7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6

General

Target

7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6.html
Size

1.1MB
MD5

6033e14dfeb0699ee4c1bd6b9c5ea95f
SHA1

a5e5776da0391a064cbe823822956c0137cef76a
SHA256

7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6
SHA512

b2a5f6543eb830b675cdad7041d5529634ccdcf6ce8de89d98cd7cddb8adaeec56d6f9104d92808d276f2e86e7015a2918fecd8e28b41c5913e511637f264c6d

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

calc.exe

pid process

2524 calc.exe
Loads dropped DLL 2 IoCs

Processes:

calc.exeregsvr32.exe

pid process

2524 calc.exe
1064 regsvr32.exe

pid	process
2524	calc.exe

pid	process
2524	calc.exe
1064	regsvr32.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a802b75c6650d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cc97483b98d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{0683D150-3CA2-453D-9CB1-73CD5ACA79AD}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001dc630fc7f94384e95ed22bc467cf95a00000000020000000000106600000001000020000000a61fa9657c51b7a947266c17cb298d575c235466ab5b6e5349f9e4d076b2ec37000000000e80000000020000200000006277752c220bb028e56f66b274c2343dcc84225c41acf554e05c377503e2979120000000bce6d9d002b31a5b3b7cb9ba7b730acb2f72e36c495cee552f85b79b0e4344b5400000005a4dadb56f6106e9cb9be4e81a241978b0074e87dc854c371f1e7d078377df977273437672d357909599ad40e0da9e2497ccc8fb4f8430d62127cf23b0186c61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1339319509"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1339319509"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364045179"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a7e1483b98d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30971963"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30971963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{71978435-042E-11ED-B274-4270B13CC2D0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001dc630fc7f94384e95ed22bc467cf95a000000000200000000001066000000010000200000003099f2935771b8a100e55b5ccf2d9c511c569da4354f0f6da4a1826155750a42000000000e8000000002000020000000ead6c0287b9bfe024d32f749516b0329e9c29613074cda59b628042f99b18b5e2000000013a55e1ca163d75f29686098607222502c63ed456fe7e4c6880935bace94cb3e4000000054c770c8cf352a07aafbadd90582deaa0f1ce09a9feb5b28c8b9ceb1592f15479374604525f0da7e74683703f03f973acf866877f5bbd3493c006e0298c46b84	iexplore.exe

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings iexplore.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

iexplore.exe7zFM.exe

pid process

3480 iexplore.exe
3584 7zFM.exe
Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

2640
2640
2640
2640

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	iexplore.exe

pid	process
3480	iexplore.exe
3584	7zFM.exe

pid	process
2640
2640
2640
2640

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

7zG.exe7zFM.exe

description	pid	process
Token: SeRestorePrivilege	4060	7zG.exe
Token: 35	4060	7zG.exe
Token: SeSecurityPrivilege	4060	7zG.exe
Token: SeSecurityPrivilege	4060	7zG.exe
Token: SeRestorePrivilege	3584	7zFM.exe
Token: 35	3584	7zFM.exe
Token: SeSecurityPrivilege	3584	7zFM.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exe7zG.exe7zFM.exe

pid process

3480 iexplore.exe
3480 iexplore.exe
4060 7zG.exe
3584 7zFM.exe
3584 7zFM.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3480 iexplore.exe
3480 iexplore.exe
1856 IEXPLORE.EXE
1856 IEXPLORE.EXE
1856 IEXPLORE.EXE
1856 IEXPLORE.EXE

pid	process
3480	iexplore.exe
3480	iexplore.exe
4060	7zG.exe
3584	7zFM.exe
3584	7zFM.exe

pid	process
3480	iexplore.exe
3480	iexplore.exe
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

iexplore.execalc.exe

description	pid	process	target process
PID 3480 wrote to memory of 1856	3480	iexplore.exe	IEXPLORE.EXE
PID 3480 wrote to memory of 1856	3480	iexplore.exe	IEXPLORE.EXE
PID 3480 wrote to memory of 1856	3480	iexplore.exe	IEXPLORE.EXE
PID 2524 wrote to memory of 1064	2524	calc.exe	regsvr32.exe
PID 2524 wrote to memory of 1064	2524	calc.exe	regsvr32.exe
PID 2524 wrote to memory of 1064	2524	calc.exe	regsvr32.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3480 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap20255:100:7zEvent28613
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4060

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\3590\Report Jul 14 56956.iso"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3584

C:\Users\Admin\Downloads\3590\calc.exe
"C:\Users\Admin\Downloads\3590\calc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe 7533.dll
2⤵
- Loads dropped DLL
PID:1064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\3590\7533.dll
Filesize
663KB

MD5
813f8790abac50bd495c21b679a5d54f

SHA1
21739063a633c8c81a9ac04d3f8d48e11e536038

SHA256
0ea61f67684730bdd6c5ddeb74c32d2622f54006b7a3ad5cb9c45dac15513eed

SHA512
165837bed0344ff6c2087ab056df448c3a9a6a0c28008060b7b016b9781b708fd7ed12b7070ea4da88bd32474862b3e8d565395a10e7aba00d78c9a4e9bda4b4

Download Submit
C:\Users\Admin\Downloads\3590\7533.dll
Filesize
663KB

MD5
813f8790abac50bd495c21b679a5d54f

SHA1
21739063a633c8c81a9ac04d3f8d48e11e536038

SHA256
0ea61f67684730bdd6c5ddeb74c32d2622f54006b7a3ad5cb9c45dac15513eed

SHA512
165837bed0344ff6c2087ab056df448c3a9a6a0c28008060b7b016b9781b708fd7ed12b7070ea4da88bd32474862b3e8d565395a10e7aba00d78c9a4e9bda4b4

Download Submit
C:\Users\Admin\Downloads\3590\Report Jul 14 56956.iso
Filesize
2.6MB

MD5
dd57dd9f92379afff3a44df0e1764825

SHA1
8e4690c45c391b6a93db0584f164318ce7bd17e2

SHA256
3973fbe964aed7a74d5b2c13f54e876e0e7ec7ff9a5188753c6f9ae3bc0ef2c5

SHA512
985f18b7c394989925b96ca6ddb489ba491ded17ad31552befe24451281ba1e5f08853c1be5113b4c0fb7a16da37261f2abb5f613a7c5ed9a8c2f8d9dcb88645

Download Submit
C:\Users\Admin\Downloads\3590\WindowsCodecs.dll
Filesize
4KB

MD5
21930abbbb06588edf0240cc60302143

SHA1
48bf9b838ecb90b8389a0c50b301acc32b44b53e

SHA256
8760c4b4cc8fdcd144651d5ba02195d238950d3b70abd7d7e1e2d42b6bda9751

SHA512
36b092e22b953a4c984530ee1f3d01aae88084ed8146918316438ee37daefe76ed3cb6dfa39c7a020871a92fc2df0a22b5f4146cdd6437339fe3cff4792db4f6

Download Submit
C:\Users\Admin\Downloads\3590\WindowsCodecs.dll
Filesize
4KB

MD5
21930abbbb06588edf0240cc60302143

SHA1
48bf9b838ecb90b8389a0c50b301acc32b44b53e

SHA256
8760c4b4cc8fdcd144651d5ba02195d238950d3b70abd7d7e1e2d42b6bda9751

SHA512
36b092e22b953a4c984530ee1f3d01aae88084ed8146918316438ee37daefe76ed3cb6dfa39c7a020871a92fc2df0a22b5f4146cdd6437339fe3cff4792db4f6

Download Submit
C:\Users\Admin\Downloads\3590\calc.exe
Filesize
758KB

MD5
60b7c0fead45f2066e5b805a91f4f0fc

SHA1
9018a7d6cdbe859a430e8794e73381f77c840be0

SHA256
80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

SHA512
68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

Download Submit
C:\Users\Admin\Downloads\3590\calc.exe
Filesize
758KB

MD5
60b7c0fead45f2066e5b805a91f4f0fc

SHA1
9018a7d6cdbe859a430e8794e73381f77c840be0

SHA256
80c10ee5f21f92f89cbc293a59d2fd4c01c7958aacad15642558db700943fa22

SHA512
68b9f9c00fc64df946684ce81a72a2624f0fc07e07c0c8b3db2fae8c9c0415bd1b4a03ad7ffa96985af0cc5e0410f6c5e29a30200efff21ab4b01369a3c59b58

Download Submit
C:\Users\Admin\Downloads\Report Jul 14 56956.zip.p7j7ta0.partial
Filesize
696KB

MD5
24d11d69dd2e86ebc0856c346082527a

SHA1
ccf6e1ca31866627de38fe1e2d42517e03d54e80

SHA256
c7728e2e03c96a8d96d4637bc7eebad73b38d5abc87f6032f76ac2b6b7b7e22f

SHA512
0278aa51926810fcaa443e1ef1c2fb2d9a1477e963809861e8cf8ec80215c669c113ad81b1e1699ecf8231b02abd43e2d0db2bcebaed3048293cd39beabf07da

Download Submit
memory/1064-136-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads