ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tsk_zLppmfyq9aq93SLWd.gif
Size

42B
MD5

d89746888da2d9510b64a9f031eaecd5
SHA1

d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA256

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
SHA512

d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFC4E4B1-D4F7-11EE-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50314fa40469da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415149003"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000fca64ce700ca2b6ae0e1c2ff594440df42e6edf9f48534628c631b01f0dd8c00000000000e8000000002000020000000df458eb7f6d84042eca1a7bcb30ce2014b8f04d42812ea336fb85a9d2cfab4fa200000000e442e4a5a28d9c70baa4f71b91e58b990deb1e68bc5f177d7686f978fed37a940000000f2dd262ab9e8e566545230cdb50161a985613702a38ade356587603033bc7f4061af88923efbf09980fdf2438cd1daf3e817ac551c531a785b4c65df884e1835	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d47c94d5a1dffbd4e68b33a7f8ae4b1b958c51b1bb5e6c2ebb1f719fc0467f60000000000e80000000020000200000008697a29907acfa26670c3350c415d63126358629a94f2d8b54a2032ae2990481900000005beeb39e77a34f9817b9a01c82577adf6d5bf189eb8554beea7eca2fe916dc2a7f1942f3f7ffe39787f6c7bca5edf520e66aa118b2c79f99ad002ad2bcf449da0aaa9d7e4b6c75c1206a1ed8a5f4f95453a6a37355881014825a4147f0cc5fe592a0e5847a0fd3ea02c708f848f37b5017299ab67740f9816a8226af5906024dc57515000ce186ab075a709944ea5a184000000020c6e5ba76f409b9b2ac1ebd390e5e0a25145e2b89a1dcdc791d47c88835e9609b58d0bf15f562c388d750a30d60ed614a89f2ca21bc89ee5776d0989bb5efd8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2568	2924	iexplore.exe	28
PID 2924 wrote to memory of 2568	2924	iexplore.exe	28
PID 2924 wrote to memory of 2568	2924	iexplore.exe	28
PID 2924 wrote to memory of 2568	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tsk_zLppmfyq9aq93SLWd.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596ebb072d8b1a78044ec0f1955e1ac1

SHA1
7dc950904149024c19f9e2a318052b8fd7fb129c

SHA256
ce284531a933acee2f0bf92eb42c4aaf43cdd2b2119f7fdf49b8e345faccbd98

SHA512
c9a235a4b3e65d8e7c2482a83fd7e41e26d777b8985be89e8f894354a02023d035310eb29ba1d305032b612bb5864c4f48ddb71576964279e9b52b32fbc1442c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2e0469d4c98d55d575691480d9c309

SHA1
de5e34c1b599390ac0fdc502d951ee2cbbe30de2

SHA256
fcae0bedc864a11199323a7c8d79e5f698b9d172d33432bfc45883b202ab3803

SHA512
d27ef2aeb78d6b393a227860a7332b89898d1886f71a32b805bb271b48de80b66be796b9dd870e2214ea4da1cbe254b591107c6eeca5c2bd0924b77574df5e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e5f5f446fe01014895be0b63af84682

SHA1
6ead1783143b25253a8b21c202179bbf34807ce6

SHA256
801903f44b8647f3ba51242b238ba5b79d972b617f2db4a4ccf43c2f47ecd02e

SHA512
9e7c958a401b0d100d391ab260c79bd87f21a5d8df427489cd97c3ee51b2f7837161b6d6aa9b9c086dfe0f847300c37ef39c2d7dcf675093724d4eef5fc779ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b42d7cdf9f343d18398848e77af77e79

SHA1
2f96923ea2a5513edad285a4962fc98343008425

SHA256
94ba889b368c83d223921324c998a8a13cd45a8bb1001b356f1cf54d596be627

SHA512
1b8242dae850c0245842fb40dddb10ff516481fc885fd4ca3631de8f234499ded39088cc6af07025f959a3d76edf7c66408d8da64354d7853efa4e74c0d8c1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7205f59208abdeee4022c91505a39f

SHA1
ed06fbf22b188d2096cbe71fbdd1aef2fd5f94b6

SHA256
88e582509698092870c3e8b80354863c268aa8643412cc48069da0dbeadb053c

SHA512
e54f616a8b223a5ef4af711d714e2ba11d1a26db2ebcff6c69e9866e583df296c489de5f212bf21937202a9aa1c41c5a7b7b546c4827666a6785246137598805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5caf2843a1f486e32d2919874f6e7fb6

SHA1
4f3a06ad1428b06996299fc895a00823fdf254ad

SHA256
c90e0bda3c4d74ff839a77115a5d97c19d9cd9f325f37681dca2c6ab91824548

SHA512
ea184f51e07e4340ba7d45831839246199f856fd90c340b7d0e32a7070e658825a0c9b6112aedd140fa88b3dab6dbda8078e9114783a90de2b416051bee558b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48a76c474f7d9daaf1c1ab1d1564605

SHA1
33707a728930712e4297fe646042796f418d9a7c

SHA256
cfa6e131a52112d803ee78fc520af4d6e553936e4cdf6ae0d22dfc53fd16c30a

SHA512
277cfe6f93e53ae3199a47c05ad4152af624a46545c906f93560fc3cee4930b541fd2d0e0ef4f0ad24c8afceacfe2cea29c9f6a73e6cf0148fc9390589504d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f32b927e1e82d149823883f23e1081d2

SHA1
1c289d6530e0ca0e30cb7cb2c4f4ecc21b86a257

SHA256
41a4d047d1027df1b58885d086e67dc2f31ff64f05040cf6cb928bee036a97a5

SHA512
b364f3fc032da3a93d1165eb016ec861ac0f4c133b2583a0f049b9f7a702609839d38866e30730a7734fe14ccd4b33f22d5077d242956e3cdfba51b4b85fab29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93ea274416d9a72a25f5be1b5ba994c8

SHA1
fecd461598a6b9ae4ad2a2d4c95b5aa536c35204

SHA256
66da54cddb4375a8d9c078969b73d7e42e07496bca61b9345bad2521b034a1bf

SHA512
5726102f03ac90e4eff85350446f9abd36dce3712f8424ff57dd50534d7dba9c96c09af88707dd111941f1155e9ebcf0e67aa538fb8838a61ed0b77591b00572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece834e51deea224431570eedb5df5e3

SHA1
645c9ac0e24feebf31e51707622d259b88c7d1cb

SHA256
bb4043bd346593f638526aa99b08462982306d42c623ce5043396c94837ba069

SHA512
7d8f76caf1c57874e6b8f9b48eb1045c36bd149a1bcf1d8acf4a02a0dd013b55ac33439f1e5a7cd657a5304b1b3d3422df9aa9715bbcc04565ee7be346c46a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34adabaac3d2c08c38fe9453517e30ce

SHA1
5daae246594b8d36f36c9d7a0fdb4829698b4e88

SHA256
199736acb920fdc31ca8bfb104863c2c153c35cbf6941c889f1fc3f98067f5bf

SHA512
549c677d0c325f6ec2ecb7b3f49fa8a296cc01cdb5afff7bc1ccc025861056ded47168d9c0978cad1b5e66c48a1d8efe8582866cb16244e64b44688be6080ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a123d2db459331799ba219351871b2c7

SHA1
97cde036cd3fc7801e49723be10f5cdc86de466e

SHA256
f6af8296734030aad0886e76b9d48505dd897bb9f657a3a633f05886991049a7

SHA512
a6b808e9394f0e05ece85af13de9466124c414b862af996777931d1e4833606e623c9b0720f1aacd0e04e415b8ad73ca40d493fd5ad6960e38fd6c7fa23327dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701f6b35ac2e9ed32662e7d98573cbac

SHA1
1b6262b6dd806d0a3d8e3bf021cb98b183876cd7

SHA256
3940cc649aa0ca27adef63fd230174bdad7fd06406742455e5cf8606ccf9656a

SHA512
1937fb83d11fa601e0c40db69debbc5cdd6e673092ecb6c76fb7d99c6ff31a466a143c358b6fe42ffe06176f661c2fdab475ad591abada3aa3231300cfadd77f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d4df00180c54fbc347083655a02685e

SHA1
2f449421dd719f3c1ec64e5d7e73889690a9fcf3

SHA256
7cbacc8d81378e17ac060ede7723eb89e1d4c02b421aaf72c96a16e8aaf85c2e

SHA512
bc0e77809010ef458d36594900b594d39ef11df145baa2561773934deef1bbc16fbaf0778c99323cdeaa8698855d496384c4820cde02e9569082f8dfefcd02d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D13.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D26.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit