2b6e5d60e616a2cdf99a725c1a63ad0248a8413f9a5b2f9280523680c073b8a7

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MQ2LootManager.html
Size

11KB
MD5

52855eb2ae71b4fe482e2b7466158ba0
SHA1

f5351295ef413b4ba83c5a4b7947b6f7f310a5d3
SHA256

2b6e5d60e616a2cdf99a725c1a63ad0248a8413f9a5b2f9280523680c073b8a7
SHA512

c703051f9b550d835bfdd941286cad0d30f01b61b22f2923bfde98fad1fad9dca5703b864f30b4cbe5c6fe5bd971a7d6232e102b4913d81e8b427f55252afe55
SSDEEP

192:HuocV0O81lKPDXRTEfzOwOxrVyTKLeFXNKe/+x/QCrgn3scBlJ+IkjECNHj2QmAZ:7oTwUrBQtcQjj5B5f9XJbvxG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000375bd5c2b03d3442bb7e89ddb7aba55b00000000020000000000106600000001000020000000db7240445eaac8db6015b3dce5c2fb63b743203417971a483d1a5cd428ebbe86000000000e8000000002000020000000c48cc42fa12df4aeaf1b148334d23e4a240bc54c5f7b8987cc5a65c77b55f09390000000a9b0d80178c9779efec25616352c2ae745e05b9345f2ecea54cb0600a28f2a8b6f675fda896707e02e6d4c7130edd87081362d18e5f3b2ae132f677aa8f8c011e2403f1495258c014a2b5ecbeee55ebc55c7e3638ee6f9d6deca8a4571c7f471ac2e8fcae3cb0d2ff64b8b036c1e1af6c4f4f9b6b2732c30e3a3b917a144b86f2a081671643ef05d8861b6584734dfac400000008a4521097ea08b1f310bf6841442439acd1bf210cc712fbeb4188c608679fc22bbf6c4f5440216659673ff88f829836b1dc68e33e7de492dbbc643df0dd6387a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422541266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e069591b40acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000375bd5c2b03d3442bb7e89ddb7aba55b00000000020000000000106600000001000020000000a6d28bd955a60429009d1e74afb71b14a44d941550fb251b11dc2cca0c747c8b000000000e8000000002000020000000690d2688ab21d24d5aa2d697ee6d090ebef608c484828663924de55101aec81d20000000dfd00edfea2668bdffa8fb416f3b8b3a1bde404958ac7487632db930346eedda40000000a8ca9d7c97596c6e45d34a6d0bfa059b5bc421b94746bdbffa65dce859c093d9c986b461d78d58c2f26bafea056fa39292941ce07b54897ee57c92691b166f02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46D67FE1-1833-11EF-8356-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3016	2964	iexplore.exe	28
PID 2964 wrote to memory of 3016	2964	iexplore.exe	28
PID 2964 wrote to memory of 3016	2964	iexplore.exe	28
PID 2964 wrote to memory of 3016	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MQ2LootManager.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d11a0804cafc02e054d790bc94b9bf

SHA1
a917ef5789b9e3254be45e5dc5e5054839250127

SHA256
38c060668899e6204bd62235d109087432271f8cc79363db3af89fbfe58a4c8f

SHA512
90a18301c360caa857d4c2f60c9e3d5d497a3a752f91d8758d6220bcfa8b6bd9542f308d66c48f34b69535a9d67d661f4d9d0d67a44ea41248f577dbf14741a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dafdf8879277c185e07c1c411f4a989d

SHA1
7d51402a97b5f483e3bea92c0ce3535a23829ede

SHA256
8a6c8fd267363fd8410258627fb084471f6c2b8a77e6f750ee002783ea284b15

SHA512
ae5d8b8100c891bc1893ae3ffb7cb0a38bb15fa41fb69a3346a2ca4342b47cb827d7db5754d53531c8ec8ab67a51aeedd9b99758c477db3b9f9b72ab4f844685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04f48fb49790918410a92fb481cd2a7

SHA1
d86993f1c3d976e35898e8999d3b25d7d3f06c23

SHA256
e25180c8708225c2808dad9caaf5f2d4d87f99746094b837a9b57e957edf663c

SHA512
6cb29c11b8baa6f2043a7ee327c6a85934e3f5c8c4897f486609dc71e0fc4fd2dde160f03d45e5e4e807455245e4fa4ca7ddda7a6ea8b68bab213fa64020b23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36dd01bbf60e7ee11e8f294504a839b5

SHA1
470f28fe01ee4da8c762796c6c4f37d9db9854b5

SHA256
c0ffd9580e518dc9fd4f89cea93196626b5b7ddd6b5f9b3ed2d7ab2d08445b9d

SHA512
c6f7f033787939e97ea4fdd186fd98198f7c57dda9f113efcea06e098aac8e2307b8c6afeba3069b581e63b2e04e707152fbbd833fd04f8344244b0e12f89fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d753b957f6ad26f93cffeb073ef49b5e

SHA1
d3866015c27227fcade1e8921cf0af9d9b0faa3c

SHA256
7ab593710749d13a9804f69c9d5a2ed61d5a8f535778c08612543ef923aea7b3

SHA512
9302fb21f99c8a79fabce42b7a5c2a6a209ee92ee12f1e4ba3c8d1098b609937d3810be405fc58a83706dd271389ff00588c2ed1b2c4bf7ae90d9f629d83d10a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75250d008f9be766321dc93c9180c37e

SHA1
494e7a54f8c8dc9ef1f2bf67778bdfb4c267d47e

SHA256
12d3ed493457bea739fd5548ea40e3b5cfc0238963eac74e5a9dd6f62cd0eb56

SHA512
140443bc0ddff136b391b06fdda882ebb0b326548e925d3bbf4c6e495c5519b71ec5b796e27df54c0c94dbb87995b4bcb0a3dc7306d7a9fc88e863189e3f41c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e306d4911f500797f06a5f4840d7ef1f

SHA1
68bfef4f8067a315b42edb540eb1fd633dd58cfa

SHA256
12da9497ed3ff41400d4bd19ca42ef0f47ce46e90231ee72ce4011cbfdcf30ee

SHA512
44eabb16f560d8761d84b638b1833ae9766b744c6d9b31d361ae87a2c1bd734f3a93eb20df6cfad73b0782e597824679e31d278a407707638035e3c3e63463cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67069a22479613a78f9a0a80aa84a2f6

SHA1
397a72bb974e531daf4ec63805c964c7a5f50e14

SHA256
61db999bb467a4c308cffd9a9340e34fd9e3956e17adc64389cd3caeda3865f9

SHA512
aa567bb7ee80e512283c8dd6c2186d909e1800237c56a37f8b1d45d31f0c0386bf554d15a6e9d8bff03a1763e7287d9e78d1afc5619c1e4b2fcb128b3569d5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408da59e9938aefc8dd767baaae7cbdd

SHA1
ee658c9046c8048b6c486b615eeaacd292b62f49

SHA256
667b65811367abb3902ca3a8135cee55007490baaf6107adce5d8a5a2964e4bf

SHA512
ab14b7475720e6a47a31a2a595f9b3ee3cf4f972f6b9c45b1e7a76ba42d54e7a3e3cca92777a982b4584e7ac0d45feedec1e811f4b037ac830bc86c3b205a3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7095dbb46e8548d7aee90213ee1a7be8

SHA1
15cc5740d376fe8d5bc882920c10e4d2e14ffa6d

SHA256
cfd1aa502e99dd88e263cb6edb9e5fb8b352db0a860c0367a908272481144007

SHA512
9c5511d6562b80a089246c059036637546f2137b2ca5588ff82b102bfa111b95aaba654538cd99b68be608b85602a1868568bf570bdb6e4d2870e1f806e86468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5417275e56a40e703ced358dfebb5d6b

SHA1
20edf154db3b2717630f66d1e9ee81c1fdd016d4

SHA256
f40757a655307d97fc64943e901b0a111a3c3f282883d5536697a14880e0ebb9

SHA512
ada117d66f119fde1d842d9504985ed070bc7f285021611d1f3a363a6b758bfe88006b46c99a8186e3875d581d91c3c8a14957a96b1c40182f06ade2ab0f446d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
557f551402b0fc40e0b10a4f2adf6a0c

SHA1
c5242dc99e06207aa2c021a7b8ddf72234846281

SHA256
96f093016ec1c442b57453657f62e4f70e0a1436c32b16aff405399a9eadbe11

SHA512
fddb7568f5f92d6c5458f15589fdf8cde7cecdf0fcf253b33ddf66c9e77b2deb3471c407347ea7fd03535f455e98bb1c4b1c7ed170ab207a996a786fdeab6253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45b66a3b63f8d2519375227dc8b7152

SHA1
33d743056fbdd32fda1eb13acc1ba596af47980e

SHA256
48d790e4b0f987f53e9f9e9121bab83397551820de802b22a78c05a0f04e7887

SHA512
28b473d64af9992757f1e95d88f5064d5ca7c98a02b178bbbd2f8bf6a6173949efb77d1d60f3aeb0d261ded74b2efc96b068090cb7053493508f400e90c53543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b6c0dedefa5fc18dbb36663f97dee2a

SHA1
605391f2b211d6aa319ab7b42d5ffd2801cce4dc

SHA256
9b7026157a6bb5246874ec7d5f13c97ed404bc35f3852adc0a8a84a84d2cdfc7

SHA512
3d255dbfdd7ce23c284477d24c31b3f8946534e49fcf6093ba9cdf938292a0205181e6c9dc497ba18da47f0ac028209f0c7067d80b52015c1361ce8db1ad56e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab254F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2650.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit