d1a804b493c3d90e57ce89ca1566e65e8272f62f3d60dd05c35660587e9f7616

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.svg
Size

6KB
MD5

83dbfc45c0867bd8c7b6f05e879d062d
SHA1

66d83c7b78ce20cd937c28dc2b8c74361d632aad
SHA256

d1a804b493c3d90e57ce89ca1566e65e8272f62f3d60dd05c35660587e9f7616
SHA512

2ca01f1d05205d9516f2a162b063ba08f38b6c75aeb73fafa5a9cb42147d175519bb136d03a05da6008690dd445cf4ed280f886fd08a0abcbdece32beef46f16
SSDEEP

96:35vc9VZY5eYXLJ2L+lSh4CozP/YP9i4NfQv5rkyoRMLxw3QKRkMFWTDcmS:35v2+JdYiCgHm9s5rkJCLx6QKRkFfU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000007a9e7ce3181f6a159b589b1db853f0f98f27c7b5d63ebca30e8fc3d45d14b732000000000e800000000200002000000053c3ca34e73d337b110450bd83bc001401ccffba4e06886e12963339575f8e812000000035df4c98d91d7e2d8545a4947b14080e8bf142e7a5b0b200a002b2692a3c591040000000ded36f9f8b5aaa934dc1661084666c51b89b444ff54a032d01a5341622b42911b003943eebb46564caecf07bdfdb7a9dca8af16a2661bbe9b8ca335bfdabff72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417610663"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000008c42c3c3a8dca545542ea8dad6de2bec657a35efc82dcc1389c4a318622442b0000000000e80000000020000200000000ed67d0c1a79e689c8c13f8749a89fa74381397de501f403b8dea307ef617edd90000000c5fdb2ef4a81177a2af28e456a32a63d3fcb7b25c29878b35737fa052ff7cb59bc826a90bdb87dabecd669bed6fa20d4dc6f78bc94ee8bd9966e33d130bf212e1975714c81197eb43d903ae69e63e697b42d068417f13f5885591948929c561889400461dc81e716d4384910c8489c7e2a4d2ca95c2736211d5dd0ce421addcf3f5f5ddc0ce6f6a10b39100129f0de2940000000cd3f913e1f40d7787003348ffe99bad315026de00eae9c07a34d0da580773013f93aa6ff21b00b03d1bb496c58063e830fc90af4bf09cfc273c8b9a621363314	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{509BB0E1-EB5B-11EE-9298-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09e8c25687fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237f690f185d00e185bc2f27171af580

SHA1
e9a92bf54afd160deb1e82c06070db79fd52382d

SHA256
9fedab4414fd73a2932eab1ff92e52ed27f57e6720115e518cb796fffcaa8c11

SHA512
1dfe099e13eb8d3ad0b7b7b5145a3b0082141a5276277785e8930daf8e2dbc9dc65027dff801cdbba09bf0d37401e3b458060ea538f175486db9a2ea9fe34d7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfbfc5802b7b151df0c2d4c7def25446

SHA1
206a9d0ba34453eac57f39d4f11de5c3978aaa3e

SHA256
02922f0ec9d4fb29552e4db408e0a37f45d11fce4df4f88a5c234ee88f6e4c9b

SHA512
62cf65edd83da4a637433c648655d391d4ac34d32e209948ff89b28b32a9d591ec14e81e2fef75c6f97bee56dc01378e05623b4ccd7b803cf8b080a9c2f619bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bbcf49b8909808ef85f648a8199a177

SHA1
8b59a04ec37e63152532014cdf0f2e378c931550

SHA256
4d88072b828a21e3c3c80b9a9a5699b1ebed186455bdabeb381f37ef4a1bc0b5

SHA512
31e8eea58e4aa501e988fa6314a8fd6dd1e2f615237751cb3e94f468f3186ee209c7dc56755c0e8dfd30204510a4db9fccb9075fe8bce7b964a89ccea082ef44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e177a4e34585a3f3b1c6f38b860b38f8

SHA1
2f393da6b559a25834098f3a1701911f478481c1

SHA256
670bd6636fdef4d980946ab8970cd82de977bb5a7262ad2b211a36cf382f57d1

SHA512
cebfbf3a16f3867b1b11d82340c2d4cc6b44f20a3b0894fa459cbab9f569031b10b02227b3749f2371335777f01262ec91500081876552194fa4a662ceea5425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc24cb7448561a8e7c5de69f1b27051d

SHA1
6fb20d818a7eebe4e26ecfa40631e9f363e86f96

SHA256
dad0588088e2d3dfcc3071794681be5299d61147e92d07fa78917c48efb59b68

SHA512
ad48d9999ae0c2472fc9a26e2c45814935400e43f3474d0a2f0d33cdb9ff51f602d09a4578926ff769c4f64112f1f9a1c5848d7702b01ec69366a5561f6d63d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a06a00c7a9cbbbcb0695bf9c0a50f9a

SHA1
6d81d5b59acc23e5baf86ee7ca136edfb05ef6a6

SHA256
5bb4cc5ccddcc3c29e711e3f84c25d9325860ea7ab711906e35df520f897fe53

SHA512
78c0a5a4ab4eba94fd1f826fe1aa0d2ae60221c4e3745afcb242da5b130a501da4a14d1ad187bb189cb60c0ec3544c71862742de897c23473c480d73b46d76c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f6e6d8dedbed8254923d2862d5ea168

SHA1
1eab5afe27242b14a5fe9c0c03a265be8323146c

SHA256
20750c6ccc0f3c0d8c92f1e955ba25fa3176184cd45db61600207384ac7e12ae

SHA512
e4516d8d28ff6b9d6172ece8e4f7fe1ae4190bae9ff558d2551bf2d19fef8db2f93961270142c4a2070ba3176e81a83e112a93a408e1392ee2f403123e14c0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
031873f3aa0e67a2598d5ed1a6bf559f

SHA1
4b6dbdc463d008aca2dd0eaf7e28d81bf2f825eb

SHA256
b0bdad5b2542af290d287dcde5e8b831b5635ac13a78cba2a93a320f9cedd5c5

SHA512
ae2c4943c35dfe58eb3d89778fdec354d16fadb5419648e9d53a2505d8f1e83fc97392cb4584f0202e9b2ed123e2b508d1617a9351299f048e630af1a0c7d70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2700d1c90b7938e3727b78fb4ea84bf1

SHA1
9ad466a5e3757f3b6e3e282182f781e3b5618ebb

SHA256
8e1470c7400abc119b6ac7a442f754fb28eaad8b3c98760e8320abcda5a4c491

SHA512
3742c7650bfabd57459a858e7eb2ca7da4c885340031eacc597b15773d50cafc536c601da1f71bc31cf6169ed5c007c5bdb4cc42a2cc758f4058f85c03a4873d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c680b2bf5c6425a677e06b37a8079b90

SHA1
2a2ecd0864bd8beb944af7197d826b7bd89cff74

SHA256
be32618668504580608a1ed9fa59a3a6389035e29b005910c7d149c04a4e59b2

SHA512
59b7c73905a047c301c024c92908469791c88a659f9e404a9b9c9584fe2f1ab9186eae481c9daf2f889397aab39d0c53be431cd7728f076228e9defc35be4163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d678201faef825f4f774f6f770a2a3ce

SHA1
aad70a47b170eb83c5aeee77809e89f257998bf5

SHA256
b78082f9b5002703b5414c7e84141f49925a15d8448db448e902cfe36e448d36

SHA512
cb6e32490f9e0a6d2f27cee37e9f8bbc26c3ec76a177127954f1ce35ab1c9616625b99ecac21cef8f82a7dbb8285772f5a11e7a7bcb4ae8a07baeef027eff540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c872544dd5b2c0949b01fa1978e6a94

SHA1
73a339d95017efcdb3d98530fa024a99466d9212

SHA256
fb104e52e35619f88b4ad3a8a5ca88b41c2b539e1aa678dd72da3b51c89cc528

SHA512
821e7aff978135268ad56db7a5e0addb7625bb89612ec5297aebbc738599e3bb7a906f96e52bfd96d9cb4943185f2d7a582bd6a315a04db749f231fbdcaa5069

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B1E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E50.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit