08b11c3897eb38d1e6566a17cec5cdf2b3c620444e160e3db200a7e223aabbd8

Analysis

max time kernel
117s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DISCOVER/COMPATBL/MULTSUPP/IEEE1394.htm
Size

1KB
MD5

de35a2ae0aed79b4085a4e2187c20fed
SHA1

c39320278d8d027c4c8d8804b01898c5d12e27ff
SHA256

c7d86ab877fc9c4964aa4c8e864475a273906d07843c16df1ec705dc10a6a2e6
SHA512

320fe832fc95e9cc27a4338dd8849a6fef8410640a9d6485f567f741f3df393fdaf107fff2339153e59ec23055ac1d5dce0f65612630e3fe9d9365b05817a8c8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003b2fcc13ff8f90982213c0d8f28f4b4c7dbf83f333f5b824f4f6d8cb4ef3ad0c000000000e80000000020000200000001d01f31c3de57a621228be6f9dad1e9619d7dfa6704b5755054ec75eb974e1d5900000002f456060a021ea242d395f61b78bd235c65b4a4e5423b7802609e3ec26d6c5bc3aa901e29cfe87d0d29d0f4b2c3cbbddc286c2337f7ad461bd995495797b1bb16f21235c7a2c65e85309ee8aff5f138552b94626726d6b02633cc7573853906e1e1eb5c2d466cada9c5ccdd91aeee5cfd379d1e105b0d242db0ffbf318776fcb161c2918c702018b03351d2c7d84d4e740000000e85cc5f48525397147300e588c36e4e6be370be662111d541cad7934233f565cca1fa12812282b311790bddae508986a46897dcbeb79c05abc59bfdaa3b7d196	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427870823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000639adc5f73739653e1ca90ef8c3e5506bb34e4b4f1bcc917bd64591ff90519df000000000e8000000002000020000000556b65ac79304ade01467c2072185f0bf2e1d8d57319f4f9b08097cddd5e2eec20000000e4a23d0cc04cca678f47fcedd6258fd6c5e02759e035b32661e5b3b54d65889f400000009291680138d12521a5664198710ec5165900e32f655588ab5aac4285feb47a233cd53122b864324f818d06b0cb08e0c22753ea8d9f2b405fc1d51e522cab53e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EBFD571-48AC-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d758f3b8dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2524	2160	iexplore.exe	31
PID 2160 wrote to memory of 2524	2160	iexplore.exe	31
PID 2160 wrote to memory of 2524	2160	iexplore.exe	31
PID 2160 wrote to memory of 2524	2160	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\DISCOVER\COMPATBL\MULTSUPP\IEEE1394.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9acc1341b85ad639b47e86aed00902e9

SHA1
bbc9f0e48df0e09d8999e551872701f9ec834e90

SHA256
a580032ac067f23deb6d9fb557e7ff6a4f9539da8f6c5d06481a99c2db300334

SHA512
0fcc5340ec1106ef796f49e1bcefd493672f2042baaf088a7c1a9b7abafdee65f2b8ab1f2179e4d19513ff0c14335d17141dfa261738421a544987a3a5d3419e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659aa077ad24ee0cfe245b95ad77dd77

SHA1
6a8e34de22292b6dac8e1508e0a52b759b8cf082

SHA256
a62b7f16142971912f4f10c27657b39cc412420c44d85c0280e4bef80a50c19f

SHA512
8b21cb6a34aba07eaacc86a3cd63a5a2eee2ada61b922c77d59de5a9be7eebc5d74727769228276bc6e709de92482e59ef7efb7214907f60e8833aa782a62655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5d17f219ba9b22c5955dc8f4cde865b

SHA1
0193dae0a6d52438e05c4ee61757c8bc1ba2352a

SHA256
a3f60ca226a49468fdd0de7dc6e0766651d33f219c3b591d6f45135791428229

SHA512
094147e27d4e20852780f4820faa177119e084354fc7c8f055c5304490447258b30aee527b5de9094754c7d51a662e2b65c722ca0c2e3440ce04cc7e1cedcb8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcedb09e6e443e5a81d76a1b1ada973

SHA1
5c4793406c1b0adaa875ec203b40c68a3fee0cba

SHA256
1f7b7f5588a8362ae27512bb44fb12bc6c68162b5f77d186194d4abbedc23dc6

SHA512
c4698b1069fbfb45a57cb1678a2f48aca57f7d20db687f2e859905a4660813de9937e77725d012640adafd2fd4e24edfce6c00e59a69593868ceb7e81ebe32f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
870855705ebad46e8dc3a034b0b33a2b

SHA1
6da8d8a16f96491ea0b50c6af23261e5dc303583

SHA256
20006d379c0f5914fc6aebb3b3b9f3b2760c4696d7018f930df053d76ac4bb7e

SHA512
a86dc5198afb39fd0923118215a51089751b4151da4ef903ddeac35684f7782ee160c7479a80cf0f459c00e811bbf3e4cd6e864d26cc994989ca821ef459d020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fcaae4141a0ce2ecab362a05aa589f7

SHA1
416b0963b71c639399dcd105cd20d5360da114c0

SHA256
49e83f2451c2dc29e959486fcee68813cbf19c8c7107fa1eeb75261ef8586f34

SHA512
b4360b9e5f8ba11a740eac6a90e82e09727e666aff016627e96197088ef372cde64b99edf797adedf02286469f490728faefdec1e405f0a00a7bc7f05d572f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d0e79b22d97f49a4e8dbd574cc15d29

SHA1
bc2d05b3a536643d08a64b91a3d834fa357232ab

SHA256
38118c2a6b18e1eed3fa6481087948f274d5f84f3082afd87e87c7e54ce06260

SHA512
b74d9e689ce6591581f2e15c51287289d46619c901a5a95caba9782e4dcebe673964330a90e6d87b52c2c2b8549f93502b306f6d81503c1aeaf3917899d47c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a0bb4e6cc49ffe5a13d348e7aaa165

SHA1
5f48ef9da1dfd76e92715c217f0b37abe14a6aec

SHA256
ec57163ed3a8a8950d3fbc54690916c72293187c284fe31766395b37d9c9d268

SHA512
cec27aeae1c923ca43b6a5d4922131d886b8e8164a13d796768bcc4765abab9b1eda3d8ce8f56891a237f395f510fb68d9fb42621f80dd22bc8bf62b0b9ba717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d4570072d43e4bc97dc12bc28e54802

SHA1
6b16a14f04fda2df42df55fda60e8d11d538ee6d

SHA256
b951456d97197394b3a2a13219fa919521ed3dc83c1177c55a29b90857ca751e

SHA512
612852da623e32a4e34b46956fd09a1016dbb5377159055cdbeabbc4dc838ee40e1effb7dc828ac8ed37f3ab7e568afdf1048072418958052526eb7c33940479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9628414b7dee5c934377f900fa803e56

SHA1
49d0ef2611521642dd93fce2cbca723d38093f8e

SHA256
1ec5bccc98e57f91d9ed8468ec39474f4331a43a16c9a0183f2125c944304d00

SHA512
69064b7bebd81d6ba74c260db110fd89afd7f9fc18b887d81ae43d28f558f97954549ce4858954756990164e2b6c97c53f8f80268beddff18ddc5393e3c8a1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55f519774de064501aaaa71a55046c28

SHA1
9a7805dc5dbbabaf5bc0a07e7cf024e50efbfa7b

SHA256
1d688f7f912e421a929291948626f74fbb29a46bc88acd8b7382a6c422eca103

SHA512
dc1e2b0eac556d87cf2d1e92a25a2ce9e4c47c645131f77251baba86635b5e218cd2de41d39f67d17d54e3fadd71911317319db53097855f595e3e56f91a9a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41c75e44d190bed7750defd624797db0

SHA1
ce09705fbeae66f7bec4c446834d463b13fbd0bd

SHA256
386ab19990d419cc43841ab020b090c4d67d286f139eebb385b5f64711b0b9ca

SHA512
f7ddfce701ac33cc77353f70b7899713e1451fe06b357725f447704cdf315d342f57b7a34956c760375c1ebfbf946b2162640f232fba21f677e3039ad7e8abd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05582c5647d2ace2e5d91ac4a4f30734

SHA1
932af9131e9e2e144bf4d23fd82a318e64b98c08

SHA256
f5b3623ec575da720af593214ba8308481b2727222faff59e4e07e0e9eb29c6a

SHA512
f35c290bd1dbf8af379f71e7c00067d8463b21eae48a6d6e28b4a6566cf797a0386be21628dee496795fc93c36f5bf4207b2bcdf70a7fe3d92d81ceefb8f9768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
426fafc165524d0a75fd98292ff14cd1

SHA1
a092be31165b4fc549ad2028c5266e9a140e8d0a

SHA256
540109817f2217f8dd44aafb5cd6887c8f86579e5813f5af72526d7563417524

SHA512
b3a19ea9369cbaab212b00c71891cbc387aea80f5da6814eb2abbda6c89d5a0bd9df04ea7188d9b7b8003de58c47b9396eac35c7b3c0b55bc0230d8cf8113115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36b400bdf9048b919d8edcc7790bbda5

SHA1
774e39d66ae826b5f91f16498b7972b41c3fc1c1

SHA256
7576f587e4b6cadf00b34dbf941e8bff7373d799a2f13caa90b55b7af0f66ab0

SHA512
e5b6f8eb3f3e61a306d2866020e5a940a5fe2fa7695220de1e519c6740daaaf59e290d40944fe91e07bcfc373118a413d515993dfd7f585b799957e8891a491e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1806.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1857.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit