58465648d792f118660ff7515e0b0350ebcfe576e19fcfd05a23b58c45770a3d

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$DESKTOP/Internat Exp1orer.lnk
Size

1KB
MD5

9ffaab5f197ee38cf1fe65e19d4bb217
SHA1

39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA256

6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
SHA512

eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000dd6c5f9d22e45af017c28ea6e449390829472084a45d84cc27f3d719bd6c2f7f000000000e80000000020000200000008e16da0f85a6ea739527b2c8e069cd67b63e7adaef3a2add4c71544a245cad682000000026b5b634c28d4c393e22422ad1c08e387dc76f65f96d0d602c8800699192779e40000000ef05af02dc73a449b27a24dc75b953657e8db08d0137c96f033deca16538099506c24c86574b0624858012eabad2d1803742afebdfcc2ccb94f08aca8b19bd29	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45299DB1-3A2C-11EF-AC6D-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000008e6baa363aac0068843a7631bd6313a9698ea5fd42b0ce591f633e5e21702017000000000e80000000020000200000007df05f38e931789ef1fed68cd0b19829f075e7f1b40ae22b149519876840307d9000000081636d84d7b71a99e86a672ccdb0ca8ae07e51531be43cf619934878251a2ba3cb87e7cb0d959c69b2116cbc75c37272fa373dfac7786edfd4d71f20ecc6fe6995912eae46e0f9ee2a291e254738c233b64e8d81384b00c0e31813e30aeb3a15886769eaff3563ee4bf068448812634a8450bf367661709c74e0459112daabe27268913c0f4542bc9ad6ef40f989ea34400000007d9841a819aae9baa74e78135049f705ee0bc9c14efbe25383b95fefb85dc416959e91174d8b547afc1ecde321ed0ae3b0ca7d4d17e411dee532760acfc0bd93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426276596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0547e1c39ceda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2736	1936	cmd.exe	29
PID 1936 wrote to memory of 2736	1936	cmd.exe	29
PID 1936 wrote to memory of 2736	1936	cmd.exe	29
PID 2736 wrote to memory of 2760	2736	iexplore.exe	30
PID 2736 wrote to memory of 2760	2736	iexplore.exe	30
PID 2736 wrote to memory of 2760	2736	iexplore.exe	30
PID 2736 wrote to memory of 2760	2736	iexplore.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$DESKTOP\Internat Exp1orer.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.113w.com/?waga
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd512b98e31058935aebfc43246ab6dd

SHA1
c3f66cee24dbf74e1dfa4230c48bae18b4879803

SHA256
7ae33b513e4c74f4232fc34cd62fa4413ae4ce54b032ccd528a0478262e90df2

SHA512
6c9d6c32a62ff48add91dca55340dd7024551bc80da6b5248fdcd251d215721be6f85c0fe13c4accda4c16afc7cdfc5f9febb150b08f15c5b1fea0d94c9349b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ae768dfc3c9744850b86757cc0e240

SHA1
4bf35ebb8e24ac7ae3d7834e2af949f9d267bcd3

SHA256
55a1f3245712e280cd9373893c5ab812ebabfd56f080203737be15ae4a5869d8

SHA512
0fae5217199e19521312a6fa888c64d9118c8a7e7de9a52ff14e227bc6bdd24b3be06cce68e3906f94fb37b100a7c44e68e42522c44d8ff76c47979fde95edea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f85cd95490ca3cebc7f190d651f79b81

SHA1
fcc92d10914fb8fe66c2795d30270e4857d2deeb

SHA256
1b2410b2f611149c9dc1e85f5e9f13681210425850582d85b5605b3f27d51a1b

SHA512
0385d3fbff34d0a5be3023d61a0655edf4883a2544d9ac456081ffde19de60550de13630f875cb100bfb73d5c5a30a16b42d2951cd4537ce7c397f2472b12ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
548a48d2af2f2a7a7ef003d098260000

SHA1
1c352790643eb2d5d23ee9823ce515f36888818e

SHA256
2d792adbb6f3f475346cc0b25cdf31b7cba43e276381b2326d2219c02c2be1a8

SHA512
27b4c3b139dded714d5254fe55e4661c73d8f13002fbf26f72dbd21945e65fcc894a8faed35f501d3a33cc692e8bc19ea78a6735b4caccb08d4ed3a6517631ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5681055bac47560c48feec64cedf7e5e

SHA1
4f46484f84532f032f0f5e9fd69f54d18a1f9c73

SHA256
9c8998f96c76852eb0c5d5d6ba69957f69c232c213eea0cbce523edafd54fd66

SHA512
a7ead377c7e6d54caa93e7f881ea58b5718ee525e99d7f4348de365c3d1a21d0e348f05ba181361d03a04af416b407c63d9e519702fe964ed3acfd5a5b55a4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15fb536acbe0910b19f55046d5d2a0e6

SHA1
10c16ae72355b573718a0afa8e029b2a911ced80

SHA256
166e51fef6822304ca15edbfac9111c492f9eb7bb021c4d048e095dd29108881

SHA512
7f729823e8041ffddcddf168b8716931b70d60d7cd955791843ed148a06e65da467f56ca52bd31c1873155b9f980fc8be568a6c5c8b0ee9793f220c192dae70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b2f8bd437fd5871fbde11c5d4f410e

SHA1
bdf08071d252b28af2c7c2ccc05036108d210d1b

SHA256
fa76c00367eb2ca5b66b9f0cba73c76479f7d90cb884187502ca9443fae017b8

SHA512
ac0c25319a64792b8127ebac30bddadd190accb93cb30fdb203036f2c595702717e79843518d43b4dc09b0ce8cc12161abc16e39a9159f55de31fc5f92c83670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
094e0a56552d5d77341a87f0af960a93

SHA1
f05c7b353f96ed23e662eaa7c048381d4b2610e4

SHA256
e520fa477b1c5b7d4bd599c423bb3ea3816ad67d92deefccdd1bde71b8f0c4c0

SHA512
0e56aa0007839b264abdf5f2ab802738c10ed024f5ebe5b7231ea96f4177b61405eb1c3e1b3bf05716b3db80d6fa0a0c97b513e8cafec02d40373ee9b9fe2055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4c3cd4895c097a3e0789a00f7161a9

SHA1
909cbf4b03796f3374a88c3e6b1827e116f08e34

SHA256
684156fd7e906610494f1ac00fac5f9ce6d98cd71b0e1e4c5809022069fee3c7

SHA512
cd334226f19757ead7de6831418513457cf3eb0aea6fe67fe8a7bd6797171b39cce6484bcf4b2599dc478ad5efb4a905ed0181da35178058c85c9b45b46ffdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f885a15f158f5fd9c86b01850fd0abc

SHA1
b5eea8f8967ccc111c9ce58ccc43080655a9ac2e

SHA256
7398b5d45dd38312faa4ea7eb415c3bc080a050c23f60e984d64ef0b18e8f474

SHA512
e4430f0fa0757d32cd6feb56ba93471802c04709c1234083bdb14278c7903a819761e5317c49fbe06cc837fbffba4ddb698f4a922b02f8373a6c992a91043d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66c42d2c29448e65eb827869dfcff3a6

SHA1
64136eea8426e1a77c92a7c73a20de10125b9a4f

SHA256
e39e4044703d555dfdd208c0f2d57a54afd7ad118b5e800e063584795af4a990

SHA512
eeffc7e887c1fbe6a92e434efaf421a556d64afc964caae2292f870dc7781274e14ef01f81b3e82fd4f17d2c6eaf411b4b43b273832206b4d2e4a30f1e68483d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FB2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit