9faa1ef55daa8fa1f2fc6e25590530255111fe2fc72830ca2a243606b12b3fc0

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2c0447e1585bddd829dfbeb8475a93c.exe
Size

13KB
MD5

c2c0447e1585bddd829dfbeb8475a93c
SHA1

22947e4f6a2e8c1a8c77431a26e02a9825a338b1
SHA256

9faa1ef55daa8fa1f2fc6e25590530255111fe2fc72830ca2a243606b12b3fc0
SHA512

2092770c987c9d89156362874299e938acc08addefd93320eb657e483652762cd8ee663f511c927915a8983332819f60e086226e0fe4bf935940e21e9af0cc1e
SSDEEP

192:E4gbgkAN4SfIKEuHGLUwv7E6IBnozu4Lr9ZCspE+TMwrRmK+vhOrk/5:E4uI4TvumX7NIBnveM4mZ5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2196-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006fa3f36a7dddc7d392241ef849ded01da2ff100de16539f6202d9aaeaecd88e8000000000e800000000200002000000042bb9c028353eb190d48e928d319ca219d842c5398a92a4b918acc7730f02ea520000000a5ae57daa9cb6a03744be0661f3b827dcb4b1b148dab0bb2a0d8dcb22fe3015a40000000222f991f4a8ae1a47525ee728c94ebf7cc0dd2c4e6daa540938eaccc837ebc8b0af29267c93e00de48f59289df27e8f003b0446bd407fd43b75b87f907889cba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFB62EB1-E03E-11EE-805C-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f242964b74da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d160d9800c888450df72d3d46a0593da1a7e5bfccc82b79c69d718219f2f3d09000000000e8000000002000020000000853b80f88017c781af2563fa80a3f9b9c663448409c0ed5e89cee9b94477fd77900000006471fc4973d4b48f310acac3b72c490d6d951bcd3d4e05f08e17b0aee023d2015b2936752e1b1a043d0c5d9fbb43bf0a2a80eaf9e96b8919c88421335906404cf41a1d359433b7b46c0a62a4354f380f7347fa305268f13881ba1f5b4d6ee1e7c3b53c897f30b54e3c085c9678e60247699d4d75d7ca12126ac704c2919a68ada8a48dbbb9628b229bd5d9bbcf10b75d4000000068ad9b37705d140bd4d6dfab6d12b50f20dbd0e733a131deead3c0e374cdaaa7f7c6a300ed16db0defcacedd3ac9ab52726b3e4e3aca26c85e1d4ff655094a8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416388929"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2196	c2c0447e1585bddd829dfbeb8475a93c.exe
2992	iexplore.exe
2992	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2992	2196	c2c0447e1585bddd829dfbeb8475a93c.exe	28
PID 2196 wrote to memory of 2992	2196	c2c0447e1585bddd829dfbeb8475a93c.exe	28
PID 2196 wrote to memory of 2992	2196	c2c0447e1585bddd829dfbeb8475a93c.exe	28
PID 2196 wrote to memory of 2992	2196	c2c0447e1585bddd829dfbeb8475a93c.exe	28
PID 2992 wrote to memory of 2996	2992	iexplore.exe	29
PID 2992 wrote to memory of 2996	2992	iexplore.exe	29
PID 2992 wrote to memory of 2996	2992	iexplore.exe	29
PID 2992 wrote to memory of 2996	2992	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\c2c0447e1585bddd829dfbeb8475a93c.exe
"C:\Users\Admin\AppData\Local\Temp\c2c0447e1585bddd829dfbeb8475a93c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://ads.eorezo.com/cgi-bin/advert/getads?did=433
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055c638d673f0885f5e55022ada827ba

SHA1
7aec692269e8f51770c285ca994f54e2c7021734

SHA256
450a1198f2cf3e80f47fbe4ef360ba4f607252a8b7176fd8743534fc4b305e13

SHA512
f67777584775ba4d885efc1433005bda98e4031ec3bfe0f6be2ed93bc378bcba8395a8ae0e5ece39832fd59169e7716108830f3bf9805533f414a0b6c829295b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f886380af9eebb5f07e7376f2cbe8faa

SHA1
deb8a5c030bd55031d0b76bd1a406df888ce621b

SHA256
da2b7a3cea7a2818d6ebc85eceaea98085d87a25ebebf70fc8fb1c9f49373b37

SHA512
ee6e66e6039b85614782b7255a532b60f2cb7692bba85f4a172cad0c1eee643c779d2d7791a1fc2cad08dce0a678ad2957e639db03996233b3e0e7e834c65bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99a9ae85a0d949bd322adc9d9d8b37b

SHA1
0a186ded2851083db4690d366b524a63f85db82a

SHA256
e017beebd648dc525928cd7ab33bad442324ba311ca71db456984043af01ed03

SHA512
45ae8d6f7936f4f18481829075665ad8396b583b758a51edeb68ab3d2a3177f56c9e856f2917577a90f93028533c5d25e6512e7af6789d42123404946d7cf835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb266928cc1744c60fc1f0b86e3007c3

SHA1
ac4e34a76803a4f3b8b99760e4e0cd05d8574d57

SHA256
7a3e65a8bed4d6eee8417cd68121b25c0c753463d9119477827ad89e725daa98

SHA512
b45916f3d7dc6576d9dc11f980027f1afffaec243c2831ab926e47561f0d1a859326ab22ebab24ed03132c09d7e50c86490a87ee7a3df48dd4082003884586d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b655234f46dde3509abc1637d86ce20c

SHA1
66ccf0b644abf01154dfa52f64e5eabea2a43e3c

SHA256
5e87b8248179fa15e132c2b3bb97bcd75ef29716e85e46643b770fd3e923a8fb

SHA512
03e84e57895da95311007bba2b07102435d951631bab8364375224d53fef028304b1fca665aa4f9db55b820c0bfbe0635b7173e25617a79bb842be9342a3ad26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8ae792f40df2e82b0ad9228d907d05

SHA1
a300ed0e8f95d551d3940df8acb71f6bca156c10

SHA256
2689338d09bf8e2197e80d7419a8f957bd2143f1faad479c0b09fcbf37a9ea05

SHA512
be1cb6d10f7afdd4a5a08bb65ddb036d298ebbb50bff39be2e84fc1ec8a98245f644667a114b6eb1619debaedb0250394ed984998b029e88a9c464c9577f32cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8c528527a838461324a7fc09b3de5ee

SHA1
80269fe5c0863d91993d6e6906132afcb40d75fa

SHA256
1d5e0bfbd228b78d1a892fe5d7d2d593f0a29eb66e2dd6335fb6e7c0b39b9be4

SHA512
f0cb9f4d48ff7fa2909f82f8a323ed836024473c8033d60b18937b70c59e4a5184da298506c96a202d87c40e4468e2d713c3bbc76437c413723a72cafea0ddc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b4167e22a804517c8d79bebfd8ec55

SHA1
756d8bd68d6fef1d62a82170b6dfd506da859851

SHA256
503155ba1103021465d872c95e64d7d78bf79c3c71bd1fa4344a40569f0383aa

SHA512
8a92d856b554b2b180bb9d5d21ac180e147a129f1fd96ad030ea1ac29df16116f1130e607c5b9e7b2306a55f4f6ab94b42ca3c6dc777fe36203f99226d35dc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2598a6e4e95b4f4143dca85744da9ba

SHA1
d72048aa35a257c10e6e97ae22af9fcb0953c088

SHA256
a3e306d06d65f93fd3e6e82d7f0d8cd94cf3e47a9a3f503c9d1631ad9563b30e

SHA512
c7d36500250ce21f1f85d12d8a1e33c05867e07d08d591cb9fe1999b2399bc3d84fdaa2fe3a019ff6103e900a20e9565abe799ec5b29c7a496b2973ae0690ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06c286d6a05b8230310b2f45de91df1c

SHA1
8d032db62eeca21f06695d8a9309cf61d4a5f370

SHA256
00e5ac680a51e6a5810f7e0d14c55b75eb01e15aa0376154b981d09398ceadc1

SHA512
9ed7b4ce5c519f09dbeefa3601363c8ea0e30610d7c3372a301668471a3a1a2f0ce8d36fa4c0c806f0a6c17b753d51816b13838c843dea2a72989d158c2f7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2993.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CB6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/2196-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2196-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download