7ca6c781fbb29e51994470a99240969d98b6183dc2e0b9c7a579354d6630c702

Analysis

max time kernel
98s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-03-2023 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

documentXXX.html
Size

221KB
MD5

51307941145d46d180bc778e8e0227d6
SHA1

6029c4bea4041bf301b96f978a61a4a64a7e9f15
SHA256

7ca6c781fbb29e51994470a99240969d98b6183dc2e0b9c7a579354d6630c702
SHA512

b5d0a1ea8e1761dcff97a4994605b732354f8388e8dc012cf542fd6fa37a00d4ce6a8afd53632f65a631b0f0bbf18668b7a769dc5f2c99081ea3732ebaf7f0c7
SSDEEP

3072:LgV3X+Ch9t4xRz0cmIY/Oa8uclVCFwrsxi4QFRyQ0gnTt+o:w3X39t4x5TmIVaOvMfQFr0ghH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 5070cb3a9852d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d050c24c9852d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000c8154fedd68e207db8c14fed5272cc1ee7404b7bb3026f7dcc2e12ef00d22a85000000000e8000000002000020000000383f54afed0d7416dfd6a186bd8ad30bd1697b3a27638197b44dc6c36d138d1120000000cc678f04d8308ebc5a1ffb57199b56667b53b2fcfbc637bfccf30b2eecdd3f4e40000000e30fb4ab443d6f3f3dcad84de3ed29873afa09973223d71ef802a1ebf056fb899072532fa8985f87609de91942acbea32b2e9a350709414ba203ecd041afed09	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385139147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{764E06B1-BE8B-11ED-9F91-E6255E64A624} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000ceb57bb2ae75c2ec689438834fc4ae5ae45c2af4f34578d589cd0c2945bf5b26000000000e8000000002000020000000336440e8ba136f71970fd09e38f5cd57ccdb5ccc34e525b4b1167c1146fa6d69900000005eea76529fa36adf018deb6c79ef3667ec9d1111207882d31a6511bd7ca77763dffdb2fbf7f83ade12d01c66e44e29b829930f22042fc2fbcda2c1da28d1336fa87c18a0ce5c2d516c94587313b09b1847fdfba74a7e27303b3a07836fb039d60c3e404e18b6c68b193012e090c237efa4bf167fffa8172f2a182f299cda02742447a9298acee0fcc896fca87ad9aa9d400000003d89dcf9ced4114290ccb1103def6043340f6ce8613882425559c1d945454caf31fe50a92ac6c6e95ab40e06240b0e36a3e15dadb4795b3a811081e945741ebb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1060	iexplore.exe
1060	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1716	1060	iexplore.exe	28
PID 1060 wrote to memory of 1716	1060	iexplore.exe	28
PID 1060 wrote to memory of 1716	1060	iexplore.exe	28
PID 1060 wrote to memory of 1716	1060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\documentXXX.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b58dc1d16f0b4cce409b9e95a90d02d6

SHA1
5a528aeb717d96bb6df71b0d28a95985b79ab5dc

SHA256
24cbf2e81fa7bf765bb191c10a0bfbca046f1115f22e8baf889e04a916e71524

SHA512
fe7450b4883f414b2ae27a942ce1511a24b838edea6ed4245f5c54ece67d53ca64621fb988dd2afa7c184c230bd1a4b90d2c89b2c11402b9cd18a1fdcd80ee9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce9bfa6332f91a0d63568738c5e8930

SHA1
238ada4b41e7796af243c0c1e30ab3a5d5e05079

SHA256
9e54597c76fe8dc69da9cf8408537cd3fbe14b6aee4d766f1a609c7cd581f16e

SHA512
4cfe8d2ff39f7bf386b64424648d7656c67a15ae68f610615e7b764f37cd3a6a3c0b2240d2a05f66c4fd8fe851453ab4ce42eb5489bd7973b6116d8ee4c9ce14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f56639b8c027897f1a35eb9850641ffa

SHA1
9f5087f5955cf909e3659139d51b9f3771ed6a58

SHA256
989f8c2ef73cd655ef590d870f3bdac5d02c1aefee43195f97715ba765de890b

SHA512
6680f6c34260071e82ed1fa5667a0eab37ca34b058ec375bf9a6a60fb2934b2e95c86e9651c1dbb6b1db2c4d4019471982568b788de58e45bc8c84a7be82a0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e3fd5b0a887db3867296797e12d2a2b

SHA1
997285628ca9bbf90b723c26b0e5c68d0e13f20d

SHA256
d6ddc8d08b7bd705f5cfaf1550d4edc3eb4b79c6262a3ff7c4df6095d32cab96

SHA512
b5e13d1cbf974dad16cb51835c7fee78e75fa6dc7776e780d2f1c96fa327ccea0c4f78466e1dfb2a5b74cdf766b29996516641dcd69f27c46bdb288b8b40993f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c6ba466fb063f22d25ccce82ffc5f12

SHA1
6d48318a0235b27c92fccfbd1bb18d85b0236b81

SHA256
a8339ab25908d9ab3c0f5502c5e877d83ccb18fa212a74bcbe643f444a795c88

SHA512
76a34e786e2a48e5384660037d1561434df96512292cb1c35453d6aa69b1c22feb0743db0411b1f81012905e8b4f6169fadbdb55cdb6cf5322f317b017a35977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ce68c3a0834776820216e97b9aecd8c

SHA1
9c6ec002a48192ba8754b732f24f1ef1f9a917b1

SHA256
7b6da760efd85ac378c482ef728049d22217c4a0fe754900b7c01c3b527504d1

SHA512
c73c8b1e9bf7e1bc662d1b03b580722848ada96d480b871a9078d1633bf981a3dd07b70b91e20b1d28f0343b1dc83c2ee990a2dde6880a4ea4bf8f516c120a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29f90faf17dfc2f253cf74c8710f8230

SHA1
40d933ee02648407435acf71a8e5fbd0199d8324

SHA256
3ebb5ba37319aed7e866a0e245e50c2e722929df6a7b5af5070144bcf9ec5f2e

SHA512
d3344d739101356caff670bec5e8b42ff9dacfc08fd24aa3a540b2335976bc5988096be30b7ecba831979c245fdfe9d9cc6b00f795eea030750502283024c9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98689b61f109ab7a62f7cc760333e624

SHA1
35a0240e3cff3b19a098e9cbd9f5fbc10b3da5b6

SHA256
4649af22c98aa2043b01a8dd72daf5150de84a7c89738662c3828feb69e11529

SHA512
8bce5bafc3c3b1fd33f01ebd270fce4e4d1a4b98b2146f854a77b85c86238c1e32c588873526636ddf81ace4fabb71b234751735eebf391c546eed9ae6efdcf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bb930e1a63cc535dae20c632bcbf2c4

SHA1
7b8f14c3cb77f42b801cf998af7dba5463303df7

SHA256
5cd3a74e2777548e01ea700184dc5a217099bc5e886a08521e473088e23f200d

SHA512
393762079ec281cbbe8eb595502164f3f0d6e429fbc5c30ed40533532d82c813d5d927bfbceedfa844228ef3182648db374b630ad0c2be8087590fba8bd08f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85e7893a4a966db949b54102c7479a0f

SHA1
26c958ad321d6179ee99dffbb26b551ea7fc10db

SHA256
323035460063c656f900f038bc391cda0e92d9a3d31798a0ce259560ffcfd44d

SHA512
f9c0ee5a923f325d1d42ea7f0fa0a8a749f56f3fce14f00bcb9144ec8c6df0fb44fd17fbd0ccc5b39efb99deecfcd6728b69224ef99534a054f3da1bb89342ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab429E.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar440D.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3HC1O99U.txt

Filesize
608B

MD5
a5aa2479dadb9888cd810ffcd3277670

SHA1
9c1e5093fce15a2dd374c791c7d65f5598221b9c

SHA256
114acf7d592d6727c4426672d733659b9c2a5cd69f6707c10df619d48c2c8f4b

SHA512
ed1d4d1195f524d9a541d67769a95592a15bfca91b978e635287889756e1183d01d3dfa6bf9f9cc29df2a31b4e9220152aad399b750c609d6ef68b137aff4512

Download Submit
memory/1060-54-0x00000000020A0000-0x00000000020B0000-memory.dmp

Filesize
64KB

Download
memory/1716-55-0x0000000002C00000-0x0000000002C02000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads