0c0795955730ac1988aa527cd4dc21d9c8ac7ae9d4837b5e63f50e870171ec87

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

software2_17_6_23/lua/Site.xml
Size

5B
MD5

ad42f6697b035b7580e4fef93be20b4d
SHA1

32faaecac742100f7753f0c1d0aa0add01b4046b
SHA256

0b8e9e995d8d77f1e4770f0f79665aee6f3f70247b3735422daba73df4c3096f
SHA512

225d05b918519458a8fcc1e6493a4e854c004da76f6250b8f52197f47094f71ee984725c31446a1967f0d55f4dc74793dd44d932f2bdf50d77d4288d663bf1ab

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a4a5aae695da01	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420083933"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008b5726ff0b0264338e457efb42335fd3590f92b9a884fa89893cbccd9c603192000000000e800000000200002000000060acb6f3d109b754ffbf60eac5c9ed625b2262fe2ca8d0a981a0a50655aad39290000000ed8974e09c9062d54505a1aa2ea78f6158f80f4c132636959a486e3812fcfe5de6afe56567c15fe4681615f5006fc2cb6e027756a0cf3dec39319c0655d325c57f75d0e9b8a98c9ee38e670c1dfd00e2fbe4c5f6459f0d014ff8fb35a15b1812e06645d203c5466f6cdf45cf8a64dcdfd3a8b1541e915b7734d169e2ac132d395d13015fb0d605ad5bf5eddd0425397c40000000c91ba05e0b5e27b4938cec28787b9e85ed8159a781da7a72f1d56bc2143f39e587fd954cf6345219861802511b5c08394c1d67bc5186e3b59a846a29ee34d954	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6484431-01D9-11EF-972F-E61A8C993A67} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000fd6bc6232bbaafb969edda9f35559cf93c9d66e3a80823044b8a2b1d45f1cac7000000000e80000000020000200000005769dbb471b74f2ecdc2bd688b30ad8f7e74651c4f7f4b3dc24dcead23400d2f20000000cdc25781ebf31da06692e9f07534f7572cba1d4f088d03003ce01ddc350505d840000000b078c1c1e07e1c7ab9168404ce6fdc7c216d498118d84de83d8398d623ce586f5fae694f89e843c82202aca62631919ff9dd7a8fd8d006ea765848daf36d7e00	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2368 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2368 IEXPLORE.EXE
2368 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE
2556 IEXPLORE.EXE

pid	process
2368	IEXPLORE.EXE

pid	process
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1940 wrote to memory of 2968	1940	MSOXMLED.EXE	iexplore.exe
PID 1940 wrote to memory of 2968	1940	MSOXMLED.EXE	iexplore.exe
PID 1940 wrote to memory of 2968	1940	MSOXMLED.EXE	iexplore.exe
PID 1940 wrote to memory of 2968	1940	MSOXMLED.EXE	iexplore.exe
PID 2968 wrote to memory of 2368	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 2368	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 2368	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 2368	2968	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 2556	2368	IEXPLORE.EXE	IEXPLORE.EXE
PID 2368 wrote to memory of 2556	2368	IEXPLORE.EXE	IEXPLORE.EXE
PID 2368 wrote to memory of 2556	2368	IEXPLORE.EXE	IEXPLORE.EXE
PID 2368 wrote to memory of 2556	2368	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\software2_17_6_23\lua\Site.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23cfacc6248894e762c81bb67199d55b

SHA1
1ee40c9a23e6c8eb92fba56c9d3e48167a17e84c

SHA256
e7563b14497f263d9a97978bf3fd94002900692fee51775d1b3f51a6b0823569

SHA512
37895f7d0053e189db1d2e7809d19f4865428200c29bd5c58a3ac2ded06a86f4354e240a40838ddc818f420de1ffb732e35b33cc3c7173ed21447c41f4a84d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91dfe6a10fdd68462c91df8e18581b8e

SHA1
6dbac3de6b5bd078d236b4d91869ea3caecfe91b

SHA256
c0097e7188af14c5f7ecdee5a0669fd23c77cdb46795a3a523ef2e4a1f595f84

SHA512
7b826e62a4b3e0988108e227358b62c3846107b1c9049ce8e8f937c3d2c5af7588027665425496f124ac45b97a25a181102491da76da4d8eca7e9961a730046e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62087c81b3460c971e5342d4aef6cb9e

SHA1
9fc9d148163629b41633cceadec62613290c8287

SHA256
fc40bf142881f6e2559fa251af98ec6fb5d2b517247d9bcad44dfe0ce6ac7975

SHA512
d3ea9667162c171d6226e6eb3f760dda4fd8c98fdcc157462de87dae1586e264e13ac8343bfbf22f9c31a421da1c42b580815298fabd5ce545096ca56b2bca21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51df52287631161bf487be4c0778590

SHA1
08345cb09ff3f24e8117e27e3c99dbd72571c188

SHA256
46cc86163762010b550465b6f637fee58ba5fccb2eab685ad0a737c28145d233

SHA512
10fe188c1d165fc3ff26b98edebda14aa6148656fa60b1507c046257ed0d54cb8ea0aee09549c955c5e3dd7ef221e05f28313a01df8447f98aff6c8c19e9ed0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f644fd38d345d187afae47acdc5f6675

SHA1
57a49efdfbac00a3a123b508ba23f5534fd6db78

SHA256
6a59980671e92e11fee31deb5609e088626290e65d08d00f26a97a87725f5b6b

SHA512
60585d4cf1bb70dd29fa9ee857b6973ea056f1886af0e5fdf1a7bd80c9024640014dd2c2d2249711d94f572b51aa77bb5157651bb18dfc302b7500d5cb87c7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747315d387b088374b6db32b60cebb8c

SHA1
18540830388473d36a0cc7b1b10cd74aab84f46f

SHA256
51b89e1941cb5e6bda8acc0f6029c7d35e0395e4fe7066e2db593a979d60484d

SHA512
f4e9a0717de68d72796b42a5ac739b54bc1fd1882df10d4f16d0da081f32a5d2c07d7d22c9c7ae0bda037682c58074a553e8b2100b25699d9ccbe01a7c1d41a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ad0658d4efb08bc9235fc8106b4e1df

SHA1
9fc67977a30cc1316862f7f6a16c4ab43b0b6e9b

SHA256
bbf2dcaeb73feb5aad7f9754e0ccf0342dda9a2a7d2918180be46e638aeb51c1

SHA512
d0d5f4b1a3f7a88d180a2e2db5aa8305047aabd6f5b79cedddc4d5755fbaeeede33c04abc3abe4bd3b16b6265696a7485d08c61b3426798fd382247746c545b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91dc6551b6d00f29ebee8214534fbb7

SHA1
9de3f420858dc3dc7b6d99784470ffb7987f1b85

SHA256
87d1bd15efaefb09354b42c24b209c365601ca1bae43e36a78e062c6c2cd1bf7

SHA512
14b8f5805dc990795a3d93584d75ddf1af4bb65a15dbef1eee30b738ba5d32b4345271026333a45bbf966592810041367a5590d9035b535db19574935620ee8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91f668346091d2b5833765a7ba902794

SHA1
bb770a666232ad4ba362ee473f13062d399775c6

SHA256
a2308d85b15ef1e106f50122ffdf6c3a059a88199640a251b6b54d2564553dc5

SHA512
a261373aa0774798a0461142283d8c3439209920ec0c647d80a942f2e3c58335d2a4fa6ae0a0d0a766d37b2c9838040012ae35e6f796bb804e123e49b2549251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f459a8ea17e345a626bce3cf870cc3

SHA1
fe997400c214dae4a57eeaf448f0e8ba06ffdd30

SHA256
38b3eaddfd3b49e3fb33f5f5a69357d8f24f68c2d361e9d83c0dafe5d24cbfa8

SHA512
31bb5367f37998d6972cefca31590cf9afa488ed8ec527755efbdf07b5132d1ac451a4a5c9f385b91dd4e9773daa64d4a5f68c2b86522eaff870f63bbd099577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3fcd13905110ecda6c5afac518b001

SHA1
8a8ae02f6f86e8b7de5d13b2acbd965671ece6ff

SHA256
3f5110d52698cf04779d825548298a607ce93054a21c62ecbf09784840978099

SHA512
6050ea60baa7a75cc534bcd48375bdf1ee277023f4b62a8f7b40a32430cf5fa6611e02d4f8c3ba905f61dde170acc9be7baaaa0ce0052e5737fbbfaed5b02ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar301F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit