79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
177s
max time network
134s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

classifier_tester.1.html
Size

19KB
MD5

bf12d2f367fc87fcfe6f3606abf34d4f
SHA1

c688db55cd8b25ca3898686f1c115df0a97fbb4e
SHA256

14e809e7542db00e200f847ad4987671849a5cb25296dd768ddb549b622dee67
SHA512

9a1a61a4af144ee94347596a1243ea6a6c480265cd2045589939d6e96a88c9597614b42eed30f9aaa807ce6f93f99a95258caef0cae7193c1bda93febf1bbd7a
SSDEEP

384:Jic/7NlHRV3nP73SXoFn1EppMkm9HOKTUn2Qg:Qc/7/HRRD3nippMH+n2Qg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a523c2cb74da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000096e481668d01dea548222b40b896886eb8c3680602d343b735e9ccf5749d9a5b000000000e8000000002000020000000d465b4388635f6e72058a94f597cb1f453f3cf076131d985675ebecf8ebda3a79000000018c064a6a111a39bc6a325689c7ba53dae2e6e1a16f88a302ad62f53ab9932fc79748d8d96a6ae17977369389771677461b58ee6fc56ace208e505c1002e8761e5ce673c9ed21014bd190853b95b6f6249208c4d253dd32414cdd3d987aad6c7ba6afc9fcbc1dc657396a2edab26f4b3360ca670cec764efe83c5bc99b8a62b54bb2402c209985afc06baefc0601db64400000007930b7b3adef692e875bea926063e5580cc401223e7776c0b93fde99510e8888a86e2c5cb942645a912ace1656b8070507dc285149f8f5ea3962ad9ae070196d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416443982"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000211f44d3d4ef6ccbf956c592e32a3084977e325cd6e752f9236ce1c01b0ec2e9000000000e8000000002000020000000c81bb1a28b7e9cde164b3e550bf39a91efb757af0efbf05aa86f2d4f28d397bc2000000010a83024959b6f4f0c3572348f3a192fa624dd6ebcb5b60425401c0cbfacfa62400000009204c14f8ed0ff81bea729bc397efee36fbece511788de498af025c62ce3b294aa58d22e3046466576ec3aab242b549a6f9103ce732aa893b5b24f68e421600c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED7DD1B1-E0BE-11EE-9DE9-520ACD40185F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2616	2956	iexplore.exe	28
PID 2956 wrote to memory of 2616	2956	iexplore.exe	28
PID 2956 wrote to memory of 2616	2956	iexplore.exe	28
PID 2956 wrote to memory of 2616	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\classifier_tester.1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af85e9e067ed662aac34b2b55b1e756

SHA1
5a64cb1058844a24940ec3835821c3c5de71f1ac

SHA256
37f70fd30b7e4b2144707f7250c916ae0e81d4e896308d0bc4d03a8d7de9d252

SHA512
7a32353588df56941289d445fb962a9f6ff518583298c66f6f2934c7281578e33928f9acb04ba65a7cb4632228ae769871653cb862bb6022313315a52edf6fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224caf6f5d4fd660c6a66c9c93f44e21

SHA1
0927780a237d301a76021b009c641e87823421cb

SHA256
71cfa06d465058b326b3f511f19ac43b84ade0e5ebe1f6b7a21015fd870a6b05

SHA512
112d85abea454495247a32fdea0f4eb840490332a38dcf80513487925454ddc0e96c3bfbd4f9767b10abb34dbbcdc9a7c8e2124e7e69b7a86ebf9847a2088fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4af8514026a0e0f3852fa4469fab0e2

SHA1
db5628344e3a56c2349857e6a4067e0709316e89

SHA256
74c27c9a8aa42caf0e4b82c4a0536187b54fe91e11e71d8c4c10ff02ad9b338c

SHA512
311994ad93f3edf41554aebe753ca3ce8d102beb5ff0be4fdd4cd84e4109f443d28e41b2f1a68662d0918b71e775ac7f116d8876ab6776126b57aa63c1b502f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b80daae1a4995199bd317b26907e4b5

SHA1
8029f315a38927d5947f070f237783f81bc19e8a

SHA256
2e05de7510baa729bbe97d6021ba88e82fbd47a2852a16961e4ea6af18e37403

SHA512
ea6b4b5909d8b1e9056b56d3cd8e9527e9a2e775317aae11e75370552747fb5597a557bf45771570473f3eecacfdcfb6d579ce8f890303ca70404456d0118e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a21df7d244921eddba9f8130591a8965

SHA1
8d0d17a24777cbccb45cbc73efde905629534f1e

SHA256
fb818bc0e53647290c18b81da2593f94c0a03909f89661d0b34edacf04616953

SHA512
3315333cad9ed5f84dd2acd8c788b96798a1b584d2c873b1f346b7d91240e635dfae6207b3442c57410511989f8780863b6fa3f9d8b0b428cec11169e1689d5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c18e24bc75810e398922130e80c965a0

SHA1
af0440c3e8d1389439e81518fe445e78b67ffc08

SHA256
87b12f9b04111baaec1dcf2a4f187faab32bd06ea34619c3406fc4a43adc0b7f

SHA512
0546904872fec6c2a025c9d2f8ffaec3eb4e2df13c7138b5075f4c6336ce2bddbb009a66dc2998b8682e6d0af8ee81e3c34b3276c0b79fef95e7c82fdbf93f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edb5ee888b404cb3faba78f134138628

SHA1
e47b63cd09fe05645057c5e26f17cd66b2bba457

SHA256
0e874cf0fde05161206ad8f4b4a81f3223d36106a61a987c1ef51c15299f7b15

SHA512
b8df76dc66c9373e5a863cdc7a9d65d8944c47917a615061574acd6b21ccbbe4c62a382e6649bd4e9f47236ccd8010a22123763dcf4ddac214be408d89c4e72b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064df88899d06e1e1acd44065bd68707

SHA1
c5045f698abe54a8f8266ce7eae0e917acc68495

SHA256
ea9a0fb3258fad6a738c0995a49fce42a74eba9ac974507dc6884dc9551e433c

SHA512
97c8763ad46a38751ecb94d4c5628343a541766708290e4d2107b0e3ca48841ae22ae0e2744ae4f9d1eb241b0e137072cad752bbf93821413a3344205034acb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3efe5023628fe35e084defe183741426

SHA1
a3e98b2976cb45ee50cc46d5ac27d23e70f2bc98

SHA256
43390ff1d7cd1e493585ebc4bcf597bf557c48fce8b9196e7cdda1732c9804e5

SHA512
e02f72dc532b2600dc29d7a0fbc7a60e54ae378dd692ab8d3b804c15dffbe4773afc40d1f96ec4599d0dc33ccd2814943e033ab307279e87723c37193b7da756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9097e89ff11e0845a113f34febd6ba3b

SHA1
ae881cc4c80b02fc4389c2e6fbcbe12e16e4c67b

SHA256
e63798c80e7785753f50681c12e5360026780ce0477e665ea47169afd7608516

SHA512
6f77a286663066b4eebb41e0f0090826b2ca8299484181b30f32c0dd7438e2e4a9f156f7719bf83ab90bfc0c7c8d91e4712dec633837e4cedbe164516bab6207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c718dc551bcf206ddc1fe0c5bac91227

SHA1
4be7aa05df0229fb4d964c01451e81ee7817bcc9

SHA256
dcb95d147cb15de6123f9a6dde0292142807c35624260dedffb301c8c516a97b

SHA512
af3ca2f6db017f5c907b1309b04e6c6c2106bfe77004d8a93ae9b6e73d7a6801483c2642198c0eca86af4877d1c3775985721200f55726acd3551a3aa150ecd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ec3f12ab01d46fe9e77f91ae509c09

SHA1
51101994f79b6af9320d1b6e963167274658fb4a

SHA256
2bd73cfef748c43df90a4df49622c7b791b1bfb7aac22aaf4d04908a1636cd29

SHA512
15d8123e8302ead174abd3a719043284784e0e82e47fc5dec8bc55ed5d4badaa6a7e45eea798b583eccfe0edd9000dcfcdbd05754cd0f8b34398b393479df5b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c55d78cd0bff860be9da3c31eb9f4dd

SHA1
a25ff45141d40d5141fb759cfeea667098e7dc97

SHA256
43352758c5eeec09773f8a1cfd521d95dc978776d68250b089762a50628efdae

SHA512
aa4a5e1b189522eb6acce4e5464ee9cc541cb001972d9692b328d542468986bcec768dbbc9baf0e1d5b0f049ad526e9e8bf2a446c238bfbacc549663cb1a8910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e5f90641165fb59e64d3e0dd07e109a

SHA1
54c275c17da67fe6f651d08135a23ec322153c47

SHA256
17c390c2e18fdb00ac63c622af4b1e93ebc566535e18756a3394c5ada22d483c

SHA512
0101439cb35bdd542ae5bac2be506b8e4cbc12a088c927b004c9da41ac0b40bf6f328c567f6cbe0f658b19aa3aa4ea94b10dba5ce50337e025986e2b1eb1d058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62895cf0b4bb33e11b0535d5f7b09ed

SHA1
e2dfe9aea4aa5b68bfe5c77eafc9b0abf6d856b4

SHA256
24b2d8014edf36eaf557a3c81a013053683adbcf4c2a2a10d5ffa81ec693ce08

SHA512
f7aeea2bb2982cef8860d76fb25aa759e41cb8aa9f1e88128dd5870fc8ded87612c47b675c3827e5b8b0109099c26ba55e48e85202675b412d49e0396a33490e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f78a548197c58f5c471f84c48bcd58e

SHA1
f9595ab6e72b512447662b237d3c00a07248ab1d

SHA256
c66944aa0bd8b19ffb252216d25571621040833d674b12cafa3ba1218c7bb5ca

SHA512
364907dc4845859c4d3a845ef32dd224282287c068a251b7715686c0be0445652e9e84200e051e248563544652cc23244cbae4a6c01ade3925bfb8faeacf0de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CE9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit