hxxp:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/d15bfbc181aac8ce9faa05c2063ef4695c09b718596f43edc81ca02ef03110d1

Analysis

max time kernel
193s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/d15bfbc181aac8ce9faa05c2063ef4695c09b718596f43edc81ca02ef03110d1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f823226a2dfbea4162ccd8b20aaddeef4ff1ed37694dda2afc0cddd0ca2b42ec000000000e8000000002000020000000530adef099542dea58571ffd962efeef6dcf3a5510cd297921aea865e9220793900000002b60f10af396f84be8c69b27b2a4b2ba1ad7b29040b333539e2b7bddd5519fced0c45f710f7bcc131670241a53858ea0c8df27913914a29f2da51250ac9a2b12132426f59d11302c863905c6bf33ede0b6e9e0429c9eb121264c785472fee44717639f1fc087b3e4cf07fbe883260ed4c05ab478d564c7a68ed356c240b532ba9d1b9305e36972530bc7b5e7345d583c40000000f033121edf2f920e54d2fb4cd665b453c587f3706f3de98576ce6f53a373a08aca8239f41f2ea12cb8976b695a042c0bdd83882ba9c1b5de0f3de780342e24d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60dbfb17bba5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000764f2a00fdb2dbdbc23388390a219fe396c571f945c527cc4e1495c94ed90d95000000000e800000000200002000000032ade99e3dede87248f4499983fce338b67ca5fe0d617a04d11e063270834d0820000000a549276f9570f65e5792d20a2e455b62a193a1307ae757c62b83a8c8854c0214400000000eec82244de5e40fc0cfcd97613da6183189e41c8cca2db764292f2aa38bdefbb329c1923a7749287f5548415a80d2936d9cc5f159d4ae9a071ec19166c225a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421824429"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{435684E1-11AE-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2936	1720	iexplore.exe	29
PID 1720 wrote to memory of 2936	1720	iexplore.exe	29
PID 1720 wrote to memory of 2936	1720	iexplore.exe	29
PID 1720 wrote to memory of 2936	1720	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http:///Users/mkasuya/Documents/Research/_malware/shared/todaysample/samples/17233746244/d15bfbc181aac8ce9faa05c2063ef4695c09b718596f43edc81ca02ef03110d1
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faff3052b55a718b47fa9d3fdda7d9ec

SHA1
ea6f2c00ad32d9baf05493186631e1ee4da1f53b

SHA256
8a2fbbd18c54680a6a9369ac7dc26bac4ff0c360d0ffc366d8a1b3c048266235

SHA512
c38a83293e795e5feecf55db09d1e912f909b6d93ba4c15fe94914504a8beb246dda046b854e4400e72123e8551643f349d2d56216f3b95ce9d0af4d6ab58dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1134c14bb56d46ac67c76949187cdc46

SHA1
0f0e0bf539554b261bd3d1c798a8658fde3217b3

SHA256
e9a8d44f302250da297560de72fc9ef4a5263a8fd75767216260a629ffa78f4c

SHA512
0b1acb364b0fd7b70afb074f684463b6cdfbfb3be88b6ae4a1d0374a1c1575e900cb724f82fb4f5f32b453c940b0e713d0ed78862a0d24fdce6a96d009373ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9780940e6bf84fec741e7b0592fe1781

SHA1
85be80f828efb89274af844056328b31ffcffe0d

SHA256
c79090cef318bb8ac6dfcab98eb1c26511705831b9f2318a3dbd2b8eda12b751

SHA512
0eb08055a45ac17927bcd6a8ae882811346b93eb195f99f13025cc04997da76ddaac7e29a79aa35d21efb4711d238996adbac82cd16b70ed5ef70c2d551e1173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f27b8edeadbd74bd3880ddda24bb5952

SHA1
5b8cb7a4d63eb42d4fba97c2253ba091c09e9aca

SHA256
90274a2520008bb0deed3f9bb3c2164c566c0779aa4dba74b8941ce3bd380e9d

SHA512
ec0e1734df981ff965ddf78b9373fed1308ececda78085775b2d5e99f641c347e165cdd8c85a696c7f260d0405084970250df7cc1b74d4309b6689590de08151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da395b99b81933fb792b25f55b97498b

SHA1
ede7a5a42be3d403e9a1c7f63f71a0ea33539e8a

SHA256
90d371b6095fd10b0ad150cd294062d9e58c6ff37fbe8910ebb6bd95e6fab2e0

SHA512
0b180e2be19980375577c904d112400b879ea98b2d12ea403670f06c97b0e4a08ef466e054af6985ff974c0b7f79dd209989bfdfd0119aca9fd16251aad5f908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f443960b500515f993818e7f92cad1

SHA1
ab5def5f00d5a660dd4c0786ba6c8f06be56cd73

SHA256
9a24e5985ba904abe83300f3644de7ca6eacddbcbf93348d88f9e292d7e0d65d

SHA512
f06c03c8c8cc34fd4f39cc47ac6cf83aef5a37637766a279f7a8d529d871dc551fdbeb7ba817165458e2132fd0077e5b1fa419200874ac7f46af1906b26aad4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42b01f136555c3d0979ce7dc5a19cae0

SHA1
b2d52d5f9a65486d10d4d6090a3d990376e853f2

SHA256
a1d098888d922254d7b409ab44caa1cd9b0911889789ee8f41a8b6df31481dac

SHA512
b8ee540c7a10f323c1fc42b4fe4b3f4426f2ea09e27cbcdf40a45a7d1666360b44a9d7dbc7a3dfcbc1384ae436cc35435b7bfcd644b7a8e60ec48c75bec18483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad58460127aeb96888b0968967b56011

SHA1
eb3db395be2569e18cd91bf9248a712e60de1616

SHA256
baa86b620b29b0fb215d544a0e575a350fc1be573aba0cf3e593a758dc072b27

SHA512
2c85a0926a166e5b4cab0e1fde1bdb75bdc2353ba7056a0100c1397f929b7c17ff7bff2a5a2e1917d842a32649ace9bf2c1de7c1ed759dd1be1357ea460ab821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42d75bf5a48d7d846a72fd8e337e9df

SHA1
5a812b936b892e3bc017ceeb95f1c196c0c8892b

SHA256
6afb790c6bdca823d804bbd0979475dd3bd0c20134bdc22ce0f4899052a1dc10

SHA512
69b5d07443530e5cb960a614ec3b34cef8a55a0990a025d0fa7c1a82a9d63a5d5e8af6599b633e07b57836bdec361c416a7a8d2ad9d1556174d72e59f588cb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18fd6ea9fc981f1d5887ff719fb679b0

SHA1
4493ea5006fe7e5e18c8a8bfe088c728eb1758f5

SHA256
ce1a06d76ed037d32c8d0065ef42a5c17d2c3bd6fe6489e90d62b1482761bae3

SHA512
d1735d84b870492e1a13783c229daf3a7e9e70223503e2e06084ddc97581d97337fe4fd8888d0c8043221c2fe5b41402178d082f558ddfe4cb5b66f7f04054e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f6afe0635af570a33c67c38f627e76e

SHA1
8c021d7d87365b22d54260403758689c94e07a6f

SHA256
39d645681c34208696946e601571cffbec9290a6c68c7e9e3907aec6f6ae94ee

SHA512
81551b4c74527bc2f97d729c337d929cb18d42fd311667858f85533b0a5ec17aed15cbf0c2faf37f32f7534228772514f1430b047e9a4df00f0d8c9c9235fd12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e04c4f8e9ad8d298cf188c9a07a1f48c

SHA1
ac0abb0d98e285ebd3d60e668f7f1bdaa14bb0f9

SHA256
f38694127a0de5a5232b15f56c96368dedbe487af6654ac2631f6930c01a6f9d

SHA512
caa7364d1a5571e2e21646f741cb046a0b109e421e992e247677e2f61b6c9dbcaa10a2d87d9f011ba4fad996ac2dc808a93d528cc748059a01b19cd98c6d0127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12ec1cbfec01d62b1cf19125b47e9be3

SHA1
f3390df4f2ee4c77e57d04d762d1852a81d1b96b

SHA256
e032b78ce9fa2d2be67baebbe224c06cf738d1a9ff10608ccd6e96c6baf3f65c

SHA512
65e98ceb4993a01cd19c00639c203753d55b4fc45fb0d0f5231ff1f2638af7ef98327a4d432cd09d8382033cf2a00e7bbac8a27cd2a86cdef45a21c8123cf281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85a01c951d76670acd65aa82030d193

SHA1
6d8e4d46c5c5335c8e2b09c1794d770c71efe177

SHA256
139e0478ede4d3b8d029b22c5f8920ec00a7c25c595fc7e28adb9c40d34d77cb

SHA512
bf725287af339fe2e9cf10761f876f9bbfca5224136987fa4c4b7683cde001b028f365a9263890954118080c65898dbd6a4c690413c99ae2a1db26241ede5d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9185a9da394920be56edd45e82ccfa

SHA1
84135a8c76076a1cd654e1d518e0d2b35b3281b0

SHA256
fc5e924ba4e6ec0fcdc0e5c8d9a951208c3e5143ea301a13aff8172f6f29809e

SHA512
8c55e17380ae5ff512b0efe2b2018076b298ba45dc64e1d84f812db57aa35018d6a3010bfaf7c87d0990f837d4b58ec971dcb8654d3ef1d3ba1c0ba3c79ebdee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda36b277f7c670e74ccd45e524db9d8

SHA1
c359f76e9c701d474b5a62d51bd29b2d588ae448

SHA256
86d7d3bf07931e14c63338d234f0ffea744b78a4363abfe2c3a6614388d14cb1

SHA512
c31c3541f24a242a20017e082f658d9a31afb24fa962b3f4c5053d01d752f3ab52acd1a7d8cbe118700a9f77d732d6c50dc32ab1b2dca103305e4996e5ef5272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cfd27b4bb45d983575518d7918e35d6

SHA1
bdb80a1d129c5b70e5aef1ca8518254643b6d57e

SHA256
5605824723576c185652c7e69ec31bc27f4d816a8e524e901359a22f754aee50

SHA512
2b73b712d47e4755bb8dc0b25d67e846f1a221030bd0845df5195834336bf2c0fe6ea33d6646c432b69b2589c8fd6288759045a46c1f7a3444a0c38edc59408e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed64d022289b50d3ad9258f3b387c94f

SHA1
898b60ece192947bc75dd9d85982cb6b398d2d4e

SHA256
3f0c7329cbcf1d137fe5be6c8121f2c371e8d19c1de641c2bf4386b068000eab

SHA512
3f5e5ffa388daba3fe17f7a02814377058626afe85e193a00b2a3ec7b544834ab1cd19114911989d736deb37ff3c045efeaa7309c0696dbf15e19a18a97561bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30F1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3144.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit