48d75213df96f594a6d84b0c9346338d7569ff5a9558174998dca5f2f43919af

Analysis

max time kernel
135s
max time network
154s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OFFICE2016/leame.htm
Size

386B
MD5

c898250d7be1658510152484cc8dd668
SHA1

b6b227b6408cc87013eac5486578bdd751584c07
SHA256

ffba0c0174e7c08a9f517a5099072bc98eae74b0f35466e11843c3b997bc16c9
SHA512

a2edd14341bdcac864b437d54d8f80b760f052f95b8d2d5b48866dfd57b8d39208e93b0774f33b74a2e9578e7357068fb795d98e137b0dda01b1ee2439bf1ea9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420133221"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C660B31-024C-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000672383d73f7e9a2e711cd899e19752f5301dce7a3f7b3fb5b90e6746196e3671000000000e8000000002000020000000a1f190b64d148824579daefaa8bb7f0ff860499a5b79a1f57ac6909a8190d72320000000e3377809c10dd3e381ff89df9cec7e5f99f81af73083de62406b0da731f350ef40000000d421b88b6bb331d3a9cb37bc2be84bd408632c8aebee12dfbc0a8df93afee4aba94ff863e122f74384390340b8addba9085d4554923fd2eb8f60769ce7c87c06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06872715996da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000025fa5c60648ba1dab0d6da42979751791273b5edccd481f322d38be954aaa3ee000000000e800000000200002000000091dac4d4a42fc3beade000e6db6d47739adbf0ccb485c9969aa84069bc3a20d4900000008503b8b425d4288ebfa0a6059c7d5d3474d58ba49bd97748232e29636936278bf6a91718caaa11823f624b012842fb3af5ae189c034c6c035e84726c43eb9f21c2b1c7138edfe20e4b264ccc686542b64c27a39c215199ff262622220163fd302e0919286f45bc6f43eeffda59dc44f66c62e4586eb04eae751f771866401c9f09959c7304534352d572acab265d0c40400000003648da387cb53d158e1e8f7cda68da443735f407a63bea5d1b6e3d81b374d0ba64b862b3a15cd3268f6a68736fc18420104182ffbe903d314ef666ed403ef68c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1736 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1736 iexplore.exe
1736 iexplore.exe
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE
3004 IEXPLORE.EXE

pid	process
1736	iexplore.exe

pid	process
1736	iexplore.exe
1736	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1736 wrote to memory of 3004	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 3004	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 3004	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 3004	1736	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OFFICE2016\leame.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c300fae8eb764c920a2b04e7347f4597

SHA1
45b95de0d7d583e68f27c0519a78f135f5dcbfc3

SHA256
edd62df4d33361c463cabf3575e37f094ef8a94a4f2fdce44fbd63159b581417

SHA512
baf8f748e2beebcf4a84552e4ec25f81661cf5e8fce46eafb4b066fc0ef2ea9a3acf900c28b4d47526e995f6e0416a281bf0b6626c4593089a3aa8059ab59aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e38e53a466c681ddae6a65094ee656bc

SHA1
447152ea2c4d28b6e2bf725deb43a84a25ddedfe

SHA256
ad5f3c53c821ffcfa4320788674be5f3166545be592d06677081ac9049d928f5

SHA512
ae087716c57f54fbc18e6c6218deabf5f768d4a1990ec7d7a053ac82e246e67bc8513f61ff174e61158ebc4921cc4349d16c2f380e98bc9e84ad7edbc0de734d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5ddc9c2cee214139038d78f2c08030a5

SHA1
b3801e55f2fca482f1f63a8b4675bc4a844cf29d

SHA256
3bef244f54827254949a90e20f873e337da952cc34805f461c20641879795f4d

SHA512
6af7514b60abd30c824f483fd55a14d258e6af400e27357ae3f0a1139291348bcb4f13265aede46d45f4820203784abb311f9acd395398d078647e25f9d36589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
15015183ad577e41dca8280219e61f5b

SHA1
e7bec2520ac94209b4152a6737d1f1bb4643987e

SHA256
8e46386992936135f287ba186b712b207954f80749cd3a02dc6b1528e3744ef2

SHA512
5931b335d7fbe89447b298f161003c975ccb4a62ef99d3cb07b3b3e2fcf4b63047f691f5d2377ed4f2fd2c06c85136f71860b9e0dfdbecf0b797e129f25bcd2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5faafd044ecf215a485eb18818e26617

SHA1
cb448881937c151da060e3505cb6af95bfd2e9ec

SHA256
2f814d2271b2910ec19b6febdec6eb60ade81f160812cc2ae00607cb088079f3

SHA512
d75e49b8b1dc8957099610c332e85a1b01aa78bd46665fba3b4a81a00b030a8a1f95273a2e7c041baa838239306854ab89bd457c5362aea2a0147c182e17bcd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
26a7c1272eb285033eb35ec22ab27ecf

SHA1
b9e2b92d75ad4619774e60e5c412179cb52481ac

SHA256
24531a97f4177b0c90ece5da3e4ac5b15848ef76544872f87afbaaa64cfb3e3b

SHA512
b45c1f3e356aa9134cbacbcde05fa4322db1b524d9201b56cb39c5746e6ab9df64a127906932de290753450fab60c1bf30a00f6239438576fd974fbff33d5285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d85a3e5a6e91dcfe56097228845ded50

SHA1
563a7b53218bba5bbe2bb84784a0f7d29f271467

SHA256
b672a3875001c7d4fe87133cd722dbd29dc9ab9c44a54b904f93b06bd42e6154

SHA512
bc5acaa541bcfbbf9609bae95abd1ca29aa203777bb417f6f43888f9b04a803c30ca26f487c945fdd53094c84ea1a093fc2c0665eac1ecc8fca615ac7b8608da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
628c6b54da37b44c490b0617feb9a253

SHA1
d2de72e915fdaa4333f9ddf58b28f0474e4e8436

SHA256
642d4d936c287ec64d2d67fc260b1fe2329a855ce275eeac71d7c74d7f88ade6

SHA512
da549b1e5b8e9ae15f936beb26a179249add76c7da59183365b641a78280a06b2aac6c4bc635e92aff209a8d87f89b6d50c46ba4c8aa48494b7b354804061d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6dd4ef9f1d045f49fc9b7b34af037133

SHA1
aae1bb811f59b42ebbdf4d9b9945f7d8b9fb13c9

SHA256
3c2b676e12bef6312546578331a56ec62de28f2d402f27379785550512be997d

SHA512
7512e854830170324661d1f5f2256d213d5bd7c4a80eba1385713d6087b1e288232947252e2ec83fc9e98703241a63f30e81131862d56b7fe2e36a53662e0c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84D1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit