7a9a9636399f4839c48b9f1b06708eafcfab8fe623cb80e758c986ddf046df13

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/.install4j/i4j_extf_7_7caten.html
Size

403B
MD5

b44a3b3bff9b6112fd91d0044d714766
SHA1

cfe32d1a1183407caa77ab5d93f2783eb746b0d7
SHA256

72f47e9a733674019af0539aba9869adbb48ee0482afbd92cba05be78173d766
SHA512

db63df5bbaf485fc8ec8775fe674eebd3c98c5acedd4ddad2f8ce3244edd1bf44b174826e0cbe96b557ba480ce496ff3add5b95f3e008b053d7782b422ea45ea

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{821A4BC1-CA06-11EE-BB33-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007aa241fc300d73d7db4cfdb3fee31bbc9ca375e99b16af66ac1273e537ee5d50000000000e80000000020000200000005f324277beceb22d21d6582b85970e95e956e25bcbe57873db148c5124dc6bab200000002f834d7fdf6be5a36f1fcfac4eb6daa6ccc2fccac5be135be4ce0be3406fa36a40000000e7693e1d065ef3820f588606651d04127028c4870db40d2b9100bd44b11fb42c83b50f722c49b853226545b04df5180e31e926ccb4b93f0ac3d44670ca2aee66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ad5857135eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f0fcfb52cc17b4682ed7e271f5a835fe1e57a0c5278cc6b1572073f16eab4cd5000000000e8000000002000020000000c055732bf2f27993b92d60f893e89a4127a13133abe6543dca160bf83830c8fb900000009f2a1ffa6264eca27250bd1e2f1ac2a02cac97c468bc117d476de77dda0fcbfb44f6475193687d0e504439329b81987394f62022b77401e854ce1973897910218fcfc08003852cfeb3bf7a453621defa8c7484cc94254a32d366f205ffdcd91ddbdfa5796ec961fd9912194b44d196f68ebfd258030d09e7b3f04926f286539603b2a0fdb4e357170e14999619dc5fc8400000000b48867b2687be300de91f0b81e486538ca0e8e2dadde925aa6a165ce440c26b8712427ffe9e3caedf89ed51ec71371043e525b0129b73638cdfa1a9c585bac7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413945849"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2716	1716	iexplore.exe	28
PID 1716 wrote to memory of 2716	1716	iexplore.exe	28
PID 1716 wrote to memory of 2716	1716	iexplore.exe	28
PID 1716 wrote to memory of 2716	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4j_extf_7_7caten.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80436190b40b0a671347d5910ba5c43

SHA1
dee68f403b9624d459773598c57ce51c31f4fdef

SHA256
8641e2ce8ddc2437d30448b5fd855db92b3eb33013b03d2d7ef4fdf813bb1a4e

SHA512
d5eef404ead64f24f638b61229e9443024d014d996f350d4efa95d523d1142b7c7253c143ffae625a30d3b1b054e595aca4aa7d9ff144455432188230a36f0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb2009649c54b7e8dd5f1cd5290d15ea

SHA1
8667beabe7cc7771d6b5c2dc8eeea9c54cc64721

SHA256
930d97c9240ead17bea540411eccc1090198ea55c7b97699ee64f62647322722

SHA512
e2b9a9e8181b5ca947f20969f2a7624e4cc3a15acf0261ead56c6d9b61e1f5356212bd6f436346854dca1b3b123853d0aee78efbb83806678a9c011f82cf307e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f681047b1b75e042ff6edc7a7aabb5

SHA1
eed49744e6745f5b028d0a9930d8ccc7ccb71807

SHA256
5bec183486d4cb71c26751b3cf776c807182fa94e3d39e26eb46aba683725f3b

SHA512
ffda647b53630e1f8037e3d1609c52c065e3cb41cdcaab0b4d04227d6aab2ea89b1475dbbc0ec92a8e9d70d8ddf895ab6ac87fe171d5828d277fdfbbb74c93bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
093cfb8975b8978ce575e1afd01f3480

SHA1
4fd5e88471706868df46e3f30df7c879b9300fc1

SHA256
d7e012dc847831b26f95f6d1529d3c2158de2832856e318f40dca6363dc4d9ca

SHA512
13531ed2c2a849b078e4ec3488ed05575581942d36a26193cafc717ff207a0798224e427a15b4e06986212936e2c9cd07a7b259874579ba1079cf1d043a0a94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe53a397f5b00875314740a9459b4be

SHA1
ed86596635acb5ef31756ce077368646bf2a1b28

SHA256
6d6c5e0a4d521314f08e55f2d33c2dccb5776470a37575c72c8b7caf41a18691

SHA512
3c97719f9576af639487a73e25dcac393faa1b3cef7f291f5ea17b48d1de9b1baf43c89f927df92f27e7b15931be8b45679543aa32de292398dfb520e8ff0c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6921051706dd8793ab033945176db317

SHA1
2edcecde5d0c3a48dbcdae8b714cbc8d7cdfa8f8

SHA256
997483c314a31e74045f269d8d694eb71d6a0dc2de216287d27b96985bb95940

SHA512
9d6480c6be61e86c91206173954ce252b12a12b76148e8fba9339d645d284c5968423945247ec4ab1eec6fb08b833b54dfc130dd02faf4afc9e8fd8f35f90c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7b1a2a3cc7ee0ff1c189ec8cc48f083

SHA1
4aa8d43b2a66ec97bbe3eca49ee13b191f38eda9

SHA256
f941df2efa659917668cfa74f31efda4d8ad57adf0223d3a7e96733147fee44b

SHA512
b261a1e87d852447fbf5e1b114498b2c2b54611b7c84d480304b40dc189cee5ebb86fab0b9e5ac409a32f2d53cc693f7099d066d19e443792c1bf074cd7fa895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c340676375aec187ba41b3028ff70e8

SHA1
ebc02d09e9840e11c228f549d71b8d36b349b169

SHA256
26a8f4860267bae5e82acf864f320e365d8ddc77833baa5f3ae019419e3bd210

SHA512
72de3fb9da6e64126fd7927fbf65173e8265dc7186f8b5efab745e88022a35ecbc9fa18913e35ae5dc0efce45429541cf28f8c692363e1203de9a6382005924d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a1775593af2af014704d507c00d6a5

SHA1
c62cc1170c98f70182f2ad91b4dfeef65a1e7220

SHA256
6b778f5b4a38b6d1267e56b577c6fce797c3d1ee924efd17a8b216e1ddc896dd

SHA512
251ad05eed534e921669e2b14d703fc7f6db2734045a13b6b6198468407d96b3c7c2991a8c0a7b42941c0dffb235b11e1cdd3d04c468c4cafc638f697b61ce24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
750efa5efd31138d8cf62f8e78a36193

SHA1
cbd06e1a86b98b22ad5fe85855c7fdf132425588

SHA256
d5dd7f0f9f6d5678d248c7c256d12fc7bccb1df888fc2a9c34b32feca7caffa6

SHA512
3c5b8084190ecf317e092546cffa443d61955474c796aa28f2fbbb2a21e9d22a54d750a6429e49ffca7f90e1768fe7023818113b58bcc224048f4394b55d5b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbe772a8ea618d4df795a2491be4d41e

SHA1
4df1e6d24cf077154cfd832ad03bd17dca03f86c

SHA256
689de87ffae3718073e2f28b8bf19ba8e0137f76feeb3a1e8964989606db60ff

SHA512
b7ceb275af5392814f4f50c70cd08ae39e09e8886b3f3bfce5fef7fd6573ac12607260edfb02e5c608aca20151a21bb2d455d95aaafdcf010430e1833902c6a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
338149bcd8c9e3a30a032c45639b3ada

SHA1
99ffb699a1322da1356b2340aac7f7f0349cf442

SHA256
37b14eab5b147cd83ca35d9bfc575adb34e03e869b64266a766089c1039875e5

SHA512
f7a700c6afc8209168af73886cf62933bf23a7e40310947ca791bd6941982a5ad9dac0b73fb2c8310f25112a8f73e20b20d5eeb56308bf6b24c620d2cbd6a1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75f9acb3cd58006f9926ee3bc8b7fdc5

SHA1
7b4c6f0bc1b4565d10065c9e94a9ae8f1117151e

SHA256
b38db6f276933558dab10c795d96a100b7996d6c7f161e0db98de8b1fd12c32a

SHA512
8c2976af84379b4be8757c965a79fa30e6ba6e667e1d5d13e76189af409eb72345b5d794758faa0667e3f1649ec4193ae105886e701079a00e6c93bc86e8f22f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e1da1b2b37a77cbca116d8aa70e5f6d

SHA1
4e4539e3c791c3ad8c8acb01d510f703c1914b90

SHA256
f92862733893c2a2833840275cdfa1bb5a9e0b857bd0913d6ca8dc8b49a505f9

SHA512
9cd5fdb12e897a5308a80865389df11d93db5f16f37c3adf818381089daec1299c988916dcdb5884967adc8fb54fd275815e976bff12b542082728aaa7093c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575056c172bf96242bb9a59221d89007

SHA1
2e22b6d7956801a39d7e79ddb13ce4302feba77c

SHA256
155f9c67eb5e85b8c3a259f74430721e3f67db3bcafc8ddf9e0fa822ef4b71e8

SHA512
f075882499df99fe1c58c1829e91f0df35cedc3e1e5c06e7b422f50ff634271eb86feaf4a32ee18ba67310c0c876d30d1bf1647cf776b27bd5bbe48bc01d9bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f803411ea78d7e60ce11ca1d96c2caf

SHA1
1a3a7d366fd22916d8fadc15c758488354301081

SHA256
4cbd7a1fa407b1f6f8e3b7d4ac318cc2b40d0767607a52a6706017be25ab655a

SHA512
b050fa1ff2d9eef344488ee67dbbdfc4136c873c32fca9a29f93b72419c78e874c4f294f046ca83f32777678807ffdd8ed42c6bc035d843165a8dabd3cc22e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e2bd30ba905b42ef951f149332dda76

SHA1
ed421ad3db978870f9b3a20c3c4bfe001703e8b6

SHA256
edae0f7821b9d1f81dc9a2ef0efb0fdf4daa1d991ec099902c0bb53716ed5a4c

SHA512
9f13eee14827c1cd90995fdc3f2cc50b29f26441256e3de62246f515d477d1ad829ba9c2f34650402e334d5e82f23d456be8cb765abdea0a13c3a75942432bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6442.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64D1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit