8b3e30c212d0dffd912973eec02f4d96aeb98548ab1f1d575fef8495b06b11b2

Analysis

max time kernel
188s
max time network
272s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sms/ContactSelect/Control.html
Size

517B
MD5

115ded8936bb8bbac8c8cebb0c497f6d
SHA1

ad1031ebe450e18870cd3d301673cf1bdd6fd288
SHA256

5c39194e5cfb55c7103a97a37d3960d4b2f9fe2bafacff7c2b1901fc42ad080f
SHA512

bae8084a4503d72db1f54caae68adbe5e30649836653c2a6edbf599babc3a1fd4f3b2fea58e2193c9414aa1f2a803c7afc923f5e4a7c9851db996f6d8230e5e9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000003f5463450333f549d3631f5cdb3583ac0c122d63dcae3e9863240508bb31588a000000000e8000000002000020000000f38f2deb6648f86568208a662ee73b79dde5aec9b31dc636934a357d56648c8a20000000120292bec7503d7067e3464d7f1ee80ccdc3071b4733ba80078edb91a57ca6f34000000094011924b5121693c6ba3d2672a792e528c950ccdac82b18f926ae840e39409e05e6c46120e6eb688e0ed90ffb5057254f239656896a34abd11210ea45aa2416	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417719587"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000066a5327d8c65ce961ba5c2aa681d2067e7061c5d7e2b87fd3ff8e47092005496000000000e800000000200002000000039f792b9002db37e61f018102688448c52b89e2645faf8f15f131a4e77a1cae190000000d3f54bf87ba72ba437959e729afc9412fcb1e40e62ae0f39e9ccb61932f5ee06442ef61f925673273215ea9a829b6a59e913b6881fd01d52e3e2e81d29d9fe7b3aad4f4dbf4ff4e4a5d05733e991dc6ce1f0ffef58375c7b842632f5c73724888c4bcf4b09d3ca053ebbd8db1228d6c4c0d77c8df1829bc31d3494842eb23ab93e37d0db2f0b653ef68dcf4aa859a67840000000215621b02c52a32efbad0e85df1ed038c2c6588b1691d332758a35ca5421984a6753fffcd799b7d6186d745a2543c71190543f749b87d018881d28ed5010ea00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED88BA30-EC58-11EE-8BFA-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8045d6c46580da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1300	2660	iexplore.exe	29
PID 2660 wrote to memory of 1300	2660	iexplore.exe	29
PID 2660 wrote to memory of 1300	2660	iexplore.exe	29
PID 2660 wrote to memory of 1300	2660	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sms\ContactSelect\Control.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10266468a67d9cf7c0e5cdf427e2e090

SHA1
c64a40a43506a0db4ff5c0150656b3a30d5a9012

SHA256
1987668dba76d1c3f43fceb96550e5d5d1fa976b640947f17ccc45cba0f8faeb

SHA512
80d111fbcb0b2208e38e0f92949d9c95d34cb00f2e17c02e2bdb6f80bfb9695e3c6e9b6bfb67fc819e781c518711234a7ed1bdbd969f1a69132492cfcb174c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a91a24ec02d25fc9f6f0494ced6b14b

SHA1
879e11b1d02d15bedd3d998b4b41b42823a93677

SHA256
928267c5575b8d773846d1cd5f2f9bde2dceb072d6da2c074c3528aec3a1c395

SHA512
7f8691a83fb6ff6b6a967debdc33e26711c35dd26076f2c5178fae8edaca507da519e9ff2f8bf9f60c1eacc13932908a6f70aaec10738e679092b155b4bf0466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
492a4fd95005ff5cfa11c82d449e1b29

SHA1
ad5ea56609ebda0541387d12537a8ec9f2bd90c5

SHA256
2688fe68f1aae2b994aabc8caedd503abe2de2660e397629a8ab2c5a61ec6791

SHA512
aa91b3f9716d5f445ce2fa0cddc51a2727157ec16d13f1cf4361dbd0c967de35b6ebe6ded2778f2ec1cf52d5fc78d92f85abda14e0e33340d87f4b6ec1d5e22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7794436b06534d4d228e311a64506f20

SHA1
1c3b2ca80966af59bba513d58ef132a661312e3f

SHA256
d684c489706df5b42d95f85c48a16abd962ee48ab4178f163ac6e6a1463c8ba3

SHA512
9d4f24988a6334eb171419223b1cf27c27fb20432cd6bc940d2aa541990415c56c3b15bab94b836a177dc4e9c5ae08e512be6508fbc0c30fc453ed8c3f0c14ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66e481ad1cfd3ef26962568ade6fdfb7

SHA1
bf0a91ef091950041c34ad7085f3395d7cb2f65a

SHA256
be98282af1a9d3787f1a664181fe1719010ef30bc2cd1c8595d38c6354cf2344

SHA512
c30defddd5764e3d0acd80433d4f2cabaabfbe46adfcf068d31e0f7855e8956df7d41609d85d3892dfcf3286808c1a47bf5789994e570d11fab5321ff21ff9bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f99309e91df5f803e53766642a1628

SHA1
2598d1d34c21b83f748b0c2b030166be7ab206c2

SHA256
37df9f75c49999b69901d5c0a3c081a9d660e3824b28a577d1c0d5143f091906

SHA512
9ec7670b8889717295a3178fc41ed04839d3d2673d1ad708c5176424d86cf35892bd0eaef25066e8e5c2b1d6dded7326e0ed633b27daf048b1863c2480d299ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbec0818aa12f4f63bd57ea76f1e33a1

SHA1
087f42284fc301f1c5e49530fb48695e04d9a20f

SHA256
1ec021de0d6f18267349c6cc24dc9c26d51228852f6bd9f8c77c427bc555f21b

SHA512
b3df985925629e6495ac14d5fc9a5a3d900a2bc538f9dac889d59072afb5f8d04534671c8243dbe38e4c0903ef5685dd08ee414676b33e63199c27dae7b2115b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aef6ebe01dc61a28aef35a255c37172

SHA1
292a25f913640f05e8e990a9eeb9f2f56572e12b

SHA256
e906112faf9b91c6680b49191ecb3142bcf986912ce1284835bd25c2a2b06e39

SHA512
a204982bc9332dd30c4fe2dc16a9477231920383823d117560718cec96d674085e31704c773edc6a3791cc0688d030bc23cd708c0ff917152f348512a7301115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2235f03ad1630f5536aac834c90548af

SHA1
cbf14a2ea52ae239d50fbf1aa0e1d4f5b0b5faf7

SHA256
eb3439dd2ad873264eb87c7d4cd0e06dc1586ad1929d2202f60a3a449b05bda9

SHA512
f0331bbca7b35b27ab64daaefe551d3c0111f176d996b306dfed7b2611da26c15003858f4965bd7fa7de917cba7a71f6a46e69d95d572a656fa22c98078481ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecac2fb1136bcd4c062a8c3c49cef390

SHA1
700859bae3cdab98cf16132654bd03397160b978

SHA256
63dc66c130b613102455bff7bdce1641b3e8d7ef5c4181632f8476f61b5c9440

SHA512
4453cfa25ed10c01ff8fba0bef96f5cd2a3216c1a9e6e669c9490e3a1aca156d7aaea7309107fe04b8a267f79cb1c81e7b2231979d026e4dc4fc41d86f6fd6f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbe84f30ccb875a1dae476d138154065

SHA1
9b2f8829d42f61dcb62ef1ce36de1f5a325f9626

SHA256
12e845aa685f4774071cbfdfdd9c1cadfa585a2bf3f3b17cfe83574cbeb19aea

SHA512
8b1fa6f22c0bf2a42dc78f29194d9b900e7089a5f1bdeae8afc7611125176edb57b33271782209b62999f410d7fbfcec14f8bab2d1a3a0c3a274f87c67b6a512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4bc35b0fc99d89cf89658e54c1ecaa

SHA1
4af7488d650a0309ca95f6840476ba0baefde688

SHA256
a061d207b31c9b2a6ac002b2b0871d58e23b6601954d5bd9e363b18a1a3d6b2e

SHA512
e0960ee701e482f814b0b6404d1eee24b1d4c1043b2024464676a6f9cb9a7d803908a6f6233c46bec833ca347a3fb8e3572d03315b5b0a0b2e838d7943fc9492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7109ca488bcae142ed47032919edf463

SHA1
430265211962fb05e8e9c1a19003e401f2240ec1

SHA256
a8bd10ccd846b08b767e28c83c39853e3b0a9bb62e9769f8da48d2fcc9869f1e

SHA512
a494b58d83ea657c5e645f811990265d2fd28b6ea20d0264723f2abf8604ad830f32774eccde37a72fb595bb02b191ad6ce0bf488704b6f10e37690251836271

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB76F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF90.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit