d66ec368c1f0c2d61f6cad21c6c0973fbdd561773af184fada09bb62d0309e4b

Analysis

max time kernel
112s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

484B
MD5

e3ae7d7a38830ce2a3ac5229f3c766c6
SHA1

5fee2ff08ecd5a7ca26452725d6d0a5ba181549b
SHA256

bf3864c410c5c5296c19baa136d4b72968fc5064d756ffca5ac520a1c6822869
SHA512

11d06d189e799e69c0f6c40eb71c7a64fd1542e040b7504995fe0f4fa3634e71ac443228c64648be64c62e7857dc196b61e022288020047953090c9fa27a1746

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca000000000200000000001066000000010000200000006336e3d77585d620074aba52e16f9db3db0b38f44f70d3f41c4ec3a51d62a57b000000000e80000000020000200000003fcfa0769c0d3623343105871140f72a3943dabdfe0e7c40aa1e95e96397d99290000000ed7e369a0e0a5071cd72a47d5f83f5c3def4b1541edfe5355b7ad64a3fea6e1f98e75754613c4fadc9a38cf30260df207a8aecaa8e7c45c932a9a90f5d757325aedae179b9ee6c9d63f068d133cbe22a454c1eed69bda80424d55a1a415ff0e3cd54c9a83272b86eb007d13e375ba8b6e9efbe1a5c3ebe29e03692bad5343e29115760d5dff5effec376466eb7b1089240000000d5f3903b6ca8bf533eac9f9e3fe64aaee7626bb7910df4df11b71d2e98619d0b10acdeacb5067148edc553224cb8fb2c688b6347d8f9dda50783abea4f15f5d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B3DC111-C17F-11ED-B2AF-D28FF4BEF639} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385463827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0088dd418c55d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000089e0a75820c7b113f83d44813e498aad989d4941fdee9f81d46ac2fc6554c5e3000000000e80000000020000200000006b8c6ed12091de688fc46937edc4f66c0069ef2864999ab06b048fd87c20e8dc2000000059e9fc2fcebf977163609b2e8e2808af91016b34eedeafdb0a4ba66d88dcf20b40000000c212b532a6f71bcdd525912e5a9ed4ab950b825fd34c824dd4f5d95bf1354ed20a16414e5d6f0d299358ffb30be79eaaa41bd1704e830e380ca086869e6cd26f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1680 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1680 iexplore.exe
1680 iexplore.exe
776 IEXPLORE.EXE
776 IEXPLORE.EXE
776 IEXPLORE.EXE
776 IEXPLORE.EXE

pid	process
1680	iexplore.exe

pid	process
1680	iexplore.exe
1680	iexplore.exe
776	IEXPLORE.EXE
776	IEXPLORE.EXE
776	IEXPLORE.EXE
776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1680 wrote to memory of 776	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 776	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 776	1680	iexplore.exe	IEXPLORE.EXE
PID 1680 wrote to memory of 776	1680	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edc7bf1c9cef2f340a315e037d8bc708

SHA1
9badbce7554eb1533760f905f4c5fe43634eccfb

SHA256
b4fba6ada5e0096b7c92acb51560c53ce7a3e482c3714e39c7eb0be029b95c5b

SHA512
9008ec46172f5f4b80c7594fe1ac1324f170234d725466843dd39d245ad9a5d7e77631d21775ebba0783f63f539aa055aa540a586ae515850901dff7d1c17c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7891ea7903938dae9af1569297f6cf4

SHA1
530fa5f8469efb8717278d32ff8897ab7e995956

SHA256
c914942c5eb91d2e425ac240e2672bcf50214437804d96d7a9fdfdf75bb6019e

SHA512
52e4ee9972cb6f09e8618481148885401c335590ec53b70cd690a910646103d3073fa33f329a7a6cfae8e70c0973027dc85c2aac3837aaf10f9b622d1900960f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d771eba23e38f017586449e1d2df0bab

SHA1
403acdc28086853d7153227b1abc4808cc0bbf84

SHA256
3171dcb0c91466090b98f6dafa3f5304375d0a588ecadff96a0f7f44dc7bf74c

SHA512
c3955d73b0b19973592eadd03babc66e38487e71ca0fd3b6c8685c52abd73f8dd7d428bef61e22a86ca2a7311b3520b12ae11dfa35f78372b7a0d4a26119d1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21463b388b987d9e9a12c1c97f5d34c7

SHA1
f6484a6215aca3fd86aab052d7a174dcce804dfb

SHA256
eba7c771f916ef548bad288a61e7eccdda8d3a51f266b3e5bf5ea2adace391c5

SHA512
9d371c5b4cdea3d424dffbd85e8ec1144b1e665cb6e8ff9f519285bfb23930d6e5752eae8230c1dc6f7e48bda09e34cedf244972698f4b7c77fc9ccb0cb67b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
073738389e8bc07f9abb5c559078100f

SHA1
4ad908ecc56790756e241b7f26d80a85c02681fb

SHA256
3766afafa1b3aa4fbfccf9291aa361b56d63812fc630e8dab39e4620f1037aac

SHA512
0dab9a26c9e886610bb09e4deb1118ffe69cecea36e0e8b2818f65e16bd4d5032167c642d3075d420411a121a03b77d397d7418f46da79a7a97281e36e809b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c06c58f9347c3d4ee8eab5bf5ec96a

SHA1
6a27788942a5a3e150fb4be59dd895472ce29e2d

SHA256
b740a2a44366a83c2cb649c7d2aa8c748c93588f78c97a5318f28567501098f9

SHA512
64b132a9fd0ca3d4f4b59ed391400ffc9e60b736bc968c44d169bdd6a9d31a23ce6d9d92c2a584e51145c47addc668bc7e3c047e95a3d4ba58b6ac9f2a29d40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
583e105bfe720b4be5259edf4cffd148

SHA1
baebf1ad34d57635bca891c802699ecc33bb0cf6

SHA256
43897f9da57be3a46e5a86e0333c58dd6072344a017b55aa8834731ddd5082af

SHA512
968c5da5629001f6a19a265e327f58e9482401d00cabb4dac76406bb4d09be6c783ecd3a73a3f268e34e3924ae4dabf6e1babd3464bea3f627dc7e125a74a597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
572fef0bcc4386ab1bb7c6cc0a46f156

SHA1
8110c56c680a89f6ee34d08cf9d7609c69a32eaa

SHA256
a299f3647e41f3a7c754e3fc8f537cb653c1e911127a11e48186292ee0ae3246

SHA512
cdcfc6fc721c4513158bb7ab051801c141c43ff1591b9c00dc606084c4e718167829dcb8542a570e0d7efdccd21d1e615c737dbaf484fb799b0d512edae6c85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64e7cc0f00b6d2dac169b45b5cf0e7bd

SHA1
06e6efdcc37d06be197316b2c348cf6b84044648

SHA256
b625f144eb894798432d688e38e1a0b44f48508fdf036145beaabcc2b7104fa5

SHA512
76f2bc158af7755a75737c59932ad06d5da82618870ecbfb24fdf1d2b80d8bbef4917a4f6673804723bbcf7da5ca227a32541e0f4048d5bc989e77cc89a2c03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e0d4978a45d21cf1b28977b762513dc

SHA1
6e3135317909d030ce4661e9c2be4c553e9e9d80

SHA256
bfb78a6e3bc1c5d548d77e0719ab6d63f8640bd88587fe20bd27c627f35f6d5d

SHA512
6b36be5209be0dd796a089fab2e2656b6313752e9dc4bb6ee01b2cec66e6fcc175d619fecdcd68b297816072aee57f14d4ecb8e38920272aceafc1f5e56c8c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D8F.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3EDF.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S4RBGNVA.txt

Filesize
602B

MD5
6233b8ccd7834e443ac69869467cb1c2

SHA1
4e99e820729fb272d9ff0b9dcee6b634c625043f

SHA256
0c127a78e8e11fd6afb46beed1271580c4a5c2dc4739bfe1bc64d02a0da9c25b

SHA512
c82b1f450d3e22a6f153f9a0692b553251f8b1c6215d905d6e300ff3f98b443bfa38e7de0ae64adce1ad16556ac4d8cb51e8a2ed861aa61d5b91ddc9e69bd5e0

Download Submit