8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435

Analysis

max time kernel
33s
max time network
16s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LOwIP7.html
Size

1KB
MD5

0961eb13ef799b1c1f2a335965f343bd
SHA1

5d7ce0e0c0137d85da4d7ced88bff2bdba80ed20
SHA256

8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435
SHA512

554458650ceec6f091e6451ed3eb46141d98deba5cab9fc54c0b956b90939caf5d846edc6ae4d368d88a964c2259f5cf9fcadc8f7e610b30928ea65af9b5c777

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e172f12ac07c3cae52265716c0d0b8670f998e7fbb9f124965d06785e674adf3000000000e8000000002000020000000c956223c1a33f79812dd41c9a13e1ae3f1a3444ff49a49bfd5f7532c5c67e74e200000000383bc925c470d89f76cd0d919baa2eda40c2c02137cb2c0e77d92413709398540000000480c759d408a4630986d0bbd089b25d68a03cdc30bfff15f70b54719aea338d98e71780c31da78c5061c4d89a72c95260bce7e7ce2c2071360467fff940f0929	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6EB2C41-CFF1-11EE-9FFF-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000279d3296f2a0da3e71e93dc44ae70e578eff4b7538f3e88707eba6f81cdae7e4000000000e80000000020000200000009328e84280a622f9b15bfd1b3566b8a3f6e566426573f1e6bda6cadf5ceab34b90000000adbfd5f02dcb0e2583a71e75c806bf60d908f34372fcfd204a97505f88492d1d5594ff699e1f108dbe5f28a97f18f80c8be45ff8b19e114990e86f4e04d635da441986780bd2cc013b3894b0d59f5cc8c94b630bdc19cadcb9eae0381d4af5e7d5cd32b38cd4adf3093f24fda5aee27d716dbe9892c3c36f0d1deb202dd786dd903080f2a0a6660a730792f70d2f85d040000000cc2e742f55e919f1a784a5dda5ca8d4655833dce5e5adb7908ed3eff2ff9f52c3b82a8241590e450bcac5f5b4cf74a078b9d2ed6054ea4cc733d4eacacaab1b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902163bbfe63da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
1700	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2316	1700	iexplore.exe	28
PID 1700 wrote to memory of 2316	1700	iexplore.exe	28
PID 1700 wrote to memory of 2316	1700	iexplore.exe	28
PID 1700 wrote to memory of 2316	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LOwIP7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2443f92c7ad4a4865061376f1bff07be

SHA1
9df2f56d25787836a5b5bd1d7df83eed8f48a6b5

SHA256
e991efbb29260ce21aa1287b1f481f9af0f93a56e32c2cbcf86ce3c788406c18

SHA512
0a892de9f39588f49787a536bbc2b3472902082abcf7878000f5d88de9318313a8697c833f736f222d38e8a32bd00395d43a91fb41bd9c8f18552f826e5b4b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828668992f15dc5bb858590289e11838

SHA1
a15b809b3411ea2a147f08f4f528f6088c1a997a

SHA256
a148cbf686aad431b4d927c037bf743ea5cf3836b034267be3d30cc687fb9f64

SHA512
98bdf583166982438a8fb393c84d7df7910ff858995b1ea082669d0a65f588476b8b7636ca87bb81b9534ec68d837e68e25148fedd94492246f2ecba66238ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d4db1199406715e26b72b451c8f1b3

SHA1
76916a2b364f37e315218ff2169ff0b4e0369b81

SHA256
9912733aeb4a90868ecaef3de9843ea9ee421eccede8b7c0fbe7ff2e5f0ead6b

SHA512
4b003c4b115dd8d4d5fc18c17760672ffc20561b9a6727c8ac6e5effcb7c29e5192c1be2ab72777ade79875831a8820bb16b3e8226b27a7de27eec2e1771cd65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1591f3d092874d25782864fd90443e

SHA1
41a2308420378ce57095708bee2502ab0fa6fd3a

SHA256
38db0ec707c481526b5493b61d7deb3f49450f3c0a8a2c82051e6076f844ddf1

SHA512
b83ade76edb03ad46eaa3757a1649a2d6de12980a863ada80d1cd031c659d3d8f28aec1ac66620565d655cac64e757582faf221f605a763b1970fc1a34b715d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f55ed14c7d721511c3d56f9a13de7eaf

SHA1
3bf83d6556fcd14b6b7354bc7d2c6d5b4c859eec

SHA256
52b1664dfe550b0c1b7c606778f89d5edb99601fd71574707a3e917322f06b24

SHA512
d553ce67f5d8031e057649be1923eaf5d842c8187dfaabd76ab2b349d959080b10923d9dd968204d5858c8658b1ac2c264fca9f49e371965917c7f30a3b29a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6722ac2c0f62dbe97a1bd9d79060cb4b

SHA1
a4ad6d6012b89339a7aa73155403d03b257e2594

SHA256
6aeb41c44eb791c51678eb5965b6d01e132828a551ce3a1d150c91b7264f95c6

SHA512
98020b225d5cf0b72adfead4450e20be1e96e56fdcc7064dae0568971a07bebbe6896b0b0661586b239185808142dd25c58bac515f7ce8060650f7574f704764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87a715260e4b494d78714dd0aaaf50d7

SHA1
98c8545ed61cbecda2fbc1948bcf226ba09e3766

SHA256
a7dfdc4ddbf44d2a497f71bef9f7a29e3cb6bf83a2189338a1871b14f3519b0b

SHA512
a974e5c0fe83ef9d62dcb934227cb75ad60bbfaf704c9a9b1ac268ab59a4f046bd9a4365ba6114ac4168f5cffbe4ea92d7d69aa01b8a56ee5291e251a01d3e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c970d9df932255e737bb07ca3ea8f9b

SHA1
f017d8a110cdebdd8d0242c9a5b0d9b6c0030e41

SHA256
3c82060cf6e782338f24f0d464768008982f9965844da85625c4f3b6ab46a65b

SHA512
a649ba54f56756584fb6838576959bef8ad4d97b37889faf30a09e4f31beab7468d7e497e2d059acb3ae2b8128b06753fc15d122ec5dba16780667f4f0e4f770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8495c9dad34d237dcdd6e89ee068b060

SHA1
44f0598dbc6e59a01922cd2a6ed7a64b5c63eb3a

SHA256
40e6469e964ea5e061e2e7b74308fcf6d5f1ee469fe8dd9e53748e01b96a1029

SHA512
c3d80eb544b2da3239864d699f1464147eb44b5db05a4c4e36ac0f329c392587f7c368f9223255248a3e46d654360cafa84c5a640ea16642e515669195c515eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23DC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit