84ccfcfd4a43da5a07e66e6306626f83fea4edfc75c2b779a8f12b5caa6f350e

Analysis

max time kernel
194s
max time network
196s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/03/2023, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84ccfcfd4a43da5a07e66e6306626f83fea4edfc75c2b779a8f12b5caa6f350e.html
Size

9KB
MD5

dd3bbab8dab95708a15b8ed1ff31d41f
SHA1

2271fe21b2542a059789ec86686dd1381e7dcb7b
SHA256

84ccfcfd4a43da5a07e66e6306626f83fea4edfc75c2b779a8f12b5caa6f350e
SHA512

28d0644351672be84c4a8a91655179ed7048dff8bca2ed73b4e2eb1ba08bedbbf1e89f5de4eb72da0ad2a239cbdc06d2c264ffb952351c0cc563dd030b3a1547
SSDEEP

192:ILlg+wuv13xV1cSHYumolduIINNM5cIk+Lx4AgCXtTHxxSZ1yz:I5g+3v13T1FH6M0IIP9IZLx4zyt6u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385515452"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000d4e80007396f169e8f2d5ac7f3127174170b9a70ceaa9c46b9e1f6d7e7154f7a000000000e80000000020000200000006fef311b9c1138cb71d71e6bdbdc5afaaae34d50fc32bd4d559d179d0c16f2779000000089a34870b263b2dee170896673994b32f9e653d000c5ca38452620c46b99244b4dce8b6614eda0bb4781712aa11492905ebd9b600ee10b8489c321557deb206e56754699821416bb96411eadc0f3ee0fc542542979e18621d08e5cb50a8eb35349ece2c48c3d6287255884c76b22d3ca48cdd47bf5ca5408ad36d5e8b2fe6e182c77a013c88616cb6c3c628210cdf35540000000898e0e561edb2277077402f4af927b7231d2dafe6a59cc9eff83ec3012468a9c309b04ffafb456d035126b2ba2b30d63e9525e583e86121f5386177bc3095b10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000004b9547d0d914ca8957be58ad66bb44d2b1997f91b30bc761f1410ec19ae875c4000000000e8000000002000020000000bf7a0a03630c03a25e34dbdd1942b7ac60c23695ae4f5535b906d719a379caba20000000e582335534ebadac6c15b90417f03fbf9366b2421cca881ca4dbd9d7c39fce6f4000000066bd793fd6b90439bda3a0af53bdb586c9b9296e56c6429ab6c73ff1ff027a43823213f78fc72aa3fd1c1b9470553dc23d6e7fa2da02fd50e78033d45172f90b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903196770456d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D8E6071-C1F7-11ED-B1DF-CEF47884BE6D} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
924	iexplore.exe
924	iexplore.exe
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 688	924	iexplore.exe	28
PID 924 wrote to memory of 688	924	iexplore.exe	28
PID 924 wrote to memory of 688	924	iexplore.exe	28
PID 924 wrote to memory of 688	924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84ccfcfd4a43da5a07e66e6306626f83fea4edfc75c2b779a8f12b5caa6f350e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f079c85172829f0c700ba9c74ee47c1

SHA1
e504ff813965d9ef75c05c03b2b1f8f10ba4164c

SHA256
4b481211031f3d8d15a08a27024155250762cc33f0d3bc50a6837f0a3d39dcd8

SHA512
a697b9b6a3940dfb270609c3949a0fd9d04e84638b07b4a3e59b3876bffc6f2f251a2b504b7cf4f4259fcdb6fc24ff84d4093bf02c986ededd3aab00127e8c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13f90c3846df80a503abd35cc2d9c6e

SHA1
5541e5ddeb90f83318fcb02c188cd9704e88d5cd

SHA256
2b1327aa824a206ccb85ec0c41dc7f01ea3ebb96c49a46ca011ef70ae30c095c

SHA512
8f140e63c914517087e82a9aaaef9d8906b81c96c8c2fe1b164f13d6435eade8631a97b3761e56902dc0c54a859019879a9c8964591a9a219249194a2590021a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86509134b8fff8efcc1729541d1656e4

SHA1
0998621d257e8a2afbf189227b73310148c64145

SHA256
c0095cfc7390c848e55f3f000996a32e764f1e6cb01f2f8769e1efc9eda3fe2d

SHA512
506dc7ab32c950cac4bbebe31c15a324f0e5ba6cbbaaa64164e1dd319a16181f51a747683266ed3f7426e4894542a3ef2f3665171498ca0fa9e345e6fec3af11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2376576b3ba2e98b7296a64c48890b3f

SHA1
29a0886f6d6affb15a2930a8c90e475e041afd21

SHA256
4cff4d69b75411b715e88cb64e59717230f73a3d79a8e474221220433b68437e

SHA512
ee75662d695513698968c9d6b4a51e6a58da8962d49319a08c68d01c0dca9f9a95c3396d98390a7a91b6aa0a13f95147038283176a96598037223840498f6781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61b73afac934058bec3f7892381bb29f

SHA1
433b15b6c49bf89ed53996c9cb7f3e6fb441623d

SHA256
2c4468a047bf6c96c12ce37951b824d1a4cee91a3dc7181054fcd9cd3697d25f

SHA512
85712af3cc2ce34fe17fe1725683f25989ec150804f2cdc5c1b60bad6050866105774654a3da972ad8967bccda3d99a27e8d4beac5cb55105ca80848a994bd4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99c6d4c17cdcf2a35ddff7e3e4135148

SHA1
ace8c40b28119d9a5cff3c95b6e2f0d9f1e00d6c

SHA256
4c9f773ab608863228bfc852ad3ee96bcbd0de665cedfe01b893c455aef0eb38

SHA512
aa384882af289040ea555d87f642f4102cce9ec7d551fb1ae83976e3c690f1a6616208fe7fca511f008b0be92847d8fb506166c0089a24a120aca2cd8dbd6ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c9cb3702c05995b8c7d034a6b379736

SHA1
0df54ec78135ab14f9d3c571c1978fbbb597e8ef

SHA256
1241a2dcbdf075be010b2cb06e453a1b3818ad76949e127dec9b86f8d68d686f

SHA512
395e9ffa461a316a45b6a38831187b98a59f8407f4946af448d8ef74cfd6d8303ae06b50e39f624c5d430bd873f202cb8c6001499c012ccf458e53bde876a7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678f47684c1cb065058cdc5e250e220a

SHA1
68ce5da7bcc428954369d46e1c1fbae157264677

SHA256
ab5fbc5077354adbf74a7c6befefb78ec8422cf717d820bc9b98df3a48a4b583

SHA512
9f2cfaff1ab54fea2da0a2618daae5cc3d9b7ca41bc1152d7d744d040df7134f14d8d2198a8777df610be8acb30b8ab4d22b0146a93bc84dc746b3dacce63118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7af5613aaebc7c69a0dd8489b342d1

SHA1
9a64c4d3fa298ead05420e4a4ee27faec8b05aa6

SHA256
f0d66788ad6884eb0654751ca10ac0d5a4ab14c793620964c9fdf9e2c2ea4bfe

SHA512
28b1c04c6b79b30617a1d688c9549e63bac302e54ee765d66ac6fa672e654538980a3bed145391531eb0baa3f22e8c49ae0583fa0e0293b09cfbfa4c9c04dec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2263d54f8b73749df511bc096cbc3e5b

SHA1
2284599191b5b8270e32ef8c82ac366efae1127a

SHA256
32d80118fc3c622ef46a9dad8d329ff517e9606f1ee81989b75c2267713e7f9c

SHA512
694bfb4492a1c166475984f96a7214f6fec7034ef4c5ca89a11a2cf971c694a0155a62d2e9484e5817a9ce69e131a946febbb3c22497f0a296997cbbc076acf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c04ebbf7c6ef8820d268e2987808c33

SHA1
087a586398b0dd0f8ca73638d433a3eabe520bae

SHA256
1c1668a04e0890db2f415afcce5573d987bae49328d236f7c71be10cd3c3c043

SHA512
8c6a1088888eaebc84fd36ee123393ef4f6999960660bcb48e9c858f4bac1b04a6ee304980a4b5d4ae52a48443dc604dad0d4478681b92d16d9ec24e6110b326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BA5D7P93\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5831.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5833.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C8D.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O3RJUJXI.txt

Filesize
608B

MD5
09389eaf619f59321039cd2babce296e

SHA1
80bd9f4ffce357d84498b4ddceedd8c19424719b

SHA256
6f83d8c0305274d1cbb8fd6f79f246449f8e3aca17b619189c95bc07b2e56f5e

SHA512
7f849d4ed026f634ebd9e30a640721b2ebbc5822167f54900ccc6d289b94cd6d946f84152114d41431c1b75c8ee479b7146bba996e292ce93d6c51f82754d36e

Download Submit