b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.gif
Size

43B
MD5

325472601571f31e1bf00674c368d335
SHA1

2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512

717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426961935"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F38186C1-4067-11EF-B585-FA51B03C324C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007e485f72049db9227b6d0cdbee8f6048cc94ce2cf345615075a3eff870207102000000000e8000000002000020000000939223f81f0fe0e5bc016df8cdb431da02bcd34ded52ce22bdcf09d9a176673190000000d273e21f5970e3b94614aed707f70609993e3e759c2d650e4582a3e96bd3b1a535723bd9a3d5cd19ebffdcb8b0973d8aeb0033022edf80f4dc632fe154909576a74649f51610222aa9d22d846b2e78a53ac0099523570a92d8a3c1b3718bd92fca428c9eedf8e1360186629f1f203d4935eaeafdf5bedb056d09447f3d2cc9a6b1a9ae98960ea5a6d5093e0eb3e0b53940000000b04c6b35da8918ddcf083b821971f1b417aebf8d5c937398c7ad9ba8c5f103bfb659a86c6f8b260a87c3c10045e3d43edac4329c8173984c7099963f13d850db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04904c874d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000035bbe487c7ecdca4b35692066c065812969ebb2492b6bf2b8da388f1abe4ae47000000000e80000000020000200000006d1885b722ff1dc06e9fe3f6099404c8e67e56dc028cb04c346c58adc64179a1200000005e6208bdcd241bcd1b67b58c632a44d1167b3a1181b033311fbbee4da42ff6cc400000007f7aa875776798e82b08fa041970d9cafc99b202deee71539cbe3a914113ad6533510ae71860a7d579308cadea054fbe7b8f5704bd07e7af24c126605aeaace0	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1460 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1460 iexplore.exe
1460 iexplore.exe
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE

pid	process
1460	iexplore.exe

pid	process
1460	iexplore.exe
1460	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1460 wrote to memory of 2204	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2204	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2204	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2204	1460	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
23cfd7273ab90f85cda4774fb86046fc

SHA1
cd6e51db9cd92bdf817eec1e8fc8a081932e32dc

SHA256
0b528d9c049771f35f3050e2fce6de57fdb1aa38836feb8262b855bbc055e725

SHA512
c51abe9bfe4bf44193c132c7ce28a4bd8db427c245a820b058a59d79822081ec8f5bb5c46c69de101fc0a875ced072289c53ac7380dcbd4894afbf1c7dcddd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
57c2b597c0fe000225e6624dd79389c0

SHA1
a656b00d415e1501ac121cfe62dad2850bccc70e

SHA256
c2f7df77ffc9c16a3666af747bb0a2d6f720ce78db80f7fb9f3e0abe8999f29a

SHA512
904ef1d6e6e293d24ab554718e8f18fe13adcdd6a425062bd71a78a02be865c9218dea6820438849a236e971fdd507dbab36999354b2d43307b8e13612119d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
16366f1dac2bafed76cbd192bde401c1

SHA1
49d7a7ef2ba52eed09ba2674eeacdb97c7f31ec8

SHA256
312c048e896666255e568d9112c7c28a2d726cf1864b259cabbe628501f2ec9d

SHA512
8e4933a62c2f69a024e68cae1797b20f4ca213f083b346dcfb627862748d7b7a9e233e8f23e56b6f018fb0c5fbcbb1c8a276e6d85138a840877ee7ba22092038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
692c87091541ea4992c90ced0a03c7d6

SHA1
0df2b7f856f06584d8d7801802b22d65aa833ef4

SHA256
1eef432f2c140a92f8de0cf41b28dc7b96eaff052fee31d5d8cf81e06f48ee46

SHA512
356eb4b996ed1b5c6a6f81b6273fcf4f91a8e0278dd5527bf175b7159234d52a62449218d3d36bd2b0807c582ee91aab4d22f6e40e111a15ea695d1e190e5591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9ec65adb0d9ff97b9486b0cdbc688a35

SHA1
08ed2ddc5fb3b545aafa2274cb5a3e6ee4eccd12

SHA256
597ae87d777b8683d24db7bb706b8fabbb48acd8378400d47f0a4dafb8bcd8ad

SHA512
f0e6a23bf3da243e170143c1abb5576fde6033095a9c100e28bcafb385509cafd86ccbb7437e26a031a736af6536f3640625dd207b77c00ecdfeccbb2943a15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
42f2abb001ae957eab57e83b52a3c0a0

SHA1
899b521b49b23d5c61cae36bb617740bb5bfc32a

SHA256
cb0de0386285441fa652c73a1739ea08539d1f605de983c8e35717c2632becda

SHA512
8b154faaee4d1ec7b4a258a503251c8dc4549afd14a4eaa05a927e6a700999188f21fb85f1e384e438cb97f9f98cf34b0787080cae44cf693f65cf6494e14c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c9144ec3e058864590b7b5731e6d86d0

SHA1
db34a0bed4569ef821cf5acd0191085e697fde10

SHA256
6ee2bea63300c997540933117a5972afaa2c5be6e8f94ec389f4e4c89dafbd43

SHA512
3075b19744431e6f0e8d9fb91bbbf41625bce73e18f17e55752812a17caaab76ea298b9f77b0838c9b4066b16079328b845c0fada045d2ca5f3465c67a4368b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1e15ed0767b7ab110394fa547cb2b469

SHA1
400fd0aa6daa9dd4fdb250f230ed2550c86c684c

SHA256
5039068130c066dbdd183ca6d25e729c5ad054a0d380a6f98d256c2a92151b03

SHA512
959287602af385b753c795087a1eae4af06cda0f9119c849cdeb043c9c94fdecfc79621152ca848dd521d58306d18f8ad972f4f614d083b628024a3336db7bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
56e73c1ac323f18fb13a83b7ecc57d73

SHA1
7d72baf627b1842d5966bbedfb925a7c0191ca91

SHA256
a1581ddfab617842e23401e6f1d8c5d09a69eb551016d9ec97c17e7cc4a04585

SHA512
5a5df33927be9e32512e41d0e505fd4fc7103aef0228917aaf669d7b73e8bd7b6d75698426ae4f88eb381203fc7c676b400085ddcfb6d007129a19baee9e5cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c971f096cfb8485bd24f7d6f88e05bd5

SHA1
824351ed37a9e5293c7c5b426a6f99f6f897cbe8

SHA256
b853ed759b6272235d7b37768aaf4e3a5d566948af3c09522f132c4a9d0a25e2

SHA512
8acca5096747dce303f3e716e2cfa0c1cf2b33f12d797942ed68e7bf4d856d268c42158a372c6ba473d491a0212289432d24ad8d00b83dd677cf1cce2edf8b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
717b23cbf37a652de257d8a4be9bb445

SHA1
cb0b872fb529b9e1bfdad47b1cbf03e17bfdbf9b

SHA256
7851128bee437a64a9c653e377a81b05194a9df91bfface1c4ac3b6b1737df84

SHA512
504a5d21f637dd964a5c5940e9eabe40cb2f056f14dbd2408662e3355751395ecb5c1c1faa3e4eebe365a83d6e4ea673865442e301e6ce58297659e742e110ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d9051f0be1760501188263be261de7ac

SHA1
0095d2045ad2843624c8682907cde8708d5a7dbc

SHA256
e24bf04490e0f0c060442ccbbbb90e282f8837faac39ff32230603b4ad54ca1e

SHA512
bd9ab01e98ee9fdab41e538a8a30b75076a855aa0b692d744c224bb2cfb42750b3cda106ac88cb7e3eaf0cffdd7abb2e9d08eced81e123b5a58ff6ce92c81573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
973f6fcf266b5e41f4e5659710d86393

SHA1
8cbe79f5f23ebfb239cc5118af94957bd211ac7e

SHA256
2132704c6f7d94c83887c1ae290db79539869f3e7f20545c691c25eb8457551f

SHA512
31c4a0ef8d1dadb282b07196d352a3914e64adda6a4dc30fd39a2e8314c4de22d8254c3513f98078cac2a7511a1c44d43a0a14781ff20c43b52a302d511667df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
90de3411fbec092060778685b9143972

SHA1
00d274c5593b1929b08f780a5a4a01232488f995

SHA256
2daef949f53a091165af726ac3128ecc39847e9550c8a72cad13a4a253f3c4f5

SHA512
7467a9a533738b35eea76499897538394c9488c5c10803db95c9770b0d1efbf8d3216f37e7ddaa1caa6c5be6bd48a70dce0e1574823515a52be9d545d2fb9508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
441d6a7d17c9cbcab51dc2a490eede31

SHA1
0e65221fa0280543e0cc247122752819979cb103

SHA256
11509ab9fac16a927d4b76d1d387766ab786dc150c01b29cb7c57f41ddc729e4

SHA512
c488cadc8a587a2ec5ddc0eabe1c9a264cb400c39c12b7731db30a16fa8321dd8bc91cdce0fef85e02347efbf90a2a9a334b7fa35a773a8884c0951c95f7af71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC083.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC133.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit