08b11c3897eb38d1e6566a17cec5cdf2b3c620444e160e3db200a7e223aabbd8

Analysis

max time kernel
92s
max time network
221s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DISCOVER/COMPATBL/DRVRSUPP/DIG_SIGN.htm
Size

1KB
MD5

e226bd3e0c4b4a1e0f63e00a2e547cf3
SHA1

d1e3a798700f27edc8376afc274b59aa24737e7e
SHA256

230ab21a647d6fae936c0014d83fb08063bf2f7e0967d256e804be7406e9293b
SHA512

669bc10973d2116b62ab05d5eeffcd50d49c645d725edcb09e75f842585852eebf14ed25190619427d5d0984c3d704f03c254e89be12250d7756ad89da569c39

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000091d8e4d13f0db2b46a0600bac562eb13b39458e4f9623fca84212f79ea658121000000000e8000000002000020000000797733837a87320ed3a233446df974c5bd3e0215b5224ad097c2915f3f46695d9000000067bde5b28b21a79018f0aa909f0f7a5914eb35362d79a35906e0b59fca99ca070bfd7fbb5aeca0b1a310b85c9c8a97012bd8f803f4cfd86be04a8669a825220be395ded4d590fef3b34643dba101faf7f2d887a6317addeedf62627803b4f33731a4969da0027718ad66b893d164c5fdb9c628274fdb62550387b408ad1f0c073d3061552bc479e02eb82056db9fc65e400000001373cdf58e1f867cac077983ffcfa12264dfbeab4eccdc16c0746e5c204f016d3d20952044a9bc3c46c58afdab38423c7f8d71a45a40b7d9aeb35baab866f008	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507cf66ab9dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005ee828fae8805dc274c8806f851ebc53c153a191ba178404c8c7e0ea18c79c6d000000000e8000000002000020000000c9d694e44d0d235f63e67e8a1fa840a28a33df5a825254c341f43adb91b14d6e200000004dc39cd69f2753a35978f7368bdf932571e083aec4d86e8008412af9ef1c770e40000000eec89af6c48e905d284cf4809cccddebc66f9fa8a43044dd8c09239a36b989dbbb3bfda184388d3358e5fcf2720f2f5d9736bb9d9ae32d8bc15e7559be68644d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427871025"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95F84FA1-48AC-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2204	2820	iexplore.exe	29
PID 2820 wrote to memory of 2204	2820	iexplore.exe	29
PID 2820 wrote to memory of 2204	2820	iexplore.exe	29
PID 2820 wrote to memory of 2204	2820	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\DISCOVER\COMPATBL\DRVRSUPP\DIG_SIGN.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af71ebe6b24789abc7555afa046a61d7

SHA1
3aae3bd88781ca8e6b67908bca821d665c1021c7

SHA256
93e6097a67cec71c838d3460a8173fa1ebce499476d91c5d40e5f339ad477839

SHA512
04786bae95151cc9b877187a7dd039346409bce05bcd825afb543ba68fd1bb3e1e9871a6358d6a0f3d2e87e3e88db8b5fa625d2e36cbabc57e68a07e0f2b9cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db414d2359cd7db428aa8dbc4cb73d1

SHA1
372e5672dcdca1b690c7ffa2a4d0b654e9eca6c6

SHA256
686e0e3f565933c4363a682e2e640f379bb69d8083e7736672e0456b68cfd456

SHA512
ae978ce6359cd3f600562ab95e586ab46d1299462a5b116dcb932f1a43b8e77dbccbe52fe2030b924a9c13a22b89174a4ce10a5bcd9f8870745960e795161d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceab401f665d8b9f07d85b8b41faa448

SHA1
fd890380fecb2757028746dacd50b431228fae2c

SHA256
05e7f4bcec7b8b75ebf202e962710b66876ebd315439ad3ec77a56b8f9117bf7

SHA512
4497a3f3fcf8bee0041c5a39251b4ecff768aa21ec948bda17d66442b56cb91bc7157b54cc86b43450f9055cfb1d07e4751fdef21fb1fdd3169d1bcb50c79971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2f8c501e76eea3e9152a01f46ec70d7

SHA1
e04a65c9e035f6b3577a1df1c870472f8c5a2fcb

SHA256
38cc8ddc4dd8075320c58b2f91dd3b8d85eca3e26061080d81e948ffe6e2c7fa

SHA512
409c5c07f8373bcca7db8b141ed6291d20a98fbe6619fa32ec09ee171399476c1a61b53fd0ffc8e2ca78223c06274947c122569e1f0c1186e7a5cbef19440293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
997fc8eb2900df403ecd5be5ac63293f

SHA1
78378c6d56a1d3daff5c32241dcb97348f93a2c6

SHA256
d9b03eb488d18ac3b59cae562b31e78cb07c6b095e492d3434e5ec759994c1d6

SHA512
4d69245c49cbe90570651cae71977a81af515e692502ff491cbfb9e03cd2acd02fee7854a28e0bcf60944a9a5beccfbbd198d42c54b2f0ac5431a67401f25b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8383fff4c9e11f4b401fa05b2a4f3311

SHA1
203fe79ba6e0d3e7f877042c1a1fc19716b3cd20

SHA256
d671a3be97454a9e734279d9663544d19290cea814bf49d40d42cc8b90076ddb

SHA512
245a799676bc7d3c540eb578aab69604c46938d5cd60bb254268436f5798efbace3a6a5270197a75e34ba4123f97b3d0f762c636aacdd8145883e7a9d4c4bdd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b083697a548387483821669d4c36b30e

SHA1
ee2e7bf2ce218ee7710b2df03ec60afe9b22bfc8

SHA256
24ed679b718c615583411ae10ddc87bdb6e3b3f5df7595af628055c29ac596b9

SHA512
b43e2aad84c9c9020b94593816e34cfab2f57f5be6fa5b4bcb2b964a9d277b3f6190bbf044e54053fd6aa8afa97764dfaa3adf6178bb849d43794112f6e494fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67039e9cc2e7b6decde7de7451d5135a

SHA1
b90749b0cc07d31064afb3b4ba4b54161a5acea6

SHA256
e0f14ae4944e097fd9bece59949ea80bc0a9486c052b3c9d9d6ea3795dc529f5

SHA512
821ee5fb623717b25a771454ac5babf0a8b3b34fdb49d9ee36f8681f0d6eb3c8423b016f210d97ea17bdac2f348907b5ddc13f163aa72d91804aab9e9f1e55dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1db597f7c05c44bb93ef4c3d8fe55387

SHA1
aa245095f174d20a65b0fe7df63fd78198733753

SHA256
3263a9fc6fd67aaab7ac39f6a788a2ad81bff9b20ffefec69b38e2d9966e67b0

SHA512
aefa30842a014323bf8c12d39fbcd32a8925e70fc7bdbb2612ab81eadcd06898f808d109c5c05262b0b0a9d964a6c0d9381ead4affe705940777b5534f6c0690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9393ad35b86ba204eea2cfa5c0479cde

SHA1
c96b82f0dd23158df06c3fe947c85a77a8a678df

SHA256
ca3910ea5ccb2f153d992d2facf21bacc9a41d44324cc4f95a90b446744bc45f

SHA512
d6956fb5b88b50a570f3747b779a4b7227c41bba273e8a267371389140fa75bd8bd60faef9c6a4920fa4c548ce1bac8ef5cd2d310037a728fa311e911a75a0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd6b4bbbf68b3bc358850e5665d95487

SHA1
c9e8c811879ad55579deab680b17fde27fdb1a91

SHA256
54d501c09397b24208162df692f2af91155df4e501b63d0b4ec10c16dcea9125

SHA512
8007b90fbd38fcda464b4ca20cd2812af05af6a2ba62a47b38b7be46f5c22dead5d4767fdf4aed065dedc78ec164952f9b8acd942b8e5291204bdf4192707843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05e207318dfda19f30bfe0a7835e94ed

SHA1
f28064d96e56e56c8d76a428197cc3a140236e55

SHA256
65cebc94ee84bc19773dbc9cbc89a6b49e3ab41beb90f5ef9c4f4dfabcec1e48

SHA512
1a93591e1e55128d6a9b674bd3f65686a83f5d21b47f82c641c15432f967845f21d40b3a8c32a71a11f89c1bbae7369b79a18fe9ad9cd900061068f5d4348f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbf633e6b78b5eadb242c0bb7a3c76f1

SHA1
e6e45bcaaffa47343b80fbfd752503ed80e938f4

SHA256
3e934b5566ffbf884c59db3d47a4959ae45c6de3f3009e7b0d94279b0d809326

SHA512
52db61fba26f03521698c6611aea1111d04f2a5ce60055a9a60afa2969d7182d8d0c434b156027b37bde240ef5eba86de64b3c354764d26522a146ddcf05ef47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bd4759ca0385459c72409ab1f6831ea

SHA1
df21d9abd948168fbe2c9b327bf4555760634757

SHA256
cfd5a4e2841a9e705ffe12ef3b693c535244da90d307c6b8c7e4b0c5371a6815

SHA512
caf54ac8a49c6bea319cd36149f7c66058ba047a0089239b4da434fea8a114606d14e71f226250fa4455930c6b8792faa59a6ac41da87b67014f208b3f20f2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3f916d9eb0d5746a7824d2e1ac74dd5

SHA1
99df41ac3f0f634f38c88146e33e9b98aefc4022

SHA256
300f195900608ed21831f49c5307d9410c3210eab40be24e3caa5cd5ef7a8c3b

SHA512
8de738dad06ab34e54f87f712a925c5e57da04edf505f5fe8b2825ee6d14319433b53f022804befc91926a38b783d1fff686d19bcbdcd37ec2b1c60d23acc9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bce3b001e807d97a221d48fa58326f55

SHA1
fe8bd72fb055e46f76fffd61932a1655476bf1b4

SHA256
1bd237522bcec12f1b80d4328b7fafb9acf79f4cd44fc895699cb4617c7f5724

SHA512
78bc6a96d6f7f20106e507f8e706fa20fed4a5ed6cb98e9e07190ef3f58a9146c8270c0a4128b8b8f285a33aa8506f48a7811f67e44aecf2b3c24ca3ccb18c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
293a442d3c14c35efbbbe1cb39ff8167

SHA1
aad3f2efa33dcd5687a4f5365258614f2f89cc5e

SHA256
cc2511289b0fcf3aa916669defed7ac087d4dec5e63f579cdb371c5e561248a3

SHA512
605b445aa4fe29f7d7056c0e0debee5db29d58527d988b5c25d6e9d509139ce6662467bc2c8eddf912a877ded0f4099755116d82c55f03da54e8c49e47bc0d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab765B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76EB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit