50a39c4f6c43325e4ab440a3229d15c4d6ee1238e620d6d13ba2bc870cd4601e

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prometheus-main/Prometheus/env/Scripts/dist/Order.htm
Size

3KB
MD5

51402d8c1114647287c649d27bfc1800
SHA1

87a55ca8cd2753bc69b201d18bbf9ad0946ed2d3
SHA256

3f74580fe3c67c218c79ca4fcbaef6ff44874e9015fe4a15cc4563b8bfe35006
SHA512

62e0125a2bc625283d572dcdf7e9462b90f88e82b8c1f3e0cae355cdbe75a08d482a66b3825600f579fc394529c7e0a47a23f650872c4ac5442d2e2fdbc1cc88

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000fcc6e1b1af2e0bd35f1d9c0c22b203b323a9f3f58af62a6c3eb8e54046b5379000000000e80000000020000200000009c368943ca93461956ca585b6b6c462a64e73f1505b31b72bbf037f12f71328d20000000cf93df26c61e4b197cc448e7575f5636c20e3638062a86523bc4db52af11fd98400000006c0801dfb1c594443e61dafc6dbc296fb376c5b877e2655d9db37e4150c0af3ea420ef9228ecf869a4ba6d4a38117b0d89187876b48b194c80e3e4578eae1213	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420072422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001fd5abbfdb5221b9ccd53d1b7165d0d95fb38d8be3d33b46ce8ce4314387ebc4000000000e8000000002000020000000c9f71dcd2c45c61e82ef6ae6e8a07b7f97ae9934e03c7e53fb06de2b566b599a90000000acb3a905cbf27276e92729fac070c6172d986274aedba6651792a57c01f8f01ddb87e22dc268d5a470507105ebe34a02cf4377f43e4b42eb7dbbffab3fdcdc461feeb1f06234acb4fd01cdd755a9d2393cbd86263e1bc380bcb77fe2b4155389fda5ceb7b9b6d91595d1120749997151e27ecee153674211f7e917eabb92bf4a556210dc90b3b068a7ef1d84b842d96f400000007227215798b0935204447eded2221b5e9fe42916fdcc7f7ee6ce9069bf235fa4cb98a42a7091744eb9749bf3dbbd910278fe30c8084cc09727c8d41b4ea893a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3069e7e1cb95da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D2D8111-01BF-11EF-995F-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2288 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2288 iexplore.exe
2288 iexplore.exe
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE

pid	process
2288	iexplore.exe

pid	process
2288	iexplore.exe
2288	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2288 wrote to memory of 2484	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 2484	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 2484	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 2484	2288	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Prometheus-main\Prometheus\env\Scripts\dist\Order.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1a9528677806949ab57000d1cb865a5c

SHA1
682fef2645321d7716628488028a6ff6b4ef376f

SHA256
9634fb72f46b5fbcc2f0053c59130ea21aee43bdfe9e2b684ed6cf43989d6e57

SHA512
1654f5e371b0be0c6136290ad4be5d57457fdd59c12fc9dbd7accef263729a1d119643c7f54480be4e161dfd9f8dd4cdbd3987656a9675ed82dec51670c1dfb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c7f1ca35094878e97afc8f70cb18ecb3

SHA1
60b7382fbf0456908141d98109073d7c23a280bd

SHA256
0810fe73f828cbf1310e94b356bc573f41e1a5d7ba3694f35a77dbddda1b4d38

SHA512
e7fcca5a6d6226a29861f9affd29e53e6c890c53dff90ff432f536671fca172d56e141067046c704621d2e91e1ee7b0068186b718bb19892efabeb4cc023ea4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
67f3415da2f4482207012f8d048ae8d0

SHA1
d149c1a39745ef92011deee1b72d1845be44e584

SHA256
2bafcdba6c05a6ec3c0348ff3eea8df207e0ec6dda640baedd4ce697fe05dbd1

SHA512
ef8e33fc1eb914371903898784c230307e21ac49442df382d58acdda02fb5c06dd673dd3daec5194a22221551ec76cc74edbb88de447245540ad9caf2b00a68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c6a5bdfdaa4c04f561c087f96f9eb308

SHA1
b3b2cc6e9a215b9c1484dde2a13e5e7fa42ad685

SHA256
fa070a58af587622a9c9343d1ec5a6cd0ad2ec31e3c6e7afb7ecf7fa57e20b22

SHA512
a35ea62e10e9c77c817df879f96b3ba1b8118407a68e56c7e6b372ac644cbc90f0fc4cdc692488a5a38cdcab3720ae216e6e2657dcf17f5dab11560d0b236816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b894b6377d506ac94aa8af3a550d61ba

SHA1
2e0b6e72d6ecf343b6a72fc69bf9c8c31cf76cea

SHA256
6e15c882e2def4d0e04eb883f71f4587431dde7a27f0682a64f31412c7c66ea1

SHA512
5ddec752a0939e99324ad5efc6ce3ccb1deff686e885228255c6d0cfab397a494e26da9f2d47ff4c7b035ced3deba35e6f1dfc60fe63a5d4d6d6299ad1e78e87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
180cfe6dd3478032e7e04259dce5a484

SHA1
160b2099f4ddc63ed5a0a233cac84eef2077fbba

SHA256
a898f5b65cda1eb3fabc2a95fa5a2ab030844ce766c5c35887f1316d7baf9acc

SHA512
91481172ad13b0334354a500832dbefe817eb0e12d3c56830b3a2a25db772773d20b7837621f774778b6a729074d279b2b36a87afb6d95156fdcb5c7d13d5455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bce6194478dbe95f0b2aced40b706971

SHA1
db21811121cbc0723e58661f6bd1cafcb2a79129

SHA256
363c4c464b51341e24954b053542ac4d0c5892fdd5f2075af8fcb591f26a4a62

SHA512
08c66fac67d6e04b83ad5b8f25c949eefc67fafaffa96d5c38203b26562c106934f466bdb97a2c25efc61a52a8c3bd28756b80e9fa0eb6c4b1a4a346429feba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
091ccb3529bf146a847458776ffae156

SHA1
4259e197f11396e2d571d12ac74d0604fd425add

SHA256
ee4dc9862f7f3668826ffb758d2f6cea65fda75af356bf08d2a09ce4a2b7ea5d

SHA512
6d1beb605b5b3b63b5988659e4686f73c747b723d7950dfa805e910c6715eaa3be505bbc89b22759967ce9c0e82c25dddd6dc9e8357cafecde0556740f7bd0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b25892773ab27d59397c7cb224f3d9a5

SHA1
35b1463731d5a8f2ad4463bfb49148b0c0f07208

SHA256
400f1ac8a0ab15aed0bd068dd3536eceaf27cfa1060a4e5b2e727f3ad02ebfc4

SHA512
99e3714731da11121105abc34fb9813d4df80e3d69abc8c0eccfae9582cfb660d0dfbb0e971502b509678211e779111c22c48d3bad837550a500d10f1f56e119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d4e31b5273cf38585c89bdad19a8d78b

SHA1
382282b8dbc9b2c3446ead24f26f9231a3ea4176

SHA256
5e467c6f3f0bce71c40df6f1c6c28a5b2dacdb395c38c18f156a1293eecf8820

SHA512
0d7e8f9052a071cabf868a9975643ecf02d83bf3f0132644a02955c862430fcea7c6cff2e124f5cecd78b8f14e99407407833a7585af8e343deed611b1ff9505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
761ae59a7526ba48bf722b6dce624879

SHA1
e3f30c1670805d2e6118a1b2e94015e23e62328c

SHA256
4be4aaf4e70aaaff11216c519981295b1ff4e2bd7389a6c394ebb5dc475d9dc8

SHA512
3613e9dbc10125d8aab6cbba6b8fab4c5e0570183cb0f25e996ae9e7298857974b2500bf1701474de1d248a84ad58915375730e6cc06cf96c9d655234de60fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab457B.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46BB.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit