461a433676e1cf327192d9f3b69c7d0a5f688b42359f81339f5a61bed9e5fbcf

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Global Protect Desktop/jre/Welcome.html
Size

1KB
MD5

a0154e8b351df4372081d55752da1c61
SHA1

1c3dc9c2e45a2ff9c0c66db0f0212fae0cd8b0ab
SHA256

285517a831a095139ab3bb5b323c9f7cd989d7edb71e73c2b359fd01fee7f077
SHA512

f1608cd05039ba8264da965eff1ccfd77523f253acb25a529f110ba4d788bc64793f75a672cf11c5eb2e0ab23d95a7f91abcdeb1f5b5f709142b4e9d13b84178

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414664832"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000c875383501d9db6a055f03b71661d176ebe3f1d402ae7ac77bb9005020a6d54b000000000e80000000020000200000003312dd39e36911bb9fe1239f3bb6fe4a942b769b191fe484bb5495a478d3a9119000000055257fee58475a7c20e5617e54b56a7b17cc769816a450329358118773aaa665b143c9e262459e430ab38bab217902a14bab5e05cc3630c6805f6326dcae826fcf87abf81997bc2c97ff9c1d304df2f3bd3ebbdf031be9a05e12a1f51f24906319ddbc83c299776819d4219f0ec86886812e81ad66e9188c47f4102ecf89910cdd7a1c0bea9e7dac1eeefa08f6e9a65f40000000985dc60e8c40ac3f1306f63812805ecb49b66bfbad840aad74af8a419ca29223ea1e9b596d5641399272902c3ced13ba439ff94c100e7aa7b65e8bef4cd796ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000c70d114ae05e28d68d3d7ab6c86adac1d67fee9fbbbc3d0311929d1e56cdba77000000000e8000000002000020000000308275f34995e5f90e38a9bbf4f81b0d1dc0482996aec8dd062afb3f4b871bd7200000001893e10bd8c658fd3a5945094aa9753a5b7228bbd05a5cd18a9eca9b14047a1a40000000fcdf403ffbf3ba7f27c98f1e1c95e3f2eff2f8d58741d3a7684c75dcbe882dc61b628fe049199318f8db6253afd995e4eb3c27e229ea480b37726dd16fb5fdb3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{855C8061-D090-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c092a65a9d64da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28
PID 1796 wrote to memory of 2216	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Global Protect Desktop\jre\Welcome.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7777cb4ea01e65186f6b76182142de1

SHA1
9c5fb9e09b589b5b7cbc8125c77bf8c9e0c792cb

SHA256
e00afd9f6e07a2f1ec292e89c168265fce1710261f191c08843a52341d84489a

SHA512
9523ee0217b515b6bf16d6c189be4f478a179fcc93db6c9946a02889c9edb35b804397fa6fc9220415f71ff35d79f9f4cb8374d1570790563275d4775a62170b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437318f48d0c7baa21aea4eaf06efd23

SHA1
0013cc0448fe17f3bc736f31e5ee5f5fbe953dbf

SHA256
7e8f596080c4661316280c5de43ded40eec147182297ab9c3ad1068bc0b135c6

SHA512
eca27b0c40a3d942194c69b8419bd29ef04716e5b8fc0e294fff1b09a2edf849b942d87772825f287ace3ae9f043d664c8c2abe88fe45281b69f482d92d20639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f673ceb225b1f5dbc6018c3d4f427f6f

SHA1
4a323d9638892102db864a0539c586d306e03359

SHA256
017927ab11a1b670e7d60120ebe1f562576b4f32737d345b431b786ebd4c3dc9

SHA512
0b5f448ee8efcf929addb4b4279a95c7d2b15aa5a3c869f5a0d0fb6941644dd30e6ff826aeb9461003796c9bf1f38d18f2341b89b71d5e82e12a440c83dff355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7c644028b3f4811c46243bdd4c6a851

SHA1
256670f5c4d2356b756a26001018a0d71f214534

SHA256
62a5e279423f7d794cbb30580444aae5983e05ca9584c8a8a98867ccb54007fe

SHA512
2d998f8d7ce631a6801983002f428c86314c80a263faf32323485034d57c86907c939172e15ed073c726f7078de12a84a56c08dc9bf5414ee89f0a26ad764188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b3d407be386192024eb4f307822521

SHA1
e47412881685db627a1bda466f0d865c8a814c6d

SHA256
4a31c21a61049bfa155e070067d221501e2e6e650f016ca6048082ed1bf2fa8f

SHA512
58c5bcdedd8d795580ca2855c25eeae77d110252c62c6d762dcf0237b8bbe954c7540c7a02df21a9f37a3d00c46c5ba54155b12e6d64094aefdfc6ca49c340ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56cc90d1335cfd5089dfebe4946dceac

SHA1
9345fb50c818030cc47e7933bc4668e48c8ac2ce

SHA256
6eee6d6ab85e2d8ce3f4c54670bcf50d5a9f93ad9fd4b11f21200d47ce121100

SHA512
7007e82f555e63ff2f1ecc458437b39f7fa6d81b1c4af4dc8b4ab7c846b22639ebf154800a69bd30990e5416eceb66c3e93fa99d0c0216a1760a94df240b62e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c44d07d1eaa993e6742ed3b239f25e

SHA1
b2bd0411b1d721cedf909ede8b4043e8a9a19323

SHA256
24deaee8126116cb563aafe4f74181b49c27cb4cf79ebce73af6f1697b4f4427

SHA512
81e2bc71c977b7043426466e4720dbee830380e7b02a25fc4442102eb43b8849813fcce037fcf0283843638a44f6da2b7bb643434c31ceb3a7fa78dc95944bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24bdc48151ec7dfdfc99f472cbb47923

SHA1
5c2ec2e09a8d17ace277ce8bf113af15c41f3c04

SHA256
dd51de14eb7fd2e21ded949937a68df8d805db517bafa68a4e7aff05cab0080f

SHA512
2285f4b2f442acd80ebd8d54a73f6b0eed08f88449bb4c0f46a16105245e9cb57e7ebf33a48b8de6bb77efb3f00492547e0a33cc2764beb5bbb4a06573ebbf40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cae635c2a311382aebe9305e6a13287d

SHA1
c1faa12451be88b3e4afa6f0cceeeae970fa21c2

SHA256
de21eb08e7df940d948c3d17ba011a320902dc0b39883b23dd75b6f85e54313a

SHA512
a8bc1081a0ab70a9b66f5248a7b9e6afbdcd89fefd3c12dc6412d18b7caa7c66e8bbfd8238fabf7807b178eff4197bf108d9b49a8b8156bfc81f1883e06f9f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04a43bb450f7d0b7994d0a19eb42f9ae

SHA1
2ff22a40f3df26303bcde0493e67639cce9d6e5a

SHA256
5e69a500169106ac8ca79c0166da8ff62a89008e976f9ec1aef771620af38a5c

SHA512
61fc58e0d3e41af438e12f9a6ca77c2e2868220b933a78946e6fcd68bba0a95fef0e397206031faf37e097706e12e244c63eb11881871ce8dd4cb4ea78c564e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f178acfea95eea69e72f9ba44d7d06b

SHA1
b945f1a80d9147ce9baa95c60ce2746738ca4651

SHA256
27c5d4c25c838397cc82bc6890f46d10ec037f82b7dc0a7105b7a8910eb3cebc

SHA512
fdad66dae4c2961e73c256ea347d61b84e4f0a77f94c380400836cb9450e5abdb46dcdbf1488861e227feb969ed2dc96185ab1496610860300d91d1ffb35acfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a908fb0c333c200a4a78a94624eda8e

SHA1
6dce3331e7b900ae04514ee414bd8290a7d2968f

SHA256
96807f025156d28065fe21baf4170ac12556929f063c9bd7bc4c167ea7ff7d63

SHA512
942ad7ce301fb51edf2eed2d901b3c5aee7bda9fa9f7a15439a2b4c2d0bb66fd23bef916dc7f19254b21e5ad9fc05b40567e98d12f0ad81ef3c2346dcbe1daab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6622ebe4e71e9fc40725c1cd4e69e5cb

SHA1
72de57a951cc2ceafd7153557f3bc8ef12d1b9a5

SHA256
501627f236df82d3f2b7a02f10dac170120bef2fa8a37dfb7d91dda6d221d30b

SHA512
8e3e84f134875d69f942300fd432af8880f4335d11c10d5fc926d55ab5a15aae4ec254bebf4a850a66efe4b49fc7dd09765e449bb9f899afe3afa500ec428341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab625C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar631C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit