0de079dd9f11aace121f3b93205545d86372322e0e0de9b36e68f1d747cb94cf

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Delta Executor PC.html
Size

4KB
MD5

9786fc2af40c593674cc8226c3d09ae9
SHA1

1f8342c59f3a6baceff2b2378bd595e3c1ae6998
SHA256

0de079dd9f11aace121f3b93205545d86372322e0e0de9b36e68f1d747cb94cf
SHA512

749ff789eaa1a44033475ccdf782c588f31a665a86ccf9a217779fdd31816b76f3c73babab673ab7fd941254025efad2c6b574ddbda98bf3842447b9deb29378
SSDEEP

48:8pyvQhNLYF6zjzblBeDPVos6AzTIQM1I1xIvIQIxIYnIcIfvILlI2IpTS3:8cqNL1PzbliPas6AzTpqCxGHydrcAl5l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414531828"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8C937C1-CF5A-11EE-9295-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f38007c935c66149cc02e8d455d6f8446e63cee8f18d4835c3782d331628b36d000000000e80000000020000200000002a538edb392e767346bdee97f3587ca41fcc6f4fe2edf8943c622ec160148e9820000000bb7e4e794aac6d26b5fe9353a107167f17a00ee52f8180ce6c229bc28d5e046e400000009f3a473a9a26838b6b52d861e39c1065442bb230fc4446e141a74692f7dbfd27dd22bc6089518101ef472de50b975df023c2647143a47933016b48a663ab8188	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000c398d66d3f233ce62668702f085ace7f9432863d3537d29aee1ba6bf5eb91dcb000000000e800000000200002000000068372f06845478ddceffeecc5ce0434cf017bb3ad5ea566e18da4e35390ca5629000000075e7a5ec7775d7246779b2595b2f2aba17c4b662713965defa9fffa5b25aa5c7abc88693b772df2ac86afa0b4f687273d9a6637a5505040ff314724e96dd135525cc65eb3799a8d07db53960f6983c930664b52c112562bfd7e5bc8ce416dd20e32e91de2bb2f12ba31de1593279e09ec1e21518211b990422008de5e01eb111f0088872a85d5823c82defe8e3528eea40000000d28a9371ec046da5762ef5cc3452354d90f09b5feee694295281cecfb7112cad4e616271a8721559696011e66cf48a50cfd3b71c5af655715991cd9920d17e90	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50edb8ad6763da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2796	2272	iexplore.exe	28
PID 2272 wrote to memory of 2796	2272	iexplore.exe	28
PID 2272 wrote to memory of 2796	2272	iexplore.exe	28
PID 2272 wrote to memory of 2796	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Delta Executor PC.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b565d999d11322c3df56a8a1ba2874

SHA1
c14ea5360e9fc5b0ddbec667064d8dd90f230624

SHA256
8824dc88dce1e61d985b4cbd62ed464bd94b244bf4e9528aa92edf22fa74dad2

SHA512
5855ed76a23125d9fee427be8d1b48a09336e332c4a4b86554fe45d75abeab4da57fc642eb1cc6a805df7fb58575fb163e90b4652c894283ab0609ed2173d983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5cecaf0a3b585f6c82fb8cee97d8a63

SHA1
af531830dd2437a1072f900502f48394994f1f91

SHA256
23bbf7d20839bd8c9f266f21beb0470f366fd39e0e5cc5f1a5c5461ae7cc0717

SHA512
441cc65226fd3e9de1f10a431207e672771f63dbd8f856d19f5317dbb8315b9b65431fd0ac26ecdcb459b2aa562911ac5c3c1c4fb5cbabe2ff6536fac0caf2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cecd43ef368ce4a592a5c034abd67e0

SHA1
76e67a9b000d32288117cda3c8c6a5107e80f5ed

SHA256
f6b108d3ac2e093c2033353e22f9df395e80e026ba1c863b28717771bb1cb373

SHA512
a6234da21c717fb8a8ed0963e836e64f06648e558cb154500d168b13b2e8acc1ca630bc58aa374521458e02d505df57f7287c50d7749d4a7e5c0981a9cb9c747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09a0bf8fbb85fcd40a6da4a2376ddc20

SHA1
b46ac837d7451a986be6aff745af43a2ce01376e

SHA256
d25878b1088fd7dcc21e3f797e9cf578371d75a7f5930c60364aad787e5689e0

SHA512
931fdb0791a33c5139cf8cf7c7f3f99d8772c8692d648a855ed9206cbd8f27c975012cc15a49614b6d10c077af2795348cd278d2905ae904ede43bc3c6613257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a4b7c5acedf420cc41808be808baefd

SHA1
e6168bdffd7647550dea82bdac177c587e66fdbe

SHA256
5dff2ab859312f17ad82f470c9d0c05854b5f927d805c8e75a6c6aa6b14fb8b1

SHA512
eea42961d52714c01223cbd3d6164bd81afa43308c8f46afc715fd27882247d82a50cb05a85fdb577889601c591f1ccac7734f2076f84efd70c52e87bfdb48ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d06b6f9235e8792fa126999e3405e144

SHA1
bf74095ff9e44f86c1973cb2386a0e20580dead8

SHA256
2ec729a6d8d567b83d88a1d9c4be0a34c65ad91ba774168b48a1cff4dac648fc

SHA512
a1557b35bda10b63f45b3e3fa8b58cc7be4f2c4ba1dde4555c471c5140037e94d55c726c2d5223ab19806ee53f940fd4ea726518cc1f6e95286821f80985cdef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
114a95f46fcbd523d9a91b091b172efa

SHA1
36381163b20a23fe7c98aa3b9cdb6a31c2b6e7a2

SHA256
36962421ab6fa4a27150adb299ff6f9a585e5c7b231a07b9e6a8c3040fb95348

SHA512
17bfa1dc15bf64f46967f070fd4d5648028a68b86ab9ccb85482fc04faa2ad2e2bb05b208fe19367bf7576edf784f616c891f9d7c417cfd20e05ed06b090a294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a5b0e908ea94d260a5b0a115641e4e

SHA1
6011b4a85fb3689276e98cd4000a8889da12b444

SHA256
953d7cd2b469e618aca153182692ed257a732c6e483919bc9a66802f6a7f4980

SHA512
04173b1866f28c4ffe8d491e036c72b725e7ebb22406a77768e85fe3f2b6d2df1461c2a7ffcf7a566e2cacbe4712a787e38e51b5857a7108e9eb190dc20af69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a36a385fe4a442e33b721af57806d3

SHA1
cdfb24d9d8d74c88b1db840970bea27d7b40eedd

SHA256
f895ca3202d97b3df33b4e87bade1a4df64f820cafcf909e9b8111ed2cec5c2d

SHA512
1ecc7ceb5b1707fcb89c07bd10d809f64d6ca5a55c54da5fa4611be434865acd235450e49358b2ae0017acf34fefae510dd29ce9223240248a135b76cb682b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e785d98e541ab83e44e1771363166a

SHA1
dd864527c476246f14e03055629a751e557db61c

SHA256
120c7c080cc0a7339acac5bfe3f388b0918709e44a5e3979dc5719a1d6daac50

SHA512
60fea0a20257244c13de5568ca8430415e7921fc0890135cb4547a9155e5e4012c3442626b873159a029c23996375ad01dd2703d664db8790a7bfb9dd75b6b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c26a805411f12b4bc8d02df9c4eb36

SHA1
e1b985c6cee64d8fa3146657f77bcf729d207ba0

SHA256
5019adbb8387b61361c3aed6f211c6d6393ac2d547e08c02939434716a9178f8

SHA512
451ee1769db067d551a82326b107d8904e303fa15a517d236ae15e95159ab879625d50dd6104b9670579b9e7a240dc38bf9a35663c74f5d6564f7631be870a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03963fa6d609243495438235c01a954b

SHA1
2bc8a3f8e410ee2a7ec37d8ff34a0074a6e65dd0

SHA256
24826fb14fff6ee71beda7207cb1e4306298d3347cd87adbede8789ef9475fc0

SHA512
a149f793992c555b1f9b92f387bdea1aed5a07fa787e19dad2570a98562e621755ff48383a430c6ea1a7de06a8d9420bd837dfa9d990d85de4cc4839db13cc88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1be5866aa68a60c06de9689ad284628a

SHA1
247fe5b906430bd6135d26ef706c797a9fab49ea

SHA256
af9c938c37614ce89d3fe9df8c3218fa2019e3446bc27da54dfce9a088f65347

SHA512
9a3072e9ff7cd59cbde78940be51fb630c75a6472d774e835807570130a532d028c03560d65c0a471c53196fdba66aa46ce0b4ff69e2f56df5a6023dc784b43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa4c232029e506bf1e2b4864a4b7411

SHA1
1c494b87802f3e8def7d41c32d971156c33517d3

SHA256
8bd034560955404c5c0eb3e5f42aba6a1bf1730d8408f2657591fdf961cc8ba7

SHA512
d4681cb96cfb78f2d2656d5e54a51a265d8b18361949c37011489339f3cbaff6cddcfc4b4e7672cf9063043a4ede6b06874fd64e1fd57ef21bd1bad7793dea14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
070b3b50007517a60fffeaa4a0b6c192

SHA1
9065ab0e9247e0e4c3b2f2a75bc98a5def8e23d3

SHA256
df37962f5ba4689ecaa9cb809d120cc795dae1ef6c031c40d13b32adca32a4a1

SHA512
71945af228ae9622b20fcc323558d3c9455cb40b353a43ddcd059a501162e45647f8213b94484f9b957cc1b07cdda0f8e38da6519210b42e238c68562fe2cf42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e6f8ed2f6089f01cc2ffc7bab540e6

SHA1
4b94ca943aa1a9f5f1370cc2e10141b88b660408

SHA256
2a6a5cf25a5d405af33ac8df49d5f6a98e5fe12a176f51076a1638d19e537cf1

SHA512
e075ad0e0c4693479d09e57df805f9b126d8aa1a75261aa7ede8f4b946a2c958f6b99bc2d5e37c517d3f6f45d127c6d33bb661031b6b383357cc8836b718677c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35699b87c49a110192140370cd4d964

SHA1
9a2df90ee93f7854b3e3692d426c6591f9e750b8

SHA256
cd09efee17e5fe9d261d210a05d0fe7b8c53dbd5e2556f9810611231a479b162

SHA512
b9bfa7950e0535e97bd32b4e84f8ef78ac2a022671313d837091522afb2242c55bf215ac8dcd69f9fac25d78841c8fadb48ce1d2fd327a40f7f77655cadd688a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AEF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B6F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit