067a056c6898c0c920c9651099455ec21a5d87839a3bcbd5d5f998a02a09b551

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Documentation/install.html
Size

4KB
MD5

8a713d6afec438fd783385a1d3aff043
SHA1

970941fd67f2902aa7de0732a54a7bc7361751af
SHA256

d7990439317faca7ca4f5af31b5fc14272517a225b017df9eae5b7a6b29d4ba8
SHA512

191c0bc9edee821d6c7fda701510c3c991f306534f1d467c4e81ab30fdaf67c11068f70f1baaedafc01ea8890e5f6d66be7a233f052fec3140f88d269a2c9205
SSDEEP

96:bAZ0voSDibhJWNrNj07PlaOmXmqsrkjOxRCtptbgCQNs4u:cZqow4WNN0YsgjOxRCtptbgtNs4u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002a9266b450c02ae88f5b37c59e2360fa146074ee1e935ed7140784d0ff8f1c3f000000000e80000000020000200000006513021b0c2537dbf9725a856af8a554429f46d29a89d2d62345b7a771db1f0020000000d8412ef45c35bf45e518ceb214af0b1d67b40176972bff19ae321b06e3a3c7f540000000d85d3b2f15a93c490653a7a288a6df8d23c992ae24ab31eaaeef5e8cbd0bb5e7f5d1acbf2dff50b087687db266e57ad6de48f6861f64e06273bb9119f9392e0d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425015713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B247CF1-2EB4-11EF-BE23-DE271FC37611} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005100f7f89eb31f38a857c613f1859535325769ec781fa7952bda3008863c1804000000000e8000000002000020000000218a13eb8b7ffe98f509256ed4ef02a4b927fe059f5b553f0cc3e949e316198290000000331f967f4dec0be5ba63772eab4751929cafc39fc1cb49adadad0567d31fe3d6134f3d89f471deee5b474f37583bd37e6cb73b536065b169d7856d2ccb71f97a2ce5531b6b363a1c461ba48aaa3597a4a5704a5f1322a63ff6ab68b0aeffb3fd4a65d72036cdd5083a8aae2543d1da74646395757453430dcef76324a0b8da5bc039383e6788b07e0f21597479d28df0400000007556de24b33607e2c78b213b6aa33b10b6eaafe7c2c567d0ebd13922af5683014e03c0864329e7bf016bb76ba0f626a56a49eb5a2551998565714c52666f0d36	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40652462c1c2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2320	2540	iexplore.exe	28
PID 2540 wrote to memory of 2320	2540	iexplore.exe	28
PID 2540 wrote to memory of 2320	2540	iexplore.exe	28
PID 2540 wrote to memory of 2320	2540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Documentation\install.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f372ff15df391ae6600c1be1e0e5a6fa

SHA1
ddfa888f1dfb3e4036ecfd434010bb32f766c6e2

SHA256
0fdc7a4481b2b4a7d6eb5680b7df6d7c369afeeef79f5e05e3e11b57b7694cca

SHA512
7db4b25868613991a155dbf1579b1aaf55e946be8cd56022a80fa8935a68156f09a807676817a35f29ddae8dcb9bba74fcff1ccee90c86ea3ebc545f9c027f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c7b0724e54b8e482a0489c4f685689

SHA1
6c3b9b099b7a1d2f3ee25ba45f726a9ef1ef220f

SHA256
8c73d73e5b4b2f86a3383071874ea34307434b7f644d12da5176584e172cb1ce

SHA512
35706cb0cd8d08c39969af320bbc6607fd61606a3e82eddecc9d618d176a4480d3056f6047470dd8b75f0e96287a5cf9198ab54814824298a3731c5ea50bce7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b989a934300949c53b85d8b0535e6e3b

SHA1
0fc4d0266be861d52d2096d50b94ad4eded81b16

SHA256
529cf2fa1561a9ae495c3eefb4dca04e2f6fcad26c9b1feb689ce6c99009da19

SHA512
4546de02922178bf47b50ed4d2beabd9977a09a39349826660458365a7cef649390279b0658004f3accad1ab1637824a27315a8f80df2bbf59f08cf5c9d4dda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
590285254a7cf766c80a3a6332f21d4c

SHA1
854a7cd5d64e2346e9624585c2506faa3d36267c

SHA256
ebc96ea15dae4612505df867681ec0f78eb5a8c401c943176138285f5132ddb4

SHA512
33e5671e859b28876e01de90e987929192b8f075216c97f69a605cc26bd9a81cc99e76607349a5cffa398d3f344d8b6f1b541a2bd05512b9f0159c4e6d663830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
855ee630f9e41aed033fbb2b9747423f

SHA1
88dae5fa3f90d0af8251a469b38a017bb93647f6

SHA256
4e71bb6909a865afc621c8d697a238291538ee5f0c4106b39b331904aac9ac71

SHA512
8cbb39148bd966cc78cae9835bd98c83a6f70752758deff4f974ec27650f09af611f75bca53f73d0755c20b8c8c29cf93d7b23d487280a7fdd0a134241498844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc7c45b26b3b99898b01b1f8ecaf564c

SHA1
63c6a3631752febdfeaa8e069bc7e348c42df843

SHA256
2de277cf80faa363d78083b7e2fb4bdbae1337b4e7697a125c0bb8f41872b49e

SHA512
bf5f1fac08ad78bf110c29e42a5b7383cc287f3e599958e5b873d362262ffed7eb4359e4eaadcfeda1980503c7b330d8eccb0420480307c7b257987dd3a3270f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d309b3eb4295e377f16c9fef26dcdea6

SHA1
2ecd5c7332c47ddb543f2d562a9bb5da5af329d2

SHA256
9aaa0545faadba1a3d776c06c4ac1c812c4f70d6b278e4abbcd4aec2f47e58d3

SHA512
cee74cab68546067e46dec18d0e7416f3aebc29badbbaa309019c41a8ae8dc32f56bf25f7579b7d762390f9fbe155772d633b7001d6166d18f4901e5da95fce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dad8ac9aaf5326a7a633043796eef01

SHA1
0828ab80b3976fe32682dffd4e63f7e6122ee08d

SHA256
7094f9c0cbb62caccbc8ff57b04247b0e6acd51bee209ce28e89055d076cd2ae

SHA512
17921fb6c175eef1a40b450fad50d1f9a4e1e9eae0fac1387e2b7adb249f0bbdf41b3c709ee61884d8f8c11ecaf9f1a7b08fbb972ffddd28d90836bd44943359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c5ba2395cfbd20b85cc9266fe60915f

SHA1
898a39a4131c862cfaf13b3b55562c22954fd711

SHA256
c11c853aa04e9221bf153b817395c3944be9698e6ee2da4ca3f74f9eee69292c

SHA512
9f1c46012d8812011c2214258509523706d6e17c9175fa79297340505f9846d70184121baa11cf83ce11f0c8d4d095aada900e54ed712a2a53e0f661ebdf4a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e3dc1d722f2ab0d09931e46bd6f7b12

SHA1
950c81f2306cb776cdbe56573a67a51eb215962b

SHA256
3f482ab03fe5dc65f5a22c1fa0d91012ccc9e9bdd0142c9add335099cdb2aba6

SHA512
6d5c47b67a2d6a76bc55f78cb911443135bb502afff5286963af193775814cf871aa71ac4a1d9a5eadd50512fb67c36abbe0ff12604639678b8984eff6fff896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff6036b81b475c1820d4504da8c374b6

SHA1
9bbdc80d662fd76cb51b3ff815d6d85599b79be6

SHA256
7df851b68a4b3b6c1f0aaf1ff2b3199b9a676d2e28da01f1083ac942d47a581b

SHA512
807ee787b334db5d61168433776bd96a9634688fc50603dd00451b0db977ef631369fcec882953172ed4dfe7de9691309a2bc265269939c4b0502cac700b0171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
719c9a82268d7df7818209ce0149ccc6

SHA1
fd90e13cfd73958ab9de2bd343bddc685b2ef03a

SHA256
f683ae727f4a18d2c8d05c1286b37861decfb79cf94fe46ef27cabfc7c45b966

SHA512
8ef2b5a470edd1295b371310ea1182d8fa0c6739257d0ad08465349847039a67911c0b383c26c34150564f8792d078909fbd088af04b08891f88ae42d52ae3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f90d99f134964cf7568752e8d054d90

SHA1
b2c1bb4d0cfe2844b089f0aece951d419421ce3c

SHA256
642e5da2e8587fd03ea1e5874a3db293450a845981551a65837cadc3766a7691

SHA512
cb9b68caeb784049060523b9230c7cd1382918f1241807e2172b6344ce7300f7e73915ca9962aa3ee91773b92ad16f31142798305747a053d1bcdeca9062a5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ca1f43523ea8067deee3ea1dbfa7d89

SHA1
fa7692529bcd9004857c26fed9a7c8ca7f8b9c8b

SHA256
8152b6c508715c00d0f1303f75a2a29e759c7e7cb65b9a179ec2ee79484215a1

SHA512
5a461ab76ebfdc790de754100c4f52e710ba0348dee5d014570cc27152cf42073b422407dcca23e22cd904b709c1da6545e28b22d0756c1778b10d2affe8c777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed327e2791d36fe374313deb3c936d0f

SHA1
c1029c5550a5dcf0af627754b770a240115fe29a

SHA256
354fa48810fc7392cac3d3ddc49e57edcc60bacaf4b71d9cdff44baa84fa19fb

SHA512
518da57fbd1cfd8c94b147d38ce1e2b751af37ee886586f549cde4bdcb4367ec88adc49d7dd1e36da9e76dd9064486fa0534a5caed2da247eefc2ad4d1ec52f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9bfc04a80e07a57295cbc87c79de3ae

SHA1
ae65fb31ed76b58a7eecf8e2052a6df71e3fc119

SHA256
8bfeb696c024aa537ac96a68c0f575b8cc95cb1b5abb0c3bc3aa51640a1f3939

SHA512
7875c89d6c2f7aa784fe6c3b672f1e42217e9f558eeb40f52d37e6a2952770dc8779f8cdfa7f860b2733807a87d29175e5bdb62d2cfc1d3f3d6186b7b178d0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB14B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit