeb5eb6c1e1fe6400000009276787ea0f92b7b1a383732ba71908bd238c110945d4d2c35b014e183dd51c91b5fa88268fc368a16fbe8720ad5f2e2b4fb980ed5f17115c9c38f483c5d8849	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00be8452657da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2928	2980	iexplore.exe	28
PID 2980 wrote to memory of 2928	2980	iexplore.exe	28
PID 2980 wrote to memory of 2928	2980	iexplore.exe	28
PID 2980 wrote to memory of 2928	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35256345\chap1\ChatRoom(Winsock)\Example1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b15d97a7a4ee2ccdf237c113c809ae

SHA1
38ddf6e7fcedf66c5b436e6d54231393ce9805a2

SHA256
b798d530e6256fd245571da35c9316ad79d0271b44999ebb185025f38b814f6b

SHA512
0bc000af3a404fc19eee8010db8bffe7b85748e39f9e980d72beab97ea3a1578d296d309a3ddbc5f202644d85cde1fc7e3bb930b3fe979e2da590f965ea85c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20ec3f1961420b86ee33a28fe946427c

SHA1
7154ab014de78fc74dfd11f5a65f18520c1840b1

SHA256
75ce42aa46c2a187f1942610856598aaa0e4b3037c90d422b8053fbb45bd15ae

SHA512
bec4908ac8117254f7935502b26d96036e0681243186887e073d497f51da023e054f05a073af6cc22f595f64e7003252718c677700b9ef74a51787615493b266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ddb21193d3815332ca1510925094516

SHA1
a230ce80b37adc794f2c9603742f69226b2a35fc

SHA256
63d58a6b5ca988390d2f5050af16124d0a66e879a8185e204d88508c9eda43a8

SHA512
bfcc2c8387b72211a0b5e7c5411d006a540616998d35fe1916185fc3aafcc0d47aa92f49e3da18cc114759155eb140c0fd2f0a711af661eac349f62f7b98d8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
833f1a1ddaa3ca2a30ff5c361602e736

SHA1
415b80156b52c859e379977e64c0226dec5b13e5

SHA256
bffc20bed40e399fcef93837914f6863885c03f31ab71ba114313ecec68775e2

SHA512
6e23edbb27d63c23aa9aa37ac9a122e104b757636f7299e68b70f906c6b89705625843da502dce58614ef18559c46216d2b391019a069a54bb6d036e1a7a8752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92198a2ebc21d4afa4d07ef1d84b6adf

SHA1
293d0fdaf05918ec0370d0eb4a1ce0ee70e02c69

SHA256
4b89c76deaabcdfa84d7fba5b0dcafe41bf6cbc8653422e87d0942c39ecd96b5

SHA512
418a028082451671184ab1def0ded7f5dabc2bbed68f4eb1ed2391b6d0c8f1605d72c91c28bfefe02878a80900ec8f52a6d67e85b94ff46993343f394e95aaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d886044b88cf231b4f23a2c299e50c

SHA1
96d6fcb23c937df298eeb8427de535816f3f61d8

SHA256
687012b237da4e61069d380d3c1b14853bb8766817697ff8e9ba527e002238f3

SHA512
1daf7508fddf88a93022287761e39113b9dbc7247c6413e0b50383656ba1e552821b910b3f485d9d0aa08308baf1a8e1d89aa50e21b1b8e693ff3f34f2534a54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b23e28180bccefc2bc6dd65c7c4b9f0b

SHA1
c1ac142b670b2bd63f83217461c060e04e3843ae

SHA256
0425fbd1b0c215f4eb29133f1e3e0fe0a18d3699732543b90dc37a1f28e7be05

SHA512
8852c30d866acbf18b300658bb77a886734946f3fad5dda6649450fb07eddc70b4ac89ff45a0b41dcb8a905d0d29a4a531ba191103c464d63e2e679e754c7147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54e001d55edb224c1b38f40217a2751

SHA1
d3efdf65ce8db94becf596bd2e93c2e1d40eee4c

SHA256
c9674a7ff0e60cd52a2f145037798c9ab3e7bc2c6fdecc6655f24d4715a1f324

SHA512
3af041ffdc6a4c39e7f626abee950399b7b3081b5bb496e3da3daf9aeff4999816d6f35ca0a15724b7bfe2959af7f590ba80d13489121a9bf4d9d1c15f62e492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6183e3e789abf838b791b90c661031f6

SHA1
1772d04e559becf27377324ae679879b9d89f04b

SHA256
929b84a082016e8d83f31c19a02dbf5c3c33f26a989647a3d52a78e2cec42dd2

SHA512
a76cae4f3d77aad82343af2901a7da53879a17103d18f12e5d1775eabf1ff2328140fa066ec89993a31a0c62c535a14bfbe07aba490ebc314c6e500a1e8d8f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ab8b5ef84070717fc2daec9e8ce5f0

SHA1
82d90162083a241d904ee41ee84030644a1dbd80

SHA256
0812b9c336a0d5db9398cbeb8662faa42387190b9d9c9eafe096459b48b00e96

SHA512
d2fd446bb4751f1aba9675daad8a4d4b1257c5ef3aab69779e990a0f312cbaf480a867d4cf0586b192265081fd1f06ccafc80409b7f8c134820b38934d66a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c11ae38130d2b36f365795f58871cde

SHA1
2982201a3987dff46ada260c28a6838180f0199a

SHA256
6099d4106035e91086f43c430ba231ae77a3029da62f3dc72413ba8e1d470b38

SHA512
1ac69fa7b2e7b3c5511955f96b3bc47ff9d40ad33480da6220000d798ad9c7b248f40d0039fb27e0f01e5429347bcbb7a1591dc08798dc214036a116e809c5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
638d6ae43184b1dc08a7cd0f58f116d5

SHA1
ff2502cb6417a2ca9044d27761fcc85055d98d60

SHA256
ae7d95373a300296a0f71cc32eb039ca1c8eb2e8ca2ebed47212f447a58dde2f

SHA512
98a46a3426be60c1001b6bfc375b8626cbe5ed8ece0b84a4fb0f994cd39e43a0eb29c8624977b1845b9ccbf2102fa6db87ac9a57814f066c4d374e04b7b32bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ed2ac977b52a2a306f8b28117362d5

SHA1
d9315582c5241f0cc9028ade06d0c713fd880c43

SHA256
d0dd2c93e8a2d9ba16cbf5a8b73c80f1d0f8825c09256c1a43fc6524060ee8db

SHA512
68ad8288a5603ebe69e04fd7b85700e324b46df84285a88fce509794bf70ac5ede44f25cd45a0cd6910c180d311c422ba9168e04c2750776acce2c7011057b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f82650fe8ccad70538b793e0f0ff4fb

SHA1
c5b5a3656bda0a68db5f9c492e9e7d6e82ccb589

SHA256
f46aec512d3d76f176b3e8ea124f41ffcca550878360b89b3f7bdec37b4a329c

SHA512
36aaa24d9d2da58baf7d59dd023cb632614910a4b886b0b3ed6f6d58020c1ee7c029f33c8657af648a2759b29a861d4ca9d288e63d14b27013a6ba3796846ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f141ca8e91a0feb7a360b8cdc25281a

SHA1
9ddb9fad9f08b393458324ff2bd7d76b211db772

SHA256
1c73181d2169efc39abe3dad5ab93576530d702da58bd5cf647c9a3df01f1dc1

SHA512
5925f6a7750d6bd0c6e27e066631d2b98563c5744ce1c41cb05929e764d75c483efdc1b8b866c0e6240056f9ae9f206df64e5bdd967477395c3f8577581799c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ec53598fce7183b949b426caccced9

SHA1
15338f2ac475c1aeb292d8cf9b92f599c2f7a858

SHA256
63650eb7e57e6e4ce82fa3471db6d8712099a61db7fabecebeed3e72dff5994c

SHA512
f32cfb0119164858023b6b47422ebb1b25c7242ae3dceda7cc42aed7d8ea17c87fc9b161d53ce73cb3378b0c32b36b350ca23e3825694755c379ae4a2d9f2f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D2E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DCF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit