c7b0f5e3530cdf399be82be797e28f90d2e526d624183da93fd961484e57ad84

Analysis

max time kernel
127s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-03-2023 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

5KB
MD5

2e75004e9f6446855b1c3043566efd3a
SHA1

a1edfd9c9b4f4cf14574e94548e762efcc4c8f42
SHA256

7a77d940487f5259d969b1f18f5d474cb12095c841de71fd7762b1e823222283
SHA512

2599560cbd0987e9e0d13a7ea70074bb39237da66f6ef355081fcacfd7ebfeb2b47f9b1d9b9d587a63b0478e7f78acb4c05e9e34a36a0c8e6b4b72a64f3b1de3
SSDEEP

96:/d3CQJB9KiUTGq8F+HL/qaUqtRdTv8W5Oe+6WU7:tbKLGD8LDYa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE22BDB1-BE87-11ED-8C8F-6AEE4B25B7A6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000005575bbe658b7e119575c8c04a1c02d77c555a7843e1d740cf21b2e3c63d5b2e0000000000e800000000200002000000034f27acf184845cee4bc7abe782e956fbee4130b4c42dfb90e9e340acdc78ee890000000505e3177b8217097032ce7c0557882a13c7dddf129ad42048b0c0f7e5aeffd8df94d90a316d10470736bffdcb62082e9d5e40f0afc488e5bd01cf68dd8a04f3b2ab34f5ec82966c36e9651c129a88ab1383ca7de53522bef4259e15581757b176bebf6c5719e239ac2f1787d225d6f5efcec13a72387e9ff42a40888dc5cd59e34ef355c1bc796a63ebdd66581190edb40000000cf2334c1621f7d8f72ccb6932392df8b9e4baa136afe936a0733fc71201f6b61166e50873ae9f3632cfa1279283bfc77f859b0fbd15eaa0cc5cba022a1733a06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385137629"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000001c24a6ebe93745aa715bf80ec3c80a47dbd7e559ca4e3e78293af2582ca41b0e000000000e800000000200002000000078872d27b554dc42ace23478c6c41c213b0e0bdd6c4449ce9a9ca5e403ae46fd2000000082c49a9b5afa8f1100f5a8f987b3dfe428d5faf2a30b1d3388dc16873d1a8db14000000073dd858e95138479b2e282dbeda239814a347cf96f928266ab89fd79667c28e97d1c65b22b8265bf35310955dd1485d7bd062b73c5396c17cf407e93d81a6c95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07bdec59452d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2040 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2040 iexplore.exe
2040 iexplore.exe
1152 IEXPLORE.EXE
1152 IEXPLORE.EXE
1152 IEXPLORE.EXE
1152 IEXPLORE.EXE

pid	process
2040	iexplore.exe

pid	process
2040	iexplore.exe
2040	iexplore.exe
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2040 wrote to memory of 1152	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1152	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1152	2040	iexplore.exe	IEXPLORE.EXE
PID 2040 wrote to memory of 1152	2040	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
852d008aed9776263a113b10947d8ad2

SHA1
abb2ae2bf44f66e376201ae98ceb856eb94a2d97

SHA256
f80635c8278b6810e16ba1fc796d3dcfa0be7fea606830605771331fce6abc58

SHA512
fac94137f5c2a82e67760df73357c6dcca4647278638f019012267186e81d5dab22bb89e25364e78724bcc9d313543c6cf46a2ea49a9bf7b187e259e5819f4d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ad3030164d8c09dc82479abb3f4d144d

SHA1
f62567b185bd77439ffb13128d08442647bd286a

SHA256
cfa42ace54eacfec459313e4ff8b30324365a224db97c2320ff43bbafe11c618

SHA512
98fdcdb111c1fc61c885ffc8c4a77cc8e3ca933d2930714fcb67d1b983472dfa91ca5d9b9c1b0c5c1a1a541fe19fe9dd4e60fbbc02ea538ac9746174e8ce22b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0733855a6956cbf2bae801576b5da86a

SHA1
36e9c5dcbb339302b5fae574b4347dd685096a22

SHA256
f593f59880742a820eeb600d1e1f8f69496358416cbd3efbafae049a79517eec

SHA512
68ac30c6b081bb40cd2ebd09b0254e53c7838403695c6bde941f2e2d78109f6a8c69a36e3c9bc8718bc2ecfa890610357f68bdc4f125d6279717c837dc37727f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e402d1eab967e9f85d14b3018680aa2e

SHA1
58a463f812422f9cf505c6b3e24ee98469317605

SHA256
dcf22cb26983b30e6efec3f71a0c48f3d1f92f57e6d54ead4aa6bea9397bde50

SHA512
b3fa2ae53b02476d52ef1f0a3184c210a8f81fdff62fce15e59d27fb84522842c6a11ebd286f91b18369a0bc092cb5e5a6fec4aaed727e95b8d80c22e46e5bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
46e7a50b11a08f45fdc7ffeba2d4aabe

SHA1
27ba38fc6f9984f53486b2549c5235a1367bb5db

SHA256
9bdf573363c4bc870b67c0e6fafb71b9da18d038538301fa199f37de8715c150

SHA512
424c6fb726601c9bc85a45074c82acd6ba86c65d41ef25274e0c269374fb19d416b295a51eb3c3c06d8c1733912497888c2390e7fc8ad6cd39760093e7f89161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c1fd6a40f0b96a01b224ef6f8c8c8680

SHA1
c878747d0294cb8fa5267708f61a3c2d20330261

SHA256
167331e760323f54e90806ea2f8277213ff3c1d9ba1e234060f1be61dd192189

SHA512
a1105ce36b1e36709aa29cbe20047ae4af9c2d4ad738205f0a201ac48d3321f98045e9da85bd152abaeec9acabdc8b5bbf60c3d3cc3598e8d360b2ae922b43b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3d8aba2691b76c17a5f4584fe74dd42e

SHA1
81e324ddc3134ec62e5d447cfdd458296049e5f5

SHA256
057717f53c3cf6bfec36633ad4642b39ac6684c3dc25d1c4584da9e6b8dde433

SHA512
2ce75d3c3f89682be0dd711962b22d3e20911b14e135ef7686d668322783bd5a43acc495e8b5e77e858466125b86a23f5353b7bdafd8fe15ea9d3c36beaf17fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab458B.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab463A.tmp
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46BC.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T9N64U84.txt
Filesize
605B

MD5
656ed8d33a8369cde22884ef69946525

SHA1
7558ad3fb0d3a82b8fe944c91328eb76e6f48ffb

SHA256
b59c5a897c9c9dc15f8cc681e8519fea5eb7eb60cdc3575d6817ec2292eaddd7

SHA512
3212479988f949bcb5caa5c5e5d92ba403e07f61488508378a87dfc0c888ac8d2c178aa02266d2f35c065bc6020524ac8e7de99edde7bec5d74ef0f75a6cafcd

Download Submit
memory/1152-55-0x0000000002C00000-0x0000000002C02000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x0000000001FF0000-0x0000000002000000-memory.dmp

Filesize
64KB

Download