6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_32_/ui/html/FinishWithTasks_deu.html
Size

15KB
MD5

0d78b34a4463915850e7b3c1b03bb5d3
SHA1

a4b863df1f4e5d29071505c9192691ae1d6fe453
SHA256

2817278f716126ef3415fe1701871dba2fd6318f5deb99785d8fa72e137ac168
SHA512

f6b507caaaa22b637c66a033383039912aaeb47e00ed57cd2480927573670aff27c377e1784d76f619662b35d3f93d966902771423faddbd16d12c8adb4e4d03
SSDEEP

384:S6XkJ0In3ipi2YeXHbiDhHmg0bug3HsqvkqI7bOqOUOXsXWXQXGiF:AJ0IywkuRmgcb3sR5HOq7J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6040990e4064da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A100531-D033-11EE-AD30-660F20EB2E2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009ac665027d9067f402e6174bd99c20a162474f0a93c0f3a8ad15adc0affd3f0b000000000e8000000002000020000000846d9b56921a281e0cd03c172c173e981338b359e660f57c42fc727a5a697f9720000000961f8942234ee1b3e57958c14d7a83443946929f2c083be68554bf67b3db619e40000000fa5d73e61e75d73df388dd11802bbfbc1074d2f6c15fe22a6e837197372e2f1d0115878522876e451ffa052904ed6e8f9eec5169bffcf78693c0dbb7ba89e5ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000010cae4da26425471e2393f34ec40243832d4d6a95d912da4565efbb9404e2615000000000e8000000002000020000000ed2c5c3a16c215b2fdcca19ccca9e1bcc71f4a2cfeb0cf515a90cd8740084c7e900000005a42c78e695925a15514d008ecad3236e4a3001580397fb15b9ef3555ab90a1efb53b3388aba17cc50d5b0c6711529a9909543bed48277b326ddd592c4651617af047064e798c397ccae1ae07dec8e05370575f425e3e243db7c642d9f1cf71385bb843be824647fafb1ccfa7e1b1c3e6b3e619a2f067a3ce70f14a480707eb66a4fae6981bf2dc71d77112ca5b0db7e40000000686716baece915fcf5f78dc348a821a82b03d676ffe0831c799a6a867313a9de57a92b099023a0abcfcd6c47d0ca11b144d0ed9b4289fe38ab523f9a23cef009	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414624761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2080	1992	iexplore.exe	28
PID 1992 wrote to memory of 2080	1992	iexplore.exe	28
PID 1992 wrote to memory of 2080	1992	iexplore.exe	28
PID 1992 wrote to memory of 2080	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$_32_\ui\html\FinishWithTasks_deu.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
270fb745fb79e7ce1abb8056eb3c186d

SHA1
f0d33f0a7272e151184f29c396765851ac6f32af

SHA256
f1a6c7f3aa3da76038262b850059aa9999af44c76bb56a77a4e9c408fc7c16ce

SHA512
5f8ed423f7ac04df4bbf567316bcd5322fa11c128ab6368d78e8735a2eab1dcbbcfcbbff5a39e164a75a50eb018ae8eb95529467adf315022646ca455d8ec504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79773bd4f2a791fd12bb4a701142d228

SHA1
3aa866683b92df5ba4cf9faf621cdf37ce5fee20

SHA256
8eebe756af97b15c6f6beb6730039ce2b20f5ae7c48edefa4eecc56a38340279

SHA512
9b4a54abfdbc1c4d52a4dafb19f6360b20940d9a9f4f7088deb5085d935f116d9e7904a200e58dc4463e805fa02749977214fa57d8e0c0f20bd2471a2c2c1d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ed6755848bff496968b5cd56055595b

SHA1
2d912341966867568cfad5fad103391aa82d1d5a

SHA256
d365c872ac509b8f8c0764e1cd97f2499d292e5d28f2e7db057a09c27ed2b525

SHA512
9aec7dbe44d13a72f68b59c90ac3f3a9e76ab59c098e149cfb708b0666d9eaa41112409721979c7743d6e64c29b3e26a6c5e092896022e29cbad4690c5036ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ae392a0b1f1a3806adcf8e58cd0a06

SHA1
22983ce5e30be23fb0be5dec6c9660d050e10ace

SHA256
94fdc80365f2516609f1fd5a196597c26b0be195085097a8da72607a23dd7a59

SHA512
780d55282129f577ee9b75217c7ad9f410ac7ddce2f86a4a7ebf08dc5d60fa5ea32a352274dfb930b18eadede39485ca9979bdc796a71a4bdc23960a5393c216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdcfd94722786d2b99fff662d7dfc25d

SHA1
8b7a2b3f5fe48730817f0cf9b4bda25669567d69

SHA256
06c38ec288c48d6d18c2b7060a08ea43e1c3155f18a43cfa8fb12be4f52b1a28

SHA512
fd506e4584cce1aac8967c7e46a1a5d0772cb14c7b1848be96cf828c3376cb8a35e072f2a8d53fe534a07d35cf56e3ab22990e656eb37df740f3a4723ece3a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52ce482b0626640deb512e2e771c7c6

SHA1
448917601e5e09417de7bdea9af9a7a43921e681

SHA256
7f97d6e7f01034d20fe2340d7fcd9fab911d0e58a14cf55b4fc226678ee3a81b

SHA512
91ae0ad671deb52258a6558281ae21b0a91fa2e1c2e4f606964d52b83809263580f0309a42bd2c12454c29f3b097142161b7c8068a67139bfd1f7e4027d9aab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c995c0fdd4ca5f4bca6880889a50fb33

SHA1
0692c91d58adcea14497fa915edc5c0c7327f9d7

SHA256
e32301cc4157e1e0661e64e1c7c6a0ba08bcfe7ddae54edf82749f9c156d7fb3

SHA512
2e047135af69ba3b94ac5ac2b720be3dd1ca8f8ebb921e90a6e1e70ce5a25e780156456b8ce961a776d91f480b07fdfbb98d92d3556df15edbc307940ade82c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75503035d1247d4356053f81ee24996

SHA1
8fa6cedd1536b18cf2d97dc37d50513eee2ea242

SHA256
467b7e31da0525a69ba884030541cfa3d8855bbe9d8a3fd4da67873ca82557c0

SHA512
8465782005ea77449084346afa0772cb9fcd82da117fbbb25f0ab7a29144a72a81d806e8153d5adb5385e79b88e52a4573540ca5ce0532189d62a8293b33ed9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2bc0104466dbcd9bc907a2e7929643

SHA1
b73889c70502f154d4bef7d5e3482edba35b1750

SHA256
ea7c9e480ab381d828a481614b91050906c93e2ca5a0bc7dfd48ed8cb4f2b892

SHA512
b579a05d2df7c92d30aaab4826d788da4001cd3315a9194f95cda5653cfeacb588bda7b82a3431d4d33b49eae619b055bdfdc903353339320c748eb98919bd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9a2771212f2b8177bc97e9ed3dd8d46

SHA1
1fafaf4a383b465853604e399da161a2e66989ea

SHA256
14fe1bcf4adfe5fef94c732fde3e3aaba98252170a86056efb2662b5ffe3b7db

SHA512
f7d66f4349abd83849acc493530794124fe667d6cc5dfa188ab0d16064814e8222fc5c3a1aaf7696f2b9b8c498f3a38a75582a417437003391b7d3315287ede8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7487b08e7ee35d80e9e866bf384c902

SHA1
785248488f33147d46f3448b2679b5809a4f1cff

SHA256
344e2b4614f3088b5f0a967e0e1889277497e1e23c179ec209bac063120ef83b

SHA512
534f3f228b380f0f5583af083c24a987350947285575b4dbf1ecc6993966666062e8f399eac49510b2de752efd716ccb4bc2db6dc0378f747a7ceeafafab3a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0546e29dae20cfb2bf013508033b637

SHA1
960bcda82dd905ced9453c80c98df9386e3350ab

SHA256
30da499fb20ec7c25c581f7d77f541a324c84724357bc6c43009edd6dd328595

SHA512
97fac45c007432d5bcc431f3590153bcb522201e772000815480b6f3ab6af730bf37d8ee379c5b9cc33354f39c490fe7ee8f8c0bc73b13d945593951ffbc929b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea84f9529904050d4caabed3255cf316

SHA1
672a310d9a07f96ca28a9a4db3667ed8d1786afd

SHA256
6769c4c062642e3d0509748258496141516a5f26afce9ef5e52a6c18009fc785

SHA512
d9a8f8f0cc70a3337127de9878a52a6cfef491da01f07b170ad1066afe65e199cb65e2a69d9d6a0e41630fc808867dac656a37c5828188f806513727933036e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4facc703140707a626129c827685d010

SHA1
12bfabfa95e10feffbf9a45241c2960e032e718a

SHA256
b83def0932ef42822d30bff8c2dea0d26862bab5b3f48e28574519c9ef25397a

SHA512
0f11f8cf2f92bef784945ec4b236632fdb516a33f1af7a33c2998223998be564186b74658be63cfb79e65a6ff102e1ab6257d7b53ba0db87947576d7499575c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ff502f13ffd3a5b237527140033f0e

SHA1
924383f56e01bf1be489d4dab829b91a31b418aa

SHA256
be4bc9ec8e0c75aa9d0a4f710c57beed5918973f926cc2debf2fe4630af1e6e7

SHA512
5410fbf6f3e2f7db9d1c3d57747486ce5dcc9327b8c43096c96124faff9f21f574cce2458fc41a1277c3c4b6c1d0ee5512ab80ea8e23c9c1b946c955923b7966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AD5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit