756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/info.html
Size

910B
MD5

7ac9bb9db5330a7f487dd856fbdea14a
SHA1

219c3ee5ea5f1feb66d843941ad61b51d1895ebd
SHA256

55b365a7ed9088b17f2259219c609f88367f257a1142f769caafeb5bfb0f3c63
SHA512

5551a7e0482082aca48ebaa6444d955083c3085d85c920cc584657344168616a6af9e7200e216963fb98e18f35ddf14187bfc2a539e7004650f323c473987347

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5460951-419D-11EF-9BBA-DA960850E1DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000f56ce527b12a9a2aa19ede9749d13c139dc98d612e11c00a7e2f7fef167e0537000000000e800000000200002000000065335a4c5bda0100923bcaf16791f15623f799f5f3938236f8251bb9e23f7b5990000000d294fd7e8d24efb954a4bc841f65f47bd5b9e00b6e1a79ea0c652c847f7ac5dc4a47f361a177ffd1cf012ef8bef0bd8bd72cef207b1b155c13603b3a092c3812f8b804696a29877c70f587237595f30ba1cb508a36595f6b53e612e0199016eafe378a9afe006c47b3b776476253208b01bd5be04d36eb336bddfd111e0c05d64b7e381c3dde6529edc865a5b831637240000000288061946ba9532f3c240e37d36f6aec71a4626eadedc1e8d6284bd42a02806a962efa60357d284fe1d38a6757363072680b73f8741090f7b2ab471b52810ab2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a1c6b9aad5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000009bfe5fb19f3f4e87e0e84e47198e2d786f7734a537b531828251e2e583cca1a6000000000e80000000020000200000004832f3dd1fc1d391bcd6c78884832cf8c7dbd131fb64f7e894e92c7e53d666ec20000000640b9d925c2c32b012116aad835a1a469a6505f928911903c6e9cec8d1de895240000000ff6d0e3fabf30439d048ec5e8e377319201fbe4e901db99fc48ccc8e8a183f258a0d9c5eddc15e6c01ec2c7e72e8c8636c0ea82692cb27a6a251083c4669e295	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	iexplore.exe
1196	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2800	1196	iexplore.exe	30
PID 1196 wrote to memory of 2800	1196	iexplore.exe	30
PID 1196 wrote to memory of 2800	1196	iexplore.exe	30
PID 1196 wrote to memory of 2800	1196	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\info.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e6420b84c02adf91051dab4012b6881

SHA1
4660e3247f78331d377656bde66ecef52c4a80bf

SHA256
592c8934361948faa424aa7c1eb4149c60b265d1fdc2dfb9489b1fa13854a8a6

SHA512
ed758d06b35cb5f1921ac0c4d4765cf59ac7df0687d81a12ea373c087b8e002451a72c5e07fe3ed16514a81b88a56760d62844dbf4252309e36918a9f423fc91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15f4faa7660b1fc8c488c5340ac14f0a

SHA1
f07c008188449430173ad18bd34d851d4af2e51e

SHA256
622ccba4b91e4738f50a2fd31e928209edb3b54931eb25f0bb06f577bf3b71f4

SHA512
aa5d7252a09ddd1542bb5626fd7652aafaf3d83787bc0dbf025da3eb3e8bd85438653581f509330b36daaf8636b239cbaf884270a7672315fd85132513bb92fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56b619ff69f28466dc67f90aba5ace25

SHA1
f8d0a6158ab734b162aa46077c0b877e4df5f924

SHA256
8b4a30274f6d6ba3020eea203e7d9eedb5068e55d5d7fd3e3d4abf9d5b555c06

SHA512
4579700107d7536a9c9c758eeec387a08743408e5cd756cc63ec09369e757bc8ac2fceacdfffbff0a78eaf92410ccf94fc80115b5489020c899e5456d710ca07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aba4689cb3202290baeb85e5d972a43

SHA1
47b5e5b2c2fa0ed26d73f847e08fac258dc1744d

SHA256
0fa204f3457d0d0e74273cb83c3e5d264a97160bf7240721ef6dc3d30019f93b

SHA512
be48083084bcc0e0b7e4e227b6cb5cbd1c5a2929ec3757b1283b4f6333b4ea48830c02191c3ac004a33f2fb41f09cb9769373aad8976b62bb4427e1b1f31b11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fe836cc5335fe69f04aa90c6942b453

SHA1
7d60c85e7b599d0ad0f9ab184b489f0e8626ce03

SHA256
0ff42a5c4b6cb0e5a62ee16ae9cb29d22ac7091d13717472332170a37d6191cd

SHA512
3aea9e5e096950186ce0e6d4672de97fedea945dc8b3fcacd9833763da127d834c1bc3da6b56b021faa28bac861fe153eb0b29bf4e37e06ea8e89da75a728410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b4b3b0575206da1f6f3b892099d4a7

SHA1
16de78a1746ede6f1313186e524cc20e50b58cc8

SHA256
f6d7d65de163abc945d9671014b3d7000ce736221c3df7d85f27f0393a8271b6

SHA512
ad0048be08fb319601f887abab9e4bda5d554189471e654e4fbdadb9387cf4b7630fd049408558f146bf2cdfec35c3e8119ee23ab8b94833c374b92e6a4d89e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f487f2fd5cfb3b10fe4c4f3a92f348d9

SHA1
1a170305384afd43a4963b05f5ffc246566f93cb

SHA256
8f3f28fb809b3172646da35807556c4ac7600c8ff98445f5fc2f2bb316303419

SHA512
1d49ea0e783262752af218e69791a2850a5bb4025102904681404d1ebf64c2043aa961a573339f9cf07e0c036ea9fa4394107178290ae9b218133d3e1b9a5254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a55b16f03cd2040124cf6f69d4a648d4

SHA1
61b73537833e35ba3ea3efd472538fe08435c212

SHA256
e6a6aa7675e2ea5ec291ae1a381a31e45fd5d3bf58a3fd18ef69fed18cba8fe1

SHA512
abe740a9500836c4223799cd637b0ae2e0f525872b896e9f73f6be1dca2373192a4ccc2579d70de093f5c39ee2dcd8df5f562ba03c887c3b19804a44f0895f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8935edf49fc2a2898df4c8da11610004

SHA1
e504cb8c0a324907c33f785f86ad9f5b2ed0bfb8

SHA256
42f08c734e88fece73cab23ca4951ef69ea7097394bb11354648d787c2cd77ba

SHA512
73866078f1eef53f196c3d3ab496f9eab321255e185b1684faf085d94fd22258c3dc862d95c4ee025a2f0fd8092789f2bfd6d82f5e177125652800251b6b70e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a377cbd4ee179c45265a1c56b324c5f0

SHA1
8b44a33e378a8230257fd8f8885ea64d7f704fb0

SHA256
6ca5877933078dc92adfa32f8e98d6a88dbc51656ed45781f0bdfa1221eddfe1

SHA512
3a8ebfc9f5d5a0d27fadc05fb72b8a7412f23078da50a11aa392cbba62925639611d5c1514d2626f3707be09824b58bcb4e8a8911619b1330a563c55fbf87ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AE7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C71.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit