206fc46b38953ac40dba9bd1c3ab49ad5822cc7e7372a7d3c5f7aeee6c665986

Analysis

max time kernel
143s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe
Size

96KB
MD5

e69997f3aa779ef713ddd487f320756d
SHA1

a493d610e9ab9c13cc9401482aca7c3960621b1e
SHA256

98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003
SHA512

ad79a2f74806814514e2c1b8bc856529651e7e9f7c491f20a419efb7dd60a6ef697f1cb0752c707674c951cdcd2929db4cac35af7d93a6bc42d0762e0fffb281
SSDEEP

1536:THB+zRmEOhwCUY/rXWoinHDHhKyru4ogWPPxOSmbf9Bo3uHTyyHddYRk33jtxbIC:TwzRmEnCUuzWoinHDAyru4ogmxOX1Uup

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000644cb8601318a9cd279bff0e24ac5470d0759c2902a5c63bd6e8683216245a51000000000e8000000002000020000000a38a06d3d4001cc0cf8a4c3254d7cfed47bb44a007a9e61c5c2d9a829a24f6a32000000057260e910013cb9837f5233cef9231bfee39eb8609ef982396aa17a304d9765c40000000b3047703947c51525089bc2940ec45a9ef8391d8aa3dfd9fe1cdf78d00e7f73a11973598960cdaa7aaf4332b8d0120845779e4503bef1f389b54077377f1dba7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04a41d48792da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419713333"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA6EA321-FE7A-11EE-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000255559eb928fb70b3e02be1bb04bb7a41126681c1e2617b32e617c348949a7e9000000000e80000000020000200000006aa54db5a02f2dcafb937d28d84807bcef0528642224d29bdb445bca258db1c290000000dd2dc1e23ab601ed9b5e9203398f4041e0b3ff74983a2818d0cacafd203cd361eb0db3ef63a936ea24b8d37e02b09fc216de63f2ab1af056bd8238d94f3c7435c2ff0a68619620b066ce92950041a737f81152558fbba1edae2b2aec09f64afb5c629d6e4c0ad7c862e83b89965d8c46b41e0655d40e9448a6aad7057e268642e9ba1567ad904d55ab620f47736f457f4000000089b03971ac6af1d07e61d920ccd267fdc0a89fd38b6a15c387995c770c1b31dacef11b269090d8ddfccf7e027728f49cfcb4da4bc3129d55149d39f1e27b54d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2984 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2984 iexplore.exe
2984 iexplore.exe
2528 IEXPLORE.EXE
2528 IEXPLORE.EXE
2528 IEXPLORE.EXE
2528 IEXPLORE.EXE

pid	process
2984	iexplore.exe

pid	process
2984	iexplore.exe
2984	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exeiexplore.exe

description	pid	process	target process
PID 2328 wrote to memory of 2984	2328	98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe	iexplore.exe
PID 2328 wrote to memory of 2984	2328	98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe	iexplore.exe
PID 2328 wrote to memory of 2984	2328	98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe	iexplore.exe
PID 2328 wrote to memory of 2984	2328	98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe	iexplore.exe
PID 2984 wrote to memory of 2528	2984	iexplore.exe	IEXPLORE.EXE
PID 2984 wrote to memory of 2528	2984	iexplore.exe	IEXPLORE.EXE
PID 2984 wrote to memory of 2528	2984	iexplore.exe	IEXPLORE.EXE
PID 2984 wrote to memory of 2528	2984	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe
"C:\Users\Admin\AppData\Local\Temp\98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=98ceabad0a987e7dda004d388ec4f6c1bd54d8de5a06d2192cf47bbb7ace8003.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
Filesize
252B

MD5
9d0020af996c853b447d19d6513454c0

SHA1
f1556761ed7e7997fc48876fdd55169676b4449b

SHA256
49db7384ccf668124cfde1d6a34dd3dbd127e9192723a2845cc48a2871be6acd

SHA512
971e53b5e9c2703efe7e775beb9867e73458ba5d4fcb2d43aae773a54a3d565b96932cdd03865f3830634d2f97ead20cbc2288f96f6f0b09554256ffb75259b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2ae742f3c1a1a8c770b1b6eb0a6781cc

SHA1
76ce65f3a2f05c284e8d29a52d96342e435e69c6

SHA256
551211f40da8408e89b7daaf4afd5888f042ed625e680bd41a76c3e36ee1ce90

SHA512
31ae693d3824121fe9c948f042cdf856c8002e4220c105ea6624b33e30b17cfc4c421ae0019c2cf536be98c88a3be5454847c605fdaaf370560cc444d4bb4908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
20984ad3440381c8c4e78e4e86aea11d

SHA1
2dd7d7a6ef3bb7286e7a3037ad6ac40f23518883

SHA256
0a3f4e305bbf839e16ddeea92483ca243ed3292cbc2f7108d3411a0bec80c02f

SHA512
35b14b46ce3c84f263affb05a58877b8a91a1b0d715175374e3cd7296647a5d3b13f53c3f291a71d1f358c5ef725e64951164a1b3e32d1921df603e8a86f475c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
25a393195e961c444a4ca7cef9961883

SHA1
5750ce02c3e59986dd5fe4e27433d5bc4aefb584

SHA256
26bdf9998cc66247336578be2f800a492511f8dd17f3bec07e1ea3658a1e3083

SHA512
6cb7d49794c4c44af7efed2e119ed7723a2d7ce53d01215b0f00038b18437710d1c71b53d5ff8e878ef715fa6508c23b5b0b32a7cdf26a79d5a7874446bf05c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3afd51600452d0588f46b9765618740d

SHA1
10528c6b10bf2070baf84d7e10c8556040c48c0b

SHA256
48aede2782053753c58e3efa9b7c2362f57bc816632325a6e8e0899f7fbe9451

SHA512
0ca7809e88309603e776cfc901ac6a5b41b1dc6f563d873cbcfe872b43b48a34dc0ddc6a40b1f67b20460205b5bce04875ac6fcdc931644e2499512708bdbdb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
49255613558be0e9d4ca6969d612256b

SHA1
c9e06abfce35b290209b208df2252478274844e9

SHA256
379314831a1da93c4efea6f04af8837f7db29e7e1dc6dad7bd97412868ec6a13

SHA512
845c68455eb0bf09f4b4d7e89d6b83d9f5e47b58872e5caf4ea0adcc11d1053412b469aa000b074830092223297e2cd3e2267ecf89a10a4236f3a19932060517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
36cb15e0972213aed7dab8c345a1275f

SHA1
b9b88d02415da2c2aa045099fb0909e435a43cda

SHA256
29ce761c78ffeaf374aec441650edccd9a3f7dd4e20400d1947afa95f2f9919b

SHA512
0401cf6da62639d295631b1432bbb34213164baef4903b6c56fdeec1f4bab7aa411f4a77ebd7e0cdeca22039fc9416d803063fbd21b2301e27cb78a9d7320789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7984baede6b3e613b00a0db04f26a75c

SHA1
4979e0b78dda31615efc7e3cfbb22370ead6f04b

SHA256
b6a1b538b9afa9550c1d83826a157236f8f345497db336631e86b4534f8b058f

SHA512
c4e111566aae1ad35758dabb384c92979e8242d764ad533e98debf905d3e5a461e51e57912b8b8248c09af64c92dea5164b8acd0f3cc0c9c0a44fed16b7a4c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bc9c9509e071b6cbcc589489e05d48fb

SHA1
15e395f79ed2216f7b2362e75f4b37e1d51e4290

SHA256
f27a7ddfd49b3d55c12cfb845cd03f6301dc2c1bfcd8410cc412f127e634ee04

SHA512
d6ea0e7d36e676c8c13e911d5d8e4b6d74656da73129e509177e4972f18614bfb0ed07ba6b4de33df58f27669161b4f50a857d5bf4275c495def2d8eab3ac685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
25a24329573f14dd4657b17141d7a753

SHA1
212f0ccf57d7a721fcb56962863cd56483135263

SHA256
9b5ff11b3c4079cc2cfcef79afb35e39cec31166c8905190e670226d5fbb899e

SHA512
0cf62f902a4685bd774fd99c839faaad9e1f7383b107724b7d02acd2b96dee078f504f6e26d451d46de167c9f5586f0b46b0bcb67eed2529c5125af665e8b3ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a5077919d41d85b7a71d100dad263972

SHA1
a94d9146f9ac589eb43d83ab7779278dd7da3a26

SHA256
80e5550fb4580262b6953dce365053010f8f5d95ca23d10c1806e80f14cff1b8

SHA512
73b58cf254fa15b28e5537ee486902c69b68de8c16b99f0d3e7770f1a3b5ef5f1a63796fe3765bc9936a9c1d43f1896b16e7e5acb05baa11678742c479173c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D65.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit