32ca6048f3923718fecb5cf59b630b29c1b18358ed6f52e1f2954b5a65b8faeb

Analysis

max time kernel
165s
max time network
172s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/03/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ca6048f3923718fecb5cf59b630b29c1b18358ed6f52e1f2954b5a65b8faeb.html
Size

9KB
MD5

5d6a5d396932cf281989c5c3b8973575
SHA1

273822ab6a79d1031af704c0d444b6d63abd0bb0
SHA256

32ca6048f3923718fecb5cf59b630b29c1b18358ed6f52e1f2954b5a65b8faeb
SHA512

8e446e125bee202dae6e8f364f90f497551cae81e195a9e97ab2d9d93047bd22dbbec649e6d83590db9b3ecf66314ed6eda7d554327b117a0fedd4a83f07eee4
SSDEEP

192:ILlg+wuv13xV1cSHYumoldYHIINNMkcIk+Lx4AgCXtTHxxSZ1yz:I5g+3v13T1FH6MAIIPIIZLx4zyt6u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384909702"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E6D0101-BC75-11ED-8C02-72D88D434236} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000262e9ad2f7bdc7c58bd1006e3c2f2b6066e11556a293aa5ab1d8267b903f97a5000000000e800000000200002000000060c5b0af982283d75c9106d8d8ad02017e4d10384e4751dc98b9b3e97cdc2b15900000006d8e7a648482a1e4208bb6a79ce74e411456218739360616c3c432084e6a432969b205c83f561175d190b5bea846600a21d186430935e93f27ca0b7405e6805fa8cfb06fd16c035f0b9e68e2c37a957d1b9ef15c62ebd1be898268350bb710a7c22d8892c90dfcf65d348ca71780ad2e9e10d09f4a6b14d08799dba8e4e3ff256763e69bb5087aba23a43a39d50b0c0f40000000332cd7643f1d6b1412947bc6b9468ea94ab73b40034b0e1edd93430681319ce7deba1d00d604e33e80045b8fc9d004eb3afbe00a2b7e9aa25bab986507098c71	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c159258250d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000070fe4dbd811e650972947ed0434cf52e2e80395bd156e720bcc0cf997bc1b6c4000000000e800000000200002000000093f18bcc15d7d5c470f4ed92182c3e1208e524f59780cf4190c1062124fa17f4200000003f1d295f453d85ef22400e847ef1c0d518a5d00b5d970f107f6e8f8948c7b10640000000c79155cc4e42ae504290544c1782766207c47588beedc1278cea34e73c2c339673bf23d8b8ddab56a7ab2d5c365380cce3ae3fe9e86e4792eb2ffdf92f7c58c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1372	iexplore.exe
1372	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1416	1372	iexplore.exe	29
PID 1372 wrote to memory of 1416	1372	iexplore.exe	29
PID 1372 wrote to memory of 1416	1372	iexplore.exe	29
PID 1372 wrote to memory of 1416	1372	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32ca6048f3923718fecb5cf59b630b29c1b18358ed6f52e1f2954b5a65b8faeb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F

Filesize
7KB

MD5
3828fdc09f71bd09771ea62e0cfc2625

SHA1
a405b9150f43b37c859783fff370b7bbba8951ca

SHA256
c8418a67f49f6f95916f7d316fa340762a4b453ee9276700a64a698060f43872

SHA512
7b5946e5ac3c06ca503adcc146050a7cdcb5d8b6aa052f5deff4ab0a57f2c45a1c640a45c46c673687f173c98cbdbc2507e142dfdf322ec94dcda230e9518e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F

Filesize
232B

MD5
7cbce25ad6f26959f8db7065871ec0e3

SHA1
15ca10b2ffe9e17f8bb3c56ffcbaf149ea5905bb

SHA256
8c68af161f432c79effaedebfd44a087eed3047047935108ad4c3e9e4edf59fb

SHA512
fb1e371b4ab66e367c1dbd4ad386c4bfd1b8a09ff79efde6a80eeda2f66a87c587b9bd37e85f7f213174802d5d6ad035b6c60f7857ee6ef112a33b789ccc7b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
128464b615f19fb54a52422848e2a70b

SHA1
a934e7e92aa7d35d8051695d930b471c66611aa4

SHA256
1739099b7dc89539c8a856c7fef5c4d5f9b19fa03b15c0fc7a6cfd0274eb0111

SHA512
a8f59729531de3f2ff3b9b319b2f473799a3c7ec272ffab8ad363a081a71773d0efe51a9b3074626cc04d450cce2e63b0cdcae3c9f8105cfc3ddbff04b7999fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eaab2f2bbffe7259c915b11d35bb2f3

SHA1
9298c9b6e1ee512e2497084d6764d0c6cadf9f0e

SHA256
1608b640bf82de72bd703678e379d45b0159eece39407c9bdd41e5554475c093

SHA512
d3ad3aa07359851493b658341282449cd769b48618d8f704d4730d802d0c60fe12fed9166438f28e5296a00a9e68b0f31c1100b744db8d211bc388a7da8a4fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b260855682a550fd024858de2b3a86f

SHA1
3b172f4866063624696a658702f14203762eee15

SHA256
782eb1d2ea79db1a5bfa39cabcb83042233017153ce451cd3f7e573d71afde65

SHA512
60e01a22f6d933ea08e07cf2cbd7c962b6aeb2f674733293ad23215e073d0881516e36c729bc035a2ecdfa51e978c33c9fd190c120ba3e67091ed2a75f94c6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45e248b419000465f23b80acdbba886a

SHA1
59c3bcc0295523e562354e0bbbb3e4f25322db8a

SHA256
409558083e4bbc333b704a22ced06c2cad12a811c02c65b3b78e49752fb837f4

SHA512
23e3e2300c7d953d621576301741bf3094f2ee30f0da5fcd5c3fc173a427ebdf92f96e2da97a00b64af32bf85e9aedb34369e55cd349c3a5a44fccee3e456810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49986a78e986bcb37ee01d24122637db

SHA1
bd936700c16db42537eac599a40760b77a3af5da

SHA256
fce855b3fe13a4fe6fcd860a1a930658e2e3ed8ac58f2ccf6f19fb187201e642

SHA512
55f150eed8fd9ffe96a19b074e5810cdb0333506b8888517e442a5154abd2a6ca3d0eddbc265637438a7bc3e8119c369b077e499883bcc6e94adafab0c6c3962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8518d591ed7ef7dc77d84d5761e2be

SHA1
0525cb49b0842c9dfb2c51d9927fd6bf1e4d9ea4

SHA256
2b2ceaffbf33480b1b948210d4b449d025a0b52f15445f95b305aade0e8aa863

SHA512
0390fd657a6940ba475516807f947e1f40c15349125e40bc48f03de57271a95ced3037b8b40dfaac00c19950e0d9cac44be6a1d791523098802e09d65075326b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a0574a45d88bcb3dfb13ab6c10a6f7

SHA1
774f8272cf12de66a1016bf0b43d88afa114d896

SHA256
18756943e243a4916678ece0c86153d84b0e6ead3924334b6fb7f846c9c54f58

SHA512
0349930159cd0a1467c2d6529b7e12c0f7ecb3d58db523f0fff5e4bdd94f4c0bbc97cfd90a1639f07fb668b43b07cd18b4323ceaf2e84fb8e9f352589762100e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8befc6bb3c5728bd2ea65a02946037a1

SHA1
e80da50b0e9c29a93f28019dd854161569156526

SHA256
4745cbc99383b5593f7771bff6b1fd5c4bca8acf400f5b3911e718f7e47f5cc4

SHA512
46743a83bb977cb860471d8542c7cad3497ff32b9167e328c9c72b0afa0eede3b6a36093f2fe5b4ed547d0fd50a1df4c227ba3bb5c54c1c32e8b7a85339d72de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bceb04d834dbf2b2af7ae1450468073d

SHA1
f3a76953ac9782a48a40df4aec28cf8964c91adc

SHA256
fe90188489f0955e91c97cce7d7645c244b72767fa2caeea7cbf587709603152

SHA512
9407e9d056efd73e15b5b8119d3ca9258acd79496f357526a3a3015aed996f1f0416380c8067f4dbedd69d79bca9d3aeeebcd9a1ca677bdd8b4ee957e4608420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71b259fd3edac00f108b30e7d8263f67

SHA1
d37ad4e6baa4256a4508382c6802663d7563b7bf

SHA256
778e64aabd2f398e94e593aad09df2bdd59f8cb3cd27a20d1bea57addcba1beb

SHA512
8652c8b443cc3c99bf1f4cf238109b97abf7e624638f6a0e65d9428248e80bbce65a9b494afd33282c50a4f5821b6a5b20fc163f0173bf3a57b827d79ee622ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T210ZMR0\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6DD.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6EE.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA86B.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EMTEHQWP.txt

Filesize
601B

MD5
b88df0ddb3b8e34af4a224917fb95907

SHA1
34e5f8bac1a674042cfdf004b6ded6d2942105e7

SHA256
01ab83f9c24720b3cef7936172cbb843f47c47aa88a35464d1bdcb1345fb2c2a

SHA512
40b3b479b0fc3fd70feef7c8b1440f23b6c5e023ae4056b2b5245d553e59d5c11f68e8ffab94fdcd4958ef83935c97ddcb4d786a6ff94d744f2310eaf109beb9

Download Submit
memory/1372-54-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

Filesize
64KB

Download
memory/1416-55-0x0000000002FE0000-0x0000000002FE2000-memory.dmp

Filesize
8KB

Download