48eda05ebc3353d6a9386a9796a76c42395caa2ab9894936ee59484b17369fbf

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

menu_ru.htm
Size

16KB
MD5

cc83539cc650c37cf1c8c375339bbcbb
SHA1

d1af7cd3c138aafcad03a172027193dadfd8f681
SHA256

b2ebcff602d543d22b00cd860254a496daa6c73c2fa8d99c794ed7eda8205d0f
SHA512

2e07acf796d4653a9c5c172f10e186dcf2711144d1ba556860e6f344ad596d6bcd27db35017c5d9bb9733edaa2088e5fa8054520665fabea9798a8fc3eaedf16
SSDEEP

192:4q+Vd+MXRWKvrKJp/5nqpoqFy+XeBPDyt2J2vu1XiFnXtBWIg0T+s:4RVd+SRBSuU62J2vu1XiFnKItT+s

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000509e2ff95323db44591c753746735e7e2274e0e5614a377dcbefa86301ad1af000000000e80000000020000200000000599a29b739080a85d26804116cc398718cc272c7ab07bb1c42882ba74a4c8d29000000061e758d48b8c7fc0c14a94192d3c9aac45ec3a7d12ff76bc2ae8fdefb064377ba50bdb32675492910c2fe3e4a93f61252ed25e153563ee4048b593dd867cffc83e3ababf8e388db60890071c672819542ba18c564b914b760084277c226227dc862f20d38dec3fc3d155e475aa3a1eaaeba90f895f193ceafeb7dfa8e27807401ffa3078ed416eac9354f1b8e579ee094000000015970192769520477991ab827967a1af26d5a387e1ecb3743ce0a5cc058723198204b46a5d66371360222e180b0aa983531dea0f06fb1f3287540c27390afb22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000251d6300f9f6cb12cbda05930f8777889a2ee9d5654c8505ee9c91b758d8df8d000000000e8000000002000020000000611057c7927bc0f238112e9246ed432c169a8a8fa43556b8d15e83999bafc69d20000000a48c35e153c519bb2aa4b142dd96261f7f8b7e60ccc03e325cc231d1e8ed20364000000068651797474f1006cbeffcadcbcfc1fec0e3d734037dba089a5f2f4d7e67853a88dcdba3042ca15a897066b2bbb8ac316e4cf622ec9f7715f4b7ddb86bc1197d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05acb2576d6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50A59961-4269-11EF-B39C-C278C12D1CB0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427182425"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2264	2296	iexplore.exe	29
PID 2296 wrote to memory of 2264	2296	iexplore.exe	29
PID 2296 wrote to memory of 2264	2296	iexplore.exe	29
PID 2296 wrote to memory of 2264	2296	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\menu_ru.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
788add8f15181fe5fca9090a81319a38

SHA1
95b1a2cdc886eb610a571af5a5530ffbbe8831a1

SHA256
d2629346ee077e8e9002d2f6fa579c3eb2ad9aac4c1c9716c5b8e79e62a60482

SHA512
61bae29425930d29c63bbb947d54788ce39193373691d235c09b1fc312622c54381f25c1ba5210533c0b796082cd7fe6d0d57daf522051090e3689787721260e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f33a31c696e4983bd8a83b6d9b5120e

SHA1
f85e89977d6e820467b0d5be4548e1c23a73c0df

SHA256
dc0820d9b9df6ad84320f86bf6eff5e385f2293c254df94534c6c93a3d3d7e4f

SHA512
4c0a55e304f72f426c68a82e92f12a49b91f43953368ab600874bf573cd286d2945a4650003591e88a12cd18b8c9e39d779f94f17d10ceea7cdc691bd281ce84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a064d2ee95430d282cf1b957fb5427a6

SHA1
ba47539035db7a2db286758148538ed696c36048

SHA256
5c16d3e016a44fa64cfafd7399a7f9b6161bbbe5f958bfe6b40e5bbf80544768

SHA512
c302cbd76850eb7feda5cf15c5be2e858ddf5c14897c9f808684a7adf7ca172e6947021eb4dfdccd450bf64a8c55f40f809994b112049be66b98c0117a9d2c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a9b1f72cb10b71db2b6b4a617c9a3b

SHA1
2c573ad4461232f567e182cec138f572435b5619

SHA256
ff9d2807eacc6aa9820b6ede3adda322df92d6efb6b9d674ec85f0cfd8247477

SHA512
68caff5c247ce593e798b6fda2306fc3e65335b65cf0c316dbb98820c5004d79c3ae2e1d8d76df5c2db5fc4be7625d27b593205500c8df25a6341a6e05673a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49214f3ed14a5092d060bdd791591a03

SHA1
1a4a3e24a07736f0764a948c9bf1e7591e5fa4d8

SHA256
a4bb4345fac28e0b3e80f5075cca4e9f6309d1bd742962fc9337079f86c40c30

SHA512
9cc186e10502919f87e2210311e5e2e1c46ebc266c92d64ae4be9fdc9564e9eb8640aa5c38efe26e02c0c8a0a6276af46103b26568f692011469a63ba3397229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d2c64142f4eac0bd2f04528aa22c5ea

SHA1
d88aa709696d49f6a3d4422218cac50f26596cca

SHA256
7db0d557669a5c2c29f70440860b59d0b52e82788914d8ac1bbbf998651c2def

SHA512
3aa9c90fd73c3ab761a6fee5c476d35b952d99077d010f87bd33e8062b51fa26e98a3353a4405ff35f2ce2f195df283fde679ab9ab8e461cbf364fa8a765c7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90768958ac866eda6603544869b244f4

SHA1
6657b8d7e81bd7fe35f57faaedaeb230ddd6bd52

SHA256
d8ac57cb48cbeb54c273da28a86643d7697e8e5482f7ffd1fbf8d2fbf12e73a6

SHA512
57487b9b8b812e46e0834b472db7efbcdaa32303122949e531893fb4d80755fdf00ffb50f6f01dad7ff0c5288bd533f5efe71e5f762d893477edbba68f9162c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8d9e912a61af9e34d98936ee608783

SHA1
a97eac3f145ee38375832b5eb63428a8d4b9b1c5

SHA256
d710edd86d0bbcbf4e2dbfe390a052c49e01c6393a964dac2cdb5f60c9742c25

SHA512
b331b1f83a25b0a8d411caacd6a69a5bc52c9a81f8aefb24114bce01f9d0860832f59ab2a7a7d57b1fc61967636e19b3710736b49c6800f9f76de5b60fe813c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7e7ac742467f8c0f989a946d86c5f9

SHA1
3b76537d3aa0a9212aa4df48c9d74eabcf5a5a1c

SHA256
ec6163d0e6200a2c162490a6f73d171da45341812d41dcda7985f52bd1262cd0

SHA512
3b1b448802a3d047aadfc4415cbc1c291c40acd7b7f14c45d5c82bf282958a4fa71b309fd3b4cab220ad025b949dd167785e1254ec91cc7480c3552cf9819fac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c1ff990b3927057e78286782804181a

SHA1
4f5e07f4326d778d3dd01cfee70e0210df2c377a

SHA256
4255eab0ac92c0315e035857ae55079cf7ad6134a706e73ed51e912d06072d55

SHA512
2b07c83efcf785c1f417efc2035d52d66eb8c12e7b5403045f37b35a9d99daad47b554af669115a659710c29715c04555f56e10efac75550ef20e7da5ed93d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed3539e9b32ea28de25bfbf1456ca18

SHA1
e2c948b5063f1f56ce44e00e9225115a9bee8a09

SHA256
4900ea9d87a81a84158e9dee872396b4a2066a6efad563028b652ba4eee43f3a

SHA512
559e1a2814d992c9be8da1365faf16c8f114441f4810ea79ad32e6770a05f89da287d789fbda18d06c00738ae926314ba3d143d930c2ec4e1ebb6a6ca9fd0293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbf0ddd741692dafb39dc60c3087c64f

SHA1
56cc2ce1f8f36a051bc954f39a619fc6e143b77c

SHA256
1f866a2a8c54474fdecba686e09cc14a759b65571fd15db5c85de3402d563758

SHA512
9f11f6dbbd0d475dcf797e3a8f7f3e6a94bd513e33d979e4d317d9663814c884a397c6ee87c71ccaef7feaa6e62190a7c457eab23b127f580121106df545b488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2255e851edc46f0c1294fcd32f3e5673

SHA1
6a0b12c0d6fa64b95c2ec5fb1bedaed051af814a

SHA256
e67cc8dc9a5590ac742ee5f5aec86679c4acc04f514780e7242a7e527143fd48

SHA512
bd46b45d074cfcc07b27554d4acc83c1042fe93cfd1f37e3f55ef83c2b021a19693bbcb8fe7fdb8f12459bbd9933e0549f1283ee5b22c197129c771ed5aa95eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f4c2edcae8a466b5a02e295ec7657b0

SHA1
99e82bbfa363d139aa0f607fc6a00b7940ae73f6

SHA256
01d5a6c36dca9c4accaeeeaaafdad508d4acc58934928f64ae1c71f3358fb804

SHA512
e9616c1851d9b8b2a598b83100d3da92257950b65e7762d29b9a7b17b4f82257a587a331a66de4af16a7f1aabe9beecb52af175242243fe12e423bcfecdd098d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c00785cd43558df672f79097b86c1e

SHA1
561af26d8959fbbf763b03aaa1345466937facff

SHA256
f1f6ca2fc829b0ad8f46d63ea6f221b0d46c07a4bc757de9d7b1ddbf2762f349

SHA512
60ca452c33293a0c321f7327a7028d2e950c098a53cfd8f1222c1d03a99ab2e719d3541278a47f67013eda68d8c748c4c56c848a73a52703a0f2b8d40dc0ad05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b16960465741bb733aaba07778f88b7

SHA1
fe089d939cc850523022c83baa424a095ea7f896

SHA256
03dca9cba6ec89b6988682277eb7415914450ee88a5ea1b2fa162fb5016b9479

SHA512
a226fa7e20479d93349922f5d06e440cd88a66cb83c7403f6cdb7d5ec052e3147261dc503cb935ba388be9a0a4c7a42b5e58b06af9d587e72dd4a645aee484be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1146.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit