hxxp:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43

Analysis

max time kernel
193s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6073e310bba5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C37FA91-11AE-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000de21d02c7e53569292fb523a5724c48087324936d77a819b576d368b3e8d45f7000000000e8000000002000020000000864358476cdad18041278c7cd300d17609fe1187f3d8f4f43e36947e05755b422000000063b1ac219844d894db2855a5694ee58afac3544bba61330ee592ded65fe6e143400000008423edf677d3e516fed5d706fe97f422a788bf0bedef52168a80f7d63fc189dcfa13a9c6e760546f60e98342a11ff197f301220e4c1a81b0ce84b260537aa434	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000abecc8955f3316ef03d8cdfd454631702482d1a5bfc3fe201b998c95156ff0c8000000000e80000000020000200000000b97518d8f8c61421b2f6e8d38dbca6e1155fdc9aa5e2b1c9ecd51f6c831c6d7900000008037409e2016972eb79845e2136b699607f201e55cd03a5c8043e732709842fd5ef23aa07dafbb90563927d4bcd3f783c5f2e700ae521a63294afb62820fd21d7bc414dc851608872bc34a6ce560febcf37d2fdb6afb3cf7daa328e719e7d01386eb2d5af4c64a38cc17e4ad82df814a44748f381808e6375d15ac129c85892807fdba83012f6f8257c87f660159289f40000000e4bbde5f6c770e6e206c3e50be3a0161ceb6b76d61f79c9015c4b200468ed58e55b8e7bfd14c351957beb531233b75f945d0e2820e2c59e13b5038497e0fec25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421824418"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/5942143614d8ed34567ea472c2b819777edd25c00b3e1b13b1ae98d7f9e28d43
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f77a098c6d51007bb98c2b8340a314cc

SHA1
508a7e70a608868f1a45f3ac3a5169547424daa2

SHA256
ac66b5360495d1966c94fde37d76e1e176b15147168947afe0ed9867f2a4edc1

SHA512
f987e0ae7fbd261cdd2a75ba5f7b6a0445091c00726552d1f4f9005cef6ccb119b22e063dfe44a8b9174ef7fdde9fe71a9ddd8eafc012493d38dca5f654949e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feaaa0db09b1d73e6c315058aa93c5ba

SHA1
03958f14eb861ecc8355efcdd80c8242439fe3f1

SHA256
b74f0317d134b0fccde52d1da1a6bac109ad12fbac642e2e73f2c5e79c00c3e6

SHA512
710965cfe439ee20aed673eec7f4514509aee23df0a2cf256ba78bda9b835dafd1694ca3d7f8eccc661e72dabb2666b4d249fd38be4b6f45d18a527900040a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c05756f6e66b0c829b7ef90d7ef48b

SHA1
e37541afbb52ad29dac9770db19ec6e5624a993f

SHA256
8b398140f60f811ea6bde6d7683dfd2ee53ffaf2a7d9416f3c117d8e0149375a

SHA512
e71d595ee29a18d08de862df50ecdd14faf10c2158b8f9cec3ea03bd5dc7b4e358b449d7815f5bf1619b269e63373b4a06cf02d058be2f79eeff8ec0adef306b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
745ac9149317beb41503524373bf2915

SHA1
2b9fc0b722a7923adf08fc13c69d8f95213c3bf3

SHA256
9c90922460444cc6ed2ff8330cb57305a38c1283a54b3af8b44b5c96b6cb1401

SHA512
18197e968e8ab19bf96602a9b08709fc03de62f42123df8b1cd61a456f31c3bb156af3cdbb54ff6555f0e067e1211642bc366ff94382e5e81a5240f14f9a4780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ee69a2024711e8dc91517c14cedeaa

SHA1
53a2b45402d8ee022936bfa12e87a5e87db99e34

SHA256
8b203d552d1b7fcc00b1d1cafd7ecaece7766de9bceed16d880aa13278aa860f

SHA512
d2e9949b594ae7fa72a5219d76baa01fded46809afe962e004082d6da701478598760aa2edbb49cd593019b5a84d5e97194645b7d3f81a9b45f755a38cd10f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27e65251c97a2d229fac3895219788a7

SHA1
9974f92aa24623475ad56326b83a9c67730a9f3b

SHA256
d7e2ef39b5b89cdf9fb5937e227a4ca3c063032da5eca462126b6ac246a0cb36

SHA512
b617afd97be74f4ae2237906e81c93d5197da2b7bb17e5e4f1042e7ed8616aa0225cbeac6183355bc6f5232762cc5ecd1eb5723a9798c54534036c3a5d1e533a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244a2a4ed77e8675ac1ef120a3be582c

SHA1
bc100da239b695f9843ccad196ff796040d26e7a

SHA256
c6d4cfafe972a059394c7cf0464ddc213fb81a35c2045f6f8fc97652c0df14e1

SHA512
28bb04203a41c4e0f415956ac3ca20764b64a7dcdc54a9ae88fa2be9c25ab62bb2fc3cef78e0cdc9af0b2977e083fe3f8bd978533b174570fe240e39cb0845b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a623c38aa6753468a513a8bda0c155e

SHA1
f07e92e3a6cb421e6a2953a0d2da270932856b07

SHA256
937250d2024179a72f1edbd655bc910547ce3c81367ee9e15789aaa64f51fd77

SHA512
28c45eedf1657a1bf36ca3ea9074d6348850c33ed0ec21cb39f35e55a55c92c694dab087dfdb108407e17099e717798cf559ef373b680f1d37a75944905ac6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0122fe241a6b46f27a326af3854136eb

SHA1
37bbe167717bf60913f794e6eef020ad317fa264

SHA256
48c5e6db6162556f6dc904841b96fdec157c657812749b09893dc35cfd190076

SHA512
89e8124a62c48666f7e6ab13543c9562772a0e613d68e29c4ee95db08f73e48c9258fd5da92f7a8b459aae017f0773053cee1566028fd62e1aefe79ea95f88a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54D7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit