75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe
Size

4.4MB
MD5

3eea13d1e67073bfcb4921357a8d35b6
SHA1

8590d071e20859be185e2fe6d6f25031faa0c34f
SHA256

75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008
SHA512

4fedcd5dbcb3de5e01b1350c1d0a9ba84887e932da7bfeb08fda61bda15a1658bc2357e7e4d708388d57649d1c62af92c5ff34641be3647c750a30dd75c0e92a
SSDEEP

98304:y4b2z4rbzKrdSZI6Iwp9GuOgC/Y1Vb7+f1vNXuiDID:vqyqrd/gpxDC/YbbsxN+iED

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000045a25eccef0b283589baf5db934dda2c00e8e04c1e1021b2f419e8767f2ed7ac000000000e80000000020000200000003d944d71c4c0e19a548a5407492654adf317c7d4a6c7a0aa8b749ff4ef287c9e2000000047ccb590a4d5212c99ed326b4122121c04f906a6742ca647592fb301a5caef83400000009d12738110f8e37e36f67af5e4a7b20bd55aa9628757e5f77e34f429e6ef8fdad8fa9bdf6c43d18510bbd6fcf7ebc97391b1de111585725c6ff20c8407840f7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000ca08aef858a21f7d4b8af22c1d71298bf284e42add8e70e71680eed03da0159000000000e80000000020000200000003b2dd91aca01290827644e8792494f5175d1e4a5c5d87fc9a66ff8dde602315b90000000dae36b9b73d89bb2b52bcea40854831553a4f4e4758cfbfc726ad078bbb43a70da6d83936242781d7e2bc02c1eca623156d3b5ff0d028e1b695060d5ed0fd112020a6823b0ddf649ad4575e77a2a409a90b8941cea05c9f1519808044938122185caebbdd4501fc4b170ad1f5dfb69ccd2f33c3e91289254ac4c68376ddd0ed4678b6930f3853a6eed2ee5ba4e7304cc4000000061ce003489ed56740dfc5ce6f386964f30c53769d50eef629b96287ede144036c6d6d336b2741771b256b39ce2b09e6d7a39ef7b004f2ff0ddb08d6930ac0b1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419997524"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ec30841d95da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A934D091-0110-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1628	1640	75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe	28
PID 1640 wrote to memory of 1628	1640	75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe	28
PID 1640 wrote to memory of 1628	1640	75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe	28
PID 1640 wrote to memory of 1628	1640	75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe	28
PID 1628 wrote to memory of 2776	1628	iexplore.exe	30
PID 1628 wrote to memory of 2776	1628	iexplore.exe	30
PID 1628 wrote to memory of 2776	1628	iexplore.exe	30
PID 1628 wrote to memory of 2776	1628	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe
"C:\Users\Admin\AppData\Local\Temp\75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ni.com/rteFinder?dest=lvrte&version=23.3&platform=Win7_32&lang=en
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2170ed7962760a3d9025f6e22b50826a

SHA1
32535b7546cf0aaa40fce2b8485e9ee04e49c44a

SHA256
7de749ed73f50a7b528d182fc3baecab835d663731e8b4ea7b0322db5d68f6ec

SHA512
91ddeffe5ff43d1ae0a282cd336f64e95dafcba05ea5361536043c285db8097aeb01519dd1018a2f1a2ee984e07111d75e537c47ca78bb60b4bc444f058497d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
096436f1cebe4f58512210ea327cdcb5

SHA1
dd990c7e4a01a4f27988aedf8052973466f01219

SHA256
5767df36e84300b7867dc8181b43cfb5dd60d5fedc81e7626fefbcb97ea00f15

SHA512
3702562626e8fa925b782fa4a935826a04012cbb7683bf6c5b7b142b1b776dd37d37d73db5f6cbd0f5b117fb231d8d3a716b8c880af942ac92aaab9ca39751bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4b1abae04a5778ae7d8dfe734e556b

SHA1
e1854a847be31177985184412bad1029cc51935c

SHA256
8490a1a36647ef8751861d1d4bde1a55034d0e65142553cb90c7019b7cb3c52a

SHA512
4b5c80637c49d570af18fcdef369620e936d0c8bf5f68a72b31cd2a150987e9e1da998f5bfd6721c4dce6babc4251532cb498f22d8bb1743052241b77061ab5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2821404a286686b546e2aebeb3e6fe8b

SHA1
5d6509674871f637f0858516701e48371940a102

SHA256
0391bf093412e7825222e770a28e255d549cf23d68c037bbacb920a9e5792354

SHA512
65a7713fe5af81b17142d51eeb988b205cbc03e3cbed8c9c765411f6022089486f66b70a30e6af8b72790e679af57dcb9a8d80b824fb7f86470b1cf3e704a23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce2d1aa6537ff3b597810bf3ba10fb2

SHA1
cede3884a13b72d93a9e9b480c96de4e4e94f62e

SHA256
92223995e492185c3833964400e2d75ba88413eb97b3f806d869d58094952a01

SHA512
69fd2cc5bdeb35661074aed3db5d26298ccf0893736abe3dab2c5db74c66c94b6a5dd9e0b344cd4585dc0598db641cb6ed8e9e15f567170fea9398b8ca14fa3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b1be255b6aac8955ed709750d47834

SHA1
1bb94f70b2e25b465706b9eb5295d02dc3f3c53f

SHA256
7b0cfa756064944372811e881db7f3b6001a591c54422fdea70ca9bff5a6815c

SHA512
2a08518877e20c6feebbc1350b0f7c17c6bb2ec017fbf591121d5fe0cef2c54cc5fd493480bf070422c502ebdb34046e2dad4e555cd522ce67ad72a0b6e09480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67962944fd1c344fa657727a16de28f6

SHA1
7c0a59a0b84570d470e24554a3019f460e5cdd6f

SHA256
5703100d3514b45663c5095ce3f02a1e7331b443e8aa8be28edc9d2644bd105f

SHA512
df7b0b6fbf78c025e86e05febda7b652ce60e5bafef476a334f508b3891a9b116446dd862a9f0932447a22bddeca664cb685e8e55e771367b8023e05d95cd930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005373882bd8d6ec7f4563e3b436818c

SHA1
c24f94c9c93e914824c1e6cc5b15c397e247275d

SHA256
80c676fbe26d023fa98513b3f2d5e454125fbe908056799bd643ffea66c7a768

SHA512
7a7966b26c6526b6909d8f61b23322e86ce9d61a454688c516719cd966c2071a3762cb66b8fb77d43987035f34cfec2d3ce3a131a476a56195ddd506c4093ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a581ec5836fa2dc694eb291dd3a808a

SHA1
62db179857975856ca5068baaa426d3543eb45ec

SHA256
54a969b9b55ed1c72ce5b1e0b8b1841eb420ea737785624020539ef8d184b497

SHA512
3e47b94d8e7816ce750b3400e1d2402b64d0a05ab13c247ce3b519816598a757978e0462e2a4b1d8702c21a380da9569f391e4573286ea46c7aa35e69c164e54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3284f26aaba4fd5e5d281abdb928cc6c

SHA1
cf083a6d7756fa2eb49f54b740bdfd8a4ca16743

SHA256
f4f80bffb6d7e6308122099f60f521608c9b38dde2108dbadb6012192d233d7c

SHA512
d76039058e0841e90e52d06a40cf2dc6bf078bb9aae37c7aae3033ba5cdf50a3d7a38610ce1f8843fa357a0a97e39a806734a338040d66e833505ea06590808b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb07f546953597867b0e499d2db9738e

SHA1
97b443012e0bfc4747d0ebb8e418862f00942307

SHA256
cc640e158fe04116d981aeb0ff8dd343d5450c78df8cccb59e5d888d9fe3e5b1

SHA512
744aa7c33013af033765c29731e32fc13214c9eba886035c31e356c19736de338b30c4810d4219f2260577d785c0eb3733874f24ba152855e3b23f30ab7c9fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9429a21980d224960e7f957eea4282b2

SHA1
f540aea600994383e1130b8d90dffc51af5cc08c

SHA256
d6e82db4b218cb92f526fac47aab1b1c1d137f52e23d8910d1223ee5760a1833

SHA512
d1df5ec0ff9cb24b9034b3549f6a9fdff7ca482163b2eb7fd9083434f5262ab181a7c7893a052a6a4479c59f52cb2b9598c262b3e299286af175a2535d9a72f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61d79882d4d27a50630148bd0eb67a0e

SHA1
e4fc84f1d52913e42652a99f8d9656d8e141f3bc

SHA256
3cad52493c606f19d7ec2e7525df48e521045acec98fba5dff1ccfed82fc5416

SHA512
3602602f0447708c7d3f06cc2710e311a0dd8073aeee336200fc6aac8ae3956ca13ff3fdb733f6cc089febff543ed3a372415f44199463a46390383f123ed9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7322ec73f835b5605e429e3409866e8d

SHA1
db28b2e370de016398cf3df3378fd551c55ba7f1

SHA256
a94e5c7ab18d7f0091a4163e7094b5167e3768d70f2344603ea22b1936aab0fd

SHA512
17d3ee4031237f1131f9be63859187687ea4ec2ab79d3a5deca2bbbdd3207afe891b82b2e4d1277bb3ddb6a17c108485f8f296389942aa772b8f7ac2247b680f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE44E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit