4761e8891310f40ef568363a0323359bb7aa1d4e83e64fb869605ba3908101fc

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

gadget.html
Size

8KB
MD5

4ff00b50a887e90f4a3ad37338fc50fd
SHA1

1f2b306737bf989b3860790bb095cb54c3aae97a
SHA256

cde092885e9c5d7c0777ce27209cd6c365acd5babac97c88d76460410203a931
SHA512

d0a4938b185f70bcb6413ab159e07317ccac19e36555d44e027fe4ccc744f94cea8c48b04b79ac77ec66d04872219e2856a8f31152930bac2f58296753bef54e
SSDEEP

192:9LjIPI3JIPuObKdai/pWia2pz/KotsuUfTmsv6n4DAM3uczAWAd8PUw+i:pQKH/pWspeuUfTtv66zFAd8Pf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005c877bdcb2335062252064aa2ab1949a7f2d45c7defe3fafe0b822cb8d09a1b4000000000e8000000002000020000000cfaaa357a2f57e4ab9649c52b0773c75adef2e3dd70f187648cf291e568ddb1820000000f1deb06417dac83980b1e66d1697b36850addb2535923f24beefa78de74be86e4000000039d529722ad6c161e14a735a393d65a4de8e88ece642596406a9f429d55f17cb9faa304adab9f456f057c9524a6c1f049a9f92a90f9410fc82c0e63f8fe06327	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e5708e9cd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9EEA781-458F-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000385a64be9256619d3d30134c064dca3cfed888c1fa48d284c97d31250d7fe4f2000000000e8000000002000020000000597136bce77d13c8e6e169a65baff3e6b4744e7b62cfe958fd3bdcef4d65e79a90000000a788f61903f2e307780fd5660c0de48aee6c051a7ebb9092bdfb5e5fa69ba4b04af40fb635bd3351bafd1d9d74ebc4da65e5c9d47c71fc8ea6ca91557d0697b4fb8e7f390e95ae4596b8e8b5ee4332ce870181156de5a126e26fee760c5568a2f1f77890f1e7d0ca561146eeedc15b09cbe8607eb86275602703de04f650637097642c6b1e8d7a2d9a23e21de7e54dd840000000a3a9be92575fd669473bf5288152ed14cd0d415e1a4727e529f47bff1a05d9029b39c85caa3bb76ce8c6a490e32a8357601063451207abc71ff7dbd161cdf827	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427528775"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\gadget.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1ddd9ebe5bda4ed1789332c631fdd7

SHA1
363b4e897b0b92cf10704f57e846db065ceca0ba

SHA256
2be6ef306b48de90dc601b0b41e21c17755124bcefdf8a42e86143368b7b839b

SHA512
4f9adefa5e960027e374cf3057370932dad71de38c8e51b7076e294c3ec35493f4cdaf8fec540f75381076f64fcd237d2b109caa3baf28aa977047ab70fcb48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb827ae5f4c768072e7dd628daafb34

SHA1
550bc2a6f894636f69eaa91725fad93b23deedf8

SHA256
525aebe6f1aaa79497017f016f9fcb0dc679090e0dcf0b6a89446460df318cc2

SHA512
3f132bcda10913f0c49ceadd8b06d7fed5cff686a6405245118ab43fb5c336ce442e04e64246815bc4af1837d38516e18524977c526c003e08b3a4c112d9ca4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4612c480dd3daea2d6295087d1d59d16

SHA1
abc98055080e1a40c5694912d3b131e2d5dc4fda

SHA256
6c5380dc080e595e8aff23637879aca2324065a9725ed421177387e3a7a820d9

SHA512
0baa198b1c8452c425cc021fe5339b657af5ff61f930f15733a674eeae2e4ad5ba754aed70defe58cb084caea005d3bb59c220053eddd7f1fca6bc70c597b2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95484febe64d9f9872f459665ebef4ef

SHA1
8c02dfb78723661d78bd7b643c2b4f0eab434304

SHA256
cf032542d5ea31819cbb00f35cfc681dadc5afb9470722bbaa744d6d6e060fe7

SHA512
0f0fe0a940adccaf193887b5275b6d73db14306556ed568bcd63f2c910e86aeaaa74ace6ff5ff48dd8a0ff0e889c0bdc0850d93fdc968b5a9d9f017e36810656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1ae8493f13e73dbe1fc46925e9c19ee

SHA1
5d62196ff7851c17e3e11f680acb27bc0122a98a

SHA256
21a29f0d6afba8e9c8d8ed37868eb28c756c92698c68ad9ee9c81c9a69e2580f

SHA512
ab1aa89183356e11d8ec9e4c23c7715fee43d680e124a7b112a64ca15cdeedcdc8e8eb5a08a14fd07128133afb4e8cd20169b7f708b592d63b87983527611f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed5b98dd1d79f85ae7d591ab1e7f546

SHA1
69cd3bd6c97187a612eff0ef3374846e35a6187b

SHA256
bdd9fd21a792543902de880bbb630c0a8f261030e5625048972d8fae6f14433a

SHA512
91e2638ef627856dc2ed5ff6ddb9ed236a6280494a53b5a5c672c7a55f0b4caa392906a4d58f1c6b96a13ff03d818994e5b43b168fd56fc1178511f987ee5ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76e5c92eae1e8ba5c8ee50c105d47219

SHA1
1a9b4a1a3c5511687e9099f19e86cc8b649cb99d

SHA256
df21c40469611cbed808bb7bebeaebd0c7fb57808b0698b2b092161cdb5c8a78

SHA512
c8ab5586624033f617feba6076d654291b7f3b14d9684dfe9280e2e64f53434bbda9963fe75c1c004ff90eb13ad4e2e6aa0831108fa06f55ab0f5dae9a34425d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e265cdad4d69f3c4a8cd4e7341c08303

SHA1
f35779f276055a5b01dc849cc209d76a17e929b1

SHA256
739983698b8aa48ae7ca92c70efa0aa8387306b15d99560fa75dbc288e6c83dd

SHA512
23caddb51f101b2493a7cc7990932b0c2785a2b994dabcfb8bdef65e8ce0d587daecd9fa71c76c8a392b425c5d7486ab24d59a3e75962a8a6a8c544460242c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e424692f007295a7b429f5f1cf43d621

SHA1
1c2975b23359406ebc72808278ba4373847ed3e8

SHA256
a7071ef1496fdc990fb45ad9d63849d3c065cee1afe9162e40671861f0c2f4fd

SHA512
a682b847b938e15a129c73dd26f9c6e77fedbb8f083e3645b30e8ecf9fbbf2d9914b26f604bf34841a2fe1744b342996476fafe0dac39ea9025e66d0dec8ccf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c1717d8a998fb8d5f179ff4160a2e7

SHA1
b8f33442cea2b555db986e0d6ccf80dba18a75e0

SHA256
0dda5c969f9b39b69e2bc35ea3cb69c36711e089beb5a856326e96d5a7a1a1b1

SHA512
67f0bdc19b12b7d10fdf9b4130dc5529b4376bd63f741774d5e8cbc1a6aa25d2aaa90207bb75e9958f791ce6cfcaee13314129509c870c11caf12f7e1df38dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b77a38fc495e153640b867436752d98

SHA1
70e316bcf42c5c8552a2872ce637fc37083d210a

SHA256
f8c5a0e47c6b5c07c70c7f7a5bce22d1af538356f2a0a278bfd531a62353e5d4

SHA512
837b2b9af2620bc2398123374934751381cf8d4f89a283878a63a7e257f81d5007c3521ee69603831282bf2ab4d841c62821144a75d7a60dd50888e6175b1e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddaa1d13fb71702cf965ee4e7b070601

SHA1
0772940c26184534b24b3086a08202493c758025

SHA256
f521f39606fb866e59926e9681d367d981a5678d0bd52a92c1b849a7e169ec1f

SHA512
12c5cf3d861049f7e01ff39f53ee63bbc965b9e562a605a3a9a657be78c81c2f852649e5cf9286e1bb7050bd2b9e00d387a931f4b76f16901d20ae404dff5c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddcb451de2e985fdc2b2da5c6d7345c8

SHA1
41d6089ce5fdde86f4f7fada52144cdb1d07bb90

SHA256
992c01e6700b7e09bd6a847cc976e1c10f7810df1fa57d9aa42030439ec03813

SHA512
80cc5cc8033476ba7f304c12f6cf4403944ffd4425a2eaba24ae0d09a679efb8c041cbe8230f374f6a1ee5921cb28ba8c3687945aaace91c53225ccdfcb28220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f94110bb560b891fb8380d96a2749e01

SHA1
e5c77ec89abea9f8eafb6662f980f5309a71b850

SHA256
e2f10506df173c4d9faea4de785c399f1c404209522a2a3334fde9cfcb325677

SHA512
169850206fd9688088c4eeac99c20e00a58504e27c4a18d8a98dcd9c8a1ca043600beed995ebac9f1a8266e2921583da4a07744d1b6167a867394359c6055548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c96a5cbe8b46a3914115d4e24fa91c75

SHA1
efeefbe96da8fe239ad7635b31a90751d345ee46

SHA256
e88e2ceb5d3007a60f79a08c16602c4aeb42193f5e5aa48f5de4dabeebfd1bcc

SHA512
3c3960cb40899af1d9ebd3f4db909865d7487c8e8c16f99a336f7dbce05c13b0bf2607b36ca15110ba1e95b0e748c41ba5a9983a092077b0f0c8f6c82cfd7cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e4c33324bf8d0753749f3e5f1e5127a

SHA1
308d2d46d531e7167e4e119de63066b1da70cfed

SHA256
86d3607b04f21ba6035f10a8c46fa80eb50b722abb6af1d9b4e184d97cfe3f99

SHA512
146b22cbf6b3244cc8331b2bb5164fa0313e89710fcfe4e87f2f7e4f2eb3b1c562fa7043f141588262612467785f8f5eb30978d428e9ec595c078eaca5fca315

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA660.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit