168caeccc25258b81c9cc6d43df8de2fd55bb3c9329b7cb423112cd56a5cb6b5

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

captured.html
Size

1KB
MD5

461955b3522967a8f6c0b81f064092e6
SHA1

1b24ba6a971800488cffc17b980181673196455a
SHA256

e040a22746d1d93bcc239e68885ac4475f9e18c5ad7edfc3501c2dabf1826920
SHA512

84221d2e55cfe02398e239a7d55b49e6dc22a0c206e3a3b817fdc621e3dabfd732c299ab9fae1d5f7d6f4f46a855ccb44e319f1040824c2b797e17f526c866da

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DC45421-EAC9-11EE-BEA9-FE29290FA5F9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417547890"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed477f115d93b747b98b63c1b178ac7a00000000020000000000106600000001000020000000044b0dc9acf4ce69afaf34f1e8eae301af1314cb844cf330a2a858d21388b07f000000000e800000000200002000000054946c5289329b3b3a2bd53d6c0ac87fbe6da95daf7ef5d20c51921f8189fa9c90000000fff93da8f67c14f5bc4a499497493a9207ac7142055227c2a02d7faf4f61d94b3ea842462590598dc12dd4640195bb5485013c6906e9fd247d619de37a743eec7691f629d6e94b2889fda8d46e7052025f7099f8bf65b7af8245a416fd1a4401be8dc015d8fe84ab946ba5d7dd77f40cf1aebbb4a2eeb1864421148c718286930b2870b4b38366997ac45cbafa1cd45b40000000eccebff803380dc59415dd463ccd07bbce00657fb07347ba059546a62caed3f8c484d7bd2ff4ecbf418e42835e5cb91d94375cb136547c8bcca5abe576d83df5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed477f115d93b747b98b63c1b178ac7a00000000020000000000106600000001000020000000241dbce1ff03730a9401345dee4411aae34a41946ac365bf19ec80ba33ee8b64000000000e80000000020000200000001e52e63e71108335f526c4e63bb439dfcd0d1c941a1ff8d9955f8e5018e7e65c2000000002273f51b4ce7cf81f7219c042955044f2d933588a0b5bb8360507c539c74ae240000000464a7ee047946cd2b87157d07c1017aaa3cec3e5d1eeb0cc70663a3d3c3668eef5a323a966405e0e74b92db2f444dcf21ae5d7f447de919105f2f1232be5d15f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205558f2d57eda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2540	2820	iexplore.exe	28
PID 2820 wrote to memory of 2540	2820	iexplore.exe	28
PID 2820 wrote to memory of 2540	2820	iexplore.exe	28
PID 2820 wrote to memory of 2540	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\captured.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
eab7df29bbf9aae757de74e4da3f5d67

SHA1
23c99b63bf5a70b2f7bda6ad33a074ad2c47bf3b

SHA256
0cfe5b3f13c8faad60f27568b62bd6a439c2bcbea4c4b466332209e480ebd737

SHA512
fa7c16a33f411aae59e6ab85bcedbbbcaf2c27c1ea14c3c70e122f0a7d7a9c982c01050a26c915b01ad92ff04f667fd4f0c3916fce297c337522ae4d02719bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
225a25c8e45bb04c54769e0718dc50de

SHA1
a3974027bbe2fc18f52c568b0a450ea149b03cda

SHA256
e25c86c66946c7ce748f315058c5534ca957d791eca7abf414fa19b722366741

SHA512
dc46fa0e0726c2b6f508528689c50226de94663cd64d0eb510877e21bc81ad1cf3292c1ac4f5e6e8cb88b2ac6b63d336c635811402456c03c3ca9b9b8cba6dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ece9c00cee06167ef60b7159b9a025

SHA1
a375c128016fc031eca454b5711522ab41dc6b79

SHA256
90a69589852157dc56e5fd011569d3eac5723cf6132fadf2351020c3d03612e6

SHA512
85993ad63dc202a9022ad7b0ae68957aa022b2d2813e4c72816f01b520016060ca58e0237ab8260bdaec50d5b4a127f2a07eb883d4213934ba08d763f2881f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b105e0ea3a2176cc97340df3386d6057

SHA1
851fb11750fb4167025ae370b1205979babc3697

SHA256
4a08778758ae0e5a19fc91009a8417154005b2fbd91a89b5a55489f205e4a70a

SHA512
a9b8609e3fb90f47db8567e3db740913eac3785aa7dda306697d195af9f132c5ea738064e7ae5f4cf19cd0834727cc5629db3f8f9972db8600850fa39f35246a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a99c2c4ca2edb0d3ab4208c627aaa0

SHA1
fef8feaafa21e66cc3bedc872b4182405acdad85

SHA256
f2753c78b79be32132bd5bddf6403f3741c056939d25d1a85db6dd5838c6f9ec

SHA512
fc6003973eca0c65fe716851a54746dc3bc66a549b982728ed85ba6e107ad13416fc73d1df05bdf992e5dd5eec0e723e48511e12d4d43774a523f832ba8c2f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c0df9b77db81ffa2b879e2c091052c2

SHA1
4bbbac0b76fff7f8fef9d1f902049a80232249f6

SHA256
ee230a4f5c196f0ce0bc8a31b9b60b8cc1465d4d68548ecb29dc434b35563293

SHA512
6d4976fcf9f65d41f0fa0aad9c215fb981059795dbadc16e4126823116faa0e8902404b3952a319903da5e52fad7cf917d48db96da46b9d0a1541f38e3340b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab4a78ee7bb10775c2da22df6359e8e6

SHA1
838fae48ea619a534013780f1928ccc52d5a2f2d

SHA256
4c0dff15a1e8af70e737eed46f36c6ad96d5d085852e440b8ff47e707f4bec1a

SHA512
69118af7347b43e36b8a045961837055786dc37347a1a87ce5789a296f336b73d273178de46cd3283375c6dedd7657c053a977ee830e7c58505d2677f1011bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0906465ddbeac67084ba33b3bf5a4817

SHA1
51b8a93e993f5f87efdb460de1476ab3da895509

SHA256
a643c4391280abff327173f135cabcdc9192c226ffe48b7f422e4de5f89cbe7a

SHA512
95f437dbafeeae7cad09e41731662067bf833bd4ae2a8c1ae8f22259f6a8224883c64c0a5e8d244d9995d7f576fcd6ca643e4163e2ed9906975d018a95adae4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943b104aff8ca60702386b619a50826d

SHA1
593d059b6a650a77f00b5a36366821db64e5a1cb

SHA256
580a0692f3473830a2416e566f4f23128f5e7555cec41f688142705ee00ac486

SHA512
12b81a4baef67c044f47ab3a3f8282f2adc86b58b096a3d156e6d229f85e66fb9c3bbe58d1c25c31096855b431ca139399f6082c4b4fab6a948806b794f51ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8b68cd57f4f184f1580ba7f37dfe7fd5

SHA1
66543a33d429dc06dbe31745964c710783c00825

SHA256
2291cd53f871f5f2f854c557c382b6f929a67a840cbc1e1babe9f0dfda6baeb4

SHA512
3355c0bc7dac9c4372d363fd416e8f633c368c8f94144a0d19b82ab5a27b5e8dece41dbc360f2b3c0d12ecec192f686a4fdb2d3d7c2f5497a5d97205a6624966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0fb73615c60b6244612de223aea80c0b

SHA1
6a62a2ac6126784d4cecb065ce971256517dec3b

SHA256
914e54f2b67c24651ec65fe67abbb9c385677719542a48e53608929be54faf47

SHA512
596a4596f5cce3bd50bf308f862dca95dd7acc103fb1fd80dc4e9481e275126b33a3001ecc8a9aa278dfd8ef1a6315d8ce516b4ee9ac0e3c06f6dbae3fc51b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B99.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit