756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/autor.html
Size

2KB
MD5

81b79e045de9e57deb4837ea4a460896
SHA1

11534bf7384c5c0164ad7746f59c3d6b1ac9bf49
SHA256

032929a14d39f473ee4053ee1f4a968b8aff8805c7e2896d4c87d257cda3cb44
SHA512

cc624765e7ea438cb1a9e47e02ac74ebeacb621b84d8f24570f004ea6fb5fe4cc94dbfec699a614a0079911997e34a6d6c23de9d7823e24f0a44e45830e3ab9e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000dbe819f07b8faa76e285da503bd726a5daa55494444de81727c2132811e62f61000000000e8000000002000020000000c4aa65f42df98a63a04ee3bbb0604b9b45cfd573468ba026ac88b93b0dffa96a20000000cc82b2ce130a9fe4eaefe1f92e0d7b9bbd644f9ecbc2e99d9444ec2cd210d7ba40000000e5dabcc1e111e89599c502ca127fa8b7521e0d2e203785862af6a911f025460ed46e52afa20ac8f3897aef07d50febe9d7793935b6ad5ed6ee5af2683246c37d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E53DE361-419D-11EF-B586-DECC44E0FF92} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d044b1b9aad5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e3464322a1e69f64e13762da3eea5819ac8e244a1479e050593a322e7903a97e000000000e8000000002000020000000eb8ef20d93bba9035d65d912aa83eb6ea054d356a1afc1b6cb2f6e08a79c754a900000000aa3e753be69b43b314014d36b0abd16d46b9d0e8b7f82535120ef6b95e80fc1cde7c18b896bc5f85721ee8657da59bfee6075a5bf9f7c414fee750937197874b2cc0e44b619537bcd8a7b0150c790866bcd3c03d55b8957cc1c18316bff2955f2c459b8d04633404db1cafe09bd2b118bb9af57b4e96d9c2b510f5e3d4f38911ec90170b1e35f547967f1c3167f12a740000000a735d7292d401112c2569cb9050a9f4979203b85a492f5b66a1a6d3544823602b9482189d5c021cfbd5a57838b59fd2529527b62a2c2272a07357c22d89f611a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2696	2672	iexplore.exe	30
PID 2672 wrote to memory of 2696	2672	iexplore.exe	30
PID 2672 wrote to memory of 2696	2672	iexplore.exe	30
PID 2672 wrote to memory of 2696	2672	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\autor.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f3752e369c38c34f42dc71f1fbeac29

SHA1
68c0be14ea16b6681f8f13042608b307f8e9d80b

SHA256
fb524b23b041f79331f7feb63d4e60a84004adff02fd4680648b7294e296b1ac

SHA512
799eec15b910f3d95f19fe25e0ae9bd4d5019c50d9176c5162edc9151f6c0dcb1d25158aa4548aca763c3b6846a3eb14a29e8913829afd33dc1e4358cf5598d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280407799e84a066a9e1e0e9616483b5

SHA1
762720739688be104a08caa64b7e69aa1f7a6aae

SHA256
c624b73604762d4922c2b964cfbd95d4bb15355cb43987b4a105fc4cade6bb94

SHA512
8a7cf47a30263185d86bcc92e9a9da40381a3d39c3f268032ccc23e769119900cc345d3dff9c6359f6cf1fed6761ff52d57d46bb2b8f18d00e1012135ca81f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66ae4f2399b1f3db63f4ea7fcba8996

SHA1
15119c0c72f982abe58609f0f2f3b2f43c53a9ec

SHA256
b9d52f1e6b5f8aed15760c541c46d9e39612d883f876a2cfed3d20e5a99a43f0

SHA512
3438f19f4df77b6178c356de04843ddc4995376ad1a65df2c182541544814de0c0231d371263fdd0988aa87f20ea572eb856e8d02c1358fc04dc6cd898294705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e4d961956e175109696c2f96b0f001

SHA1
39e2fd5a9a3229044bee4e2872d8f05833a97358

SHA256
0b5e3e14c63e3247bc3f0b7295a6c92e81bfe259b8c2c692d15590b5d8b1155f

SHA512
54718e01cadb9926138562facfaac924345e2a3e1b59ec313d341470883fb13b31c36a9423cd53660d1892192797dc370c519188c9bfed9d3e29df214dfeb0b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eace8c9bf15623ef83d828e6353e093

SHA1
6e839958f234afb3c9a9546e3decf88fab159882

SHA256
33197331567375600ccaa58cd27b3f84e543ec4f62a5695da743232181e33554

SHA512
e8ed9801953521668333aa662192ff55997dadfd75f011c7ea342069f54e872386ca411f43b478ea1e3478cfdccf892acd6c9b008855d3bef194b96ca7bf44cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5219163dc420f11967b48797a3e396f

SHA1
a17ca525cdf7552a589123c832dfb9e5f39308bc

SHA256
9070505a5ca980e95bc41c77345ee09836fde0b9275623976c196fa95f37eb8a

SHA512
5526b727dc867a0a957c251a5fe82dfa48910c80cc87b2042e489de5d865442f399f67b0e2c57ed2a8ad6788fb87873d1a5c2d39998c30ce1e7bd6d30a5d9d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9773727152be3abe3fb71ead42449f22

SHA1
5bade3747b8c865798c7307ea68fab9a46017d4c

SHA256
1f002393221d9f802a40a112188fdc09979af09f6da8c97ee7ba83b124854c6a

SHA512
257baca6a49cf95ad94f042196d8fc378a41fc290a9e2ffb73e6f13a7eee10879b9ccaade64598160fcf36b3eb2c7f864caae137b67275d27bff81cf582f0e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3810fa8b206567c342ab9a2cb9a49da4

SHA1
5b7ff9f32d396ebeaaec5a7dbfd1b7089e20ed07

SHA256
b8123a1624369d7dac842e241ad5c21e8fc2907dd62d368218a9515307760bad

SHA512
2b05025427cb07610372e3224ab93be71b5f964c205a06868e385afa34adcb411c76269fab1eee0279775b15eb5681f70b7bd04be9268684df7075b7e491ed9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
467bb493bb3b6a2519088870250d5caa

SHA1
f124e0e6f69d94f70a9c017c581da94da441280f

SHA256
4f7dc1c6e1943d04812b6f5f4a8f99386e970f6b55a8b8c6dc8ff03a4a59359f

SHA512
9484a569fb0dd2d38ceec59ab991bf9da494839c7c4d8bd431869e4e45e23242d5a57d09b54f1d22816e111d38111916071c6459803cb4d2ddbb51fa93bf9a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bb27942e1fc23351f44eaa660a47145

SHA1
6e05af5f8d02799a8e8aeb388f4150ad67106f82

SHA256
eb59a708df0a42a1a862852860a3f245d8686e74d55cbb58240e492493bd55a0

SHA512
59782ea177705baaca0ddd35b12823872507cdee790f897430dd0e4fc36a07d8149497888cba3bfd8335f8dd9c4cf0e43ebffb7aa6adf7a7d3a0deebba319a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba5a4075af70ef25d451d0688d244a39

SHA1
90be6f237c42e3683df193109a84b76a83461687

SHA256
ce7009dd7f50847952731d925ad11b0146fbdde77b55d3a6487ed2cc8fdfac57

SHA512
9d8bed6302a4764b5c581e890ee410fff3cbaf8031a6729ba3d714addc1c11db7edfb50e50551a5345af319f6bb36cec2ac2817805717a4c1d55ed8ae7cf3cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93a589e9106382b7a4cd4ab17066f35

SHA1
136b6fa7301f2225a1c5ee07b0715c213f02c5a9

SHA256
15cf5edf3695b94390dc98f245e49869ed81cb01cc7959e17395bf39251f298a

SHA512
056b03b02761ea66615808f77da6ea43b9153db9e7bec5a33d4e6a770127e560f897e1fbad7449955f6b78f9f29a45418c39fcde30893016e1f620469a723199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6067e06d5bd18ee4bec28ddd13cecb8e

SHA1
c4c5438921a903aa06de2bee86a3d8bcebbc5f21

SHA256
74ccb7f5084ccd1fa667a22de5807de508166b383dc636bbe3ea348625f6dcfd

SHA512
df60ee13ae2405b2cb6ff639a8863e08964ea1e1a67488cbdbced0b4d4dc2e970481dcb1b7b524ca0da723f81e3bcd36fd5dbf1574a3b27d8e57e3aa08eb4c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e0c1d0aca7f0bb7b17bf1ee2731f249

SHA1
9fcf87323204fb351d8fc18d2e8f7218145068d2

SHA256
3f0810e39f6c0f3a7c324c4c1c1db7322f9e6f4060e6c59e7d912de7f7aad4a5

SHA512
471f00d4f92e3647ba60f374ad8759fccfb1b89020331c184c239466388164e63ff37877312f2c37ff63b42e853004c9e0939f73bcb5ab4e3f27803503679a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9ddd3cb38f30f597c82ad351980b3a9

SHA1
54d3684c7253eeceabaec2b1d683d4137e1182b9

SHA256
7d2cfbb5e93232a1b109b1a63a13608dab4cf2f458f3330118e42dd84da24e6d

SHA512
1588d35629beff7978744af1c4aec3f63da6115f153b47aa4d8fb902efb9f73b40fb037eaf8c222f261d018512d1981622ceed416b9f7ac9be000d46b5776f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c665d89b4d55e6d57f2ff5a156b3ff61

SHA1
054668889b7c59ccc06c7acaea9b47bddb860acc

SHA256
e7cab008acea763fbb41b2281ca09f4b3edce1d2b3c98e2db46cb01e8fe935f6

SHA512
b711f758774ad6ff9fbfc0716035aaa5d498d595093f32fdb64df674f8602b866c651b41479a24c5dd9b618a00097c67dc073ab5dcc3f6e97f33dca38b55bee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4711.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B68.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit