1a9028554253860a04c30fc6c4b2a18fef248f334c2a30c9271b6741f4f1ed76

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AssemblyNoteSvc.html
Size

8KB
MD5

fd566b0df79c8171987ae25ad771be20
SHA1

87bfa2a0694bcde33c9f7d46256d8ec8565abddc
SHA256

1a9028554253860a04c30fc6c4b2a18fef248f334c2a30c9271b6741f4f1ed76
SHA512

cd2c1ae71fe307ad188333db149b93bf3e81cd036c6961ed377ae9073cf7078e8ec5e7a5c7f92014fe03625f9d64c6a27215f93fc8bc8cb8760d31cc649445c3
SSDEEP

192:oSFNVM9OAOUdDs4JAZwm8KBzbj2D4sOSxkxXns:6ytz/2cs3qc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000020528c4cf98ca3a7a9b7b3f19c58ae0ed93c2f434abeb8e975f159ceedbd301d000000000e80000000020000200000001b24079cdd55ad6d86572ad51561386f6cc6cc9a4b1a52998f18bab98dd8e4009000000033edf397ee1669655cd260de49d330c75ab93fa0533c1d5fd59509b039ebd9daa291a29ff250b244301e0c7fac79481b4ec23633a45eb9ee5ca712d220710e736a8d97e989cf339c75e2b91d55ddaaac514adf88f3e18625d07a4fa32f518dd2528226e2a1031e092de5bf092896bfc16dca7329e9baa02cc95060e210e9f295d4e2f6501a3cf73025ea3efab8acfead400000009dae50685368f6a0cfb027ed484fe511b49b01d8f87be88cc2311abe038ab7670abc4ff145901dd50e388dcd9b41b26f74124ff036c2b273765f8bb82cae8eaa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42702581-1A92-11EF-BA8B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e7ecb05c87a0f2140c7f282afd6b14a293a98ec2ab0b296dcfa9d0e40ac0c908000000000e80000000020000200000005a95ea9ac7e2e409cfaaa4138253acef7b3ed3db4fea8ed356ce7c1d3ec2eea220000000bb3afaf6bf479baae834d9a247dd8bf56a329b8d3a4b2569c2d394accd60ef9c40000000d039e2ee65d32892fd85d729636af9362c3f1f59f04aa61de6f284d7e0c583015d21f1fed5c79e240a72e985d5aee1fcd8e98dbf624ac414b90e64bb7175f636	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04902179faeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422801962"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1780	848	iexplore.exe	28
PID 848 wrote to memory of 1780	848	iexplore.exe	28
PID 848 wrote to memory of 1780	848	iexplore.exe	28
PID 848 wrote to memory of 1780	848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AssemblyNoteSvc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e45aa840fa2a744b5c58802dcb12d571

SHA1
32e0deaa8ea66b26507e6c67fa986f2c15f78895

SHA256
dc2d9fba8883f26fbecc631ad699a4b97a4f2c4cba6806f174e044df62de9f8a

SHA512
ba0c93c3826e20918d94d7d208adf9b895d684507b4e8fcbbdaf7ddb8ab4d5a37e0485bc7ed9be0b7a210348cacf7d9e439215ef828f57fdc64d1bcd2a64e4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63526bf74bc666fe0e41a7ac7d087f65

SHA1
1eedcc30b7d051c18c1a46b589f083e2d15b5fba

SHA256
b1f93c2f7a3c6bc75aaeb9ac06d213390b947b0e36ec1a9b30ca7772fe1b38ba

SHA512
6e74e38539f038695df47a413b8cb6e73d1015047f21bb78b70719a98009202e603d518dfdc2109cea853a6ed3f628627bd4867bfa39bf7f95fda0c8166f48ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6359932de1c19f510bcc0fe42352b41b

SHA1
ab2e1025ad0f98e3daac85780c910f843486584f

SHA256
07414259cb85422bea751c536efb2ce6d66fa2a473c824e8a2d0393d92883e1f

SHA512
54d089df0c1d9d5887bbb645f42e0f45c49b3a96b96ba3080b41a43b0cd78ae644e349f005294d16674adcc18160c2ffb63e1128d0f15e452af8c2f216639d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc80f0f3090dad1dd2e131563a70ecb

SHA1
d7b941075b380656e75ccd15dfd65b22bce1df47

SHA256
2199d52c82e6292a27c3725aa0e26807db33fb22d619b081b2e7b5692c5aaced

SHA512
36f06800dcbfab4272593375fb376d0db6cf4f0ab645cf118e1381319a23fc0b3a7fea7433bba442554143570f1ac25636aa9331bfdd1532bc8b81b3d99d4c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df2c9851ee1c577fd7e3fdc8ddba469

SHA1
e4ba1457e166b45e3eb9c9b100ab71d199d2c2b6

SHA256
75547bea87bc1a0f9e6c99042c84d30262c6c229f796db78e6f94f4cd0bca876

SHA512
caa9311dbd5130b3f57d9592871e30d03564da667697823bf08f6008e21322bcf670263ede3fdb5a8e13aadd202e7b10c8f6ddea6dde2d18757ea1e251a8ece0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b8d2c3447c086a4eec8b010e9fb67b

SHA1
e3fd55d62c8ce43bf98911334857aaef35f64227

SHA256
5e7c7b691b35f70117f4f492aee08a311d3df1e34338087eb09a2b4c1eeb1503

SHA512
423bbd5ed0116f017abb6060915b4f738cdda9bf9be0e37bcd8bc805890b98568b4e6ee8b65cb40d1d7fc955717db858360635aaaa38a030b7e3288e0e56f727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
491d94635a901ba84b601475a8065128

SHA1
690b21713c51ed19f6812b1569b80f7f0d2fc198

SHA256
33f6288e327320b203c8517bea889bcf2195cf9530673e9fc4f0fa223972ae10

SHA512
805305017d2dfe57eca2d4e5b1d20e6424005874a941fad605fc7744a004738091210d68dec86a61d4ec50929eef35e376819580e479ebe3b4c3df2b626624a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946fe16960a8337e413e59f078e60bf0

SHA1
a023c12eb02438cc7975f0e0278af61d6b468b9b

SHA256
9288c430d8d2f8a4d2e82024067a85e2676a75278b12dfe63b287b957b7c49f7

SHA512
51292017a404ffe48c3b80ae72f11dc46c966198e6c72070751e05a93ded86914f8c1022f220635af333f6ca6253d99798512e7afb82558b6004d50801517d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
302b5d82517134cd3dad971042edec80

SHA1
cd5ec311ed4657ce727e7fd1bc293198dc7d1c65

SHA256
14dd571589b225b8c46635251b895e4d4764beaeed8525a30ca8e7992690141d

SHA512
d4fdd9d808d468acf27421d1c85192dc834e70608d2f843663b7886523aa058308f274cd50e3b5db4f6a53d10d7f401a9f445c85e9cb3338a7ea2c721d0425c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3036d62cd99543f2c59236e4ff4a58cf

SHA1
87cc595f9d9abc7e7665d9485db23116b2064cf1

SHA256
3c6c09040aff5dba09182ee414e23acf2f1bebc310f1db1b9f84dcf47ae90637

SHA512
3c744b17a68c2323df8e8ac47673b45533899fa669a556aeddae9f7a33077bb73cc705bfdbd877ea7648bb32e12d70bd34eff0c2cad6e27b42c75de905d90bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc5b8cd68c9f6c4e737f7567cd2c58b

SHA1
f2f2b8ea9849213638818e70946a4239ddc9c339

SHA256
821eb957b7d91271aba2dddd1eb104e981b910aee4809f3911e8fcfac3462e8d

SHA512
7f1f21a063584d3b3e25520e50dea1c86ae286135ff662c3d544b70f06fb80d40939e0983893bb972f715a5dfc97ae2a12700f1ef5934d905aa43286eb8f95d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aacfbf89c2c42dee2911c2c520fc1fae

SHA1
aaaf054d4b279cb58385d337f27c3f502c1f8970

SHA256
e1bcc8e294d5aab3ce3f29b6a4c17e9b82456baae7a9eff45a40af2409cdcb7a

SHA512
4d3887bb1a1728cc0cc0c9be9e15107a60aeb1a787643a4f8811483817e37b96a96af79199de151739a264d857f5936deac25457fd9c19f1272c5ad15ea64f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e470b2800079523e06a1db37f8ea085d

SHA1
6d94925d33ba0a72a6cf0563b7ea40bd3fbf5742

SHA256
5a68d2e180dff24eac1cc2fa6991c3b3be9cd49cc9842347cccaca4a3fadd148

SHA512
d9e8a21ef1529e39cb2271b9b800294f257236444ee867dddc29cc9335fee455840deb075a2bead179927ec4bdd25da34d539fd0a68eb8cab67742d15bc2da83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b45bcd8a9d7f8b03ca2cfbfeaa73375

SHA1
bac13f6d3be8fc049ccfb9853c1a62391ea9c390

SHA256
46134070250655d87a28e78bdd9074f651d38a62af56312d382d0b055ee674ca

SHA512
05f952fc67b60a2d7613530d7c0027e60598b15687f4758cf9772aa84c8d53b4ee88f4370440766f52e96246f3a886ede2d038431ffae12afb3903d8346fa37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15761ad35e591ba77ced1d13a48e8a45

SHA1
d9865367f20d4f71c46df89cbee0fccb07857197

SHA256
3a6835cab3531ec479a7fa59989f5c6ebf28b0cb93f2921f0fd19b746cbd575b

SHA512
fdd1fc68cfd10d7ea69fde6a9bb0da9a0ef907228a0cb7821d2c1e243f395ec8cc4006d3a005e96091a373ee79ca66d84fb68bea765be39f640f22a840199942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d035eaae0e90e310d760cdc18a299a2

SHA1
fad99e65b700c8f4ad4b4a1b351fb2c85efff39d

SHA256
e21bc6cacd39991571cdd15a50866a0d3a9abba4f575b5adbbf268d5f0314bf6

SHA512
1ca31e859ffb480985148e2ab5bd6853bc77a689d7155ecd40dbb2b60077eec94546793548825309e88eeb12f8d65874f9257476b04153afb980aae69800aeec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90335cb7d65a3dc0a0cbda9e4cf30f9

SHA1
13dfa42ba93166799376df1e840b1ee57320d3b8

SHA256
f4386b2f70e5cd610ff78c20d5e2f4d7357a7c35aa567a937cabcf564327a50f

SHA512
cefeac863e2a3fcfa8164d8613a0c12d508eef506ca101a23f709e40642635459b8c0cbbabf942f46fc500d1b3e63c26231814c5b77e78b8cde4f2cc7801e1cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37A6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3846.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit