7b23e0a3b9ee4b789c82bca3a31e4e5d53e5413480b0ab91ee286ceec3b0e1ea

Resubmissions

13/03/2023, 15:56

230313-tdkd7sba96 1

13/03/2023, 15:55

230313-tcvhsaba89 1

Analysis

max time kernel
30s
max time network
21s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/03/2023, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Aut.html
Size

13KB
MD5

b25fa23ed35934d506f3564908a17513
SHA1

7e63ead29311d5fd577240132db9340ac0bdd25d
SHA256

7b23e0a3b9ee4b789c82bca3a31e4e5d53e5413480b0ab91ee286ceec3b0e1ea
SHA512

6b9f541abe3ceed133540b83b99b73b2b15a2dbdd76fce32b3f8a8c6996d5fb7bb4fca61e7770503756475acced9322195fc3fad85053a0e4b44bdd098057ef7
SSDEEP

192:t/IxZY92oRIn9JzMSuBKhFc7yh0R158jTFr+xbO1Bb9XdhSXWOb8+2/EdcM3mkQx:YoRwC00R15ATFOEN9X3EVH3mkQXau

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E16F8591-C1BF-11ED-BB59-EE84389A6D8F} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1052	iexplore.exe
1052	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1764	1052	iexplore.exe	29
PID 1052 wrote to memory of 1764	1052	iexplore.exe	29
PID 1052 wrote to memory of 1764	1052	iexplore.exe	29
PID 1052 wrote to memory of 1764	1052	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Aut.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8c38bd0d0a2dd3648f7619780dac370

SHA1
2797dc6d1a5ae7349364a232a39544ab0319d84b

SHA256
8c708508554f34a41da10bf6361e68e739b33f8a171b5b29797c3d845d0dad1d

SHA512
7cb825a497fd92ff791d6de9bcc914da94bc0c953192be2c1e3ddf5df59249f3e184c02cdf623ea379cabb6045843e422080ca062e35f31ad010b804136c3048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c90929b1f6be4e80235500d056fcce11

SHA1
58290f37456f71eb8d593b2d476dc9a241a6f511

SHA256
0ddf8b352a1806db1659ecedced6fadaea408b5e876199bbf9c235335e85bd80

SHA512
1441f8c7658ec83afba8ff83c69e30153f2ec381b1030cf803c638d73e95e7ebcb0a09876e4f9bbd05d8bdf56b5c8cd77ba466c798c86ae64184fd5625cab79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9b25e4de0c4105f0de6176f5339c32e

SHA1
b99c8cb27952d79cfdcb20f1bb2217667bff1996

SHA256
d952187071bfd2c995d8da7699d82fe17049049a221b62886f07b1aa6b029069

SHA512
5bdfdb02b3d3888ea287fbe6fe052333f0e94074eefa6f3f0714fc6151d60fc06e6a2d9c769a780cd554aa3654211f115234a9eb9ef77f9c6f69621de453108c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c42ab1bd72caba64d84a9ec1af7649

SHA1
11cb5521e2b68b276ef2d50315c1624e6ad4abc7

SHA256
6c6b34bded77104ef3eb131c705a40d62eb65588ac0f1a410d66db34d80aed55

SHA512
0d40248e9776a4799dd56949efc1bc6d1e71c8ed43f53266977cd7e2e398acb2f8c8fa55178ee3a638532a77130e8274f8eb4538d0f322bbdfd502af7df36981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da733a90a7b2e70dbd4c2c04145790e0

SHA1
912230d31df9c987ca861ff39b180e5cac8114b6

SHA256
60ef1c46c4654db8df5e0ab39d82fb226f86006d1b9898af69c7b379bc97b3c1

SHA512
4b2f8a8c1277a366130a52dde2cf67fd1867233edc387381ce441dd2d71d1b3c0d0b9295fea7dde908a6dd787d65e95de0f1e2e759373d527a257d2baf9ab0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b82bb699ff3c603b42b26ed566654d

SHA1
da36d2b6b14861e2e361b127df8d1b5b0569028a

SHA256
ee48e5c8e59389f4a224d62cd7ac7e504edaac5c36840b392c139b6f1fbfaee4

SHA512
491da7d9a561fddcd356656be6cbc059c40e2bee30a3770d825010c36ba31542a5d58463054771e96b06dfbb29c92968154022d9622f0d69ea8833b0e5311391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f957c72817dacfaf863a51f1bbba2c44

SHA1
307eced5aa3a0bde3734b38ce62deb71b88ebcc0

SHA256
eb9afb1c405ad12747050552529200aeb1f1707db38d3616682b3b99765f82cb

SHA512
cdf1e1e74db66e2fc6e3b31d7e31cf5502cb15dac614dc07733de30543fb2877356fa52bda0272ebad2efb3f50308c096d255fd15cb9cfb9b12de2a2826fee05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
562b5adffd299966b3f33d009f9195a3

SHA1
b0b9cc182c8b2191806642c686ce40c26adf6dbd

SHA256
d21aab2bcc628dd0ca3caacd907729836c3d414310a5f2f6c485bb512e3533c1

SHA512
f9fdc83d68c5b00fc83dcd2bb28b64653ff2c9925ec12acedabc856295cb99a9fc0a8a8780e16a91b3faf528e7e3cde80c6f3a45e0c89c624b372a11a63b2b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
839a4d7173b8c6dd3e3edc869dfb797c

SHA1
30b84bc7d4308d9abc61c7ec01589ea5d5bd9289

SHA256
9c806b1b8c39bb28465f4d7e492f8dbda423e0cf80d4d784cfab6a3bcca7681b

SHA512
2020e15dc64b8cf7dfcf26838a8dc28ef68b18823ebef643075d54df05425d8ca1baf46c49f0936e44501b75a40abd6444b1e618b5fb247adda9f7bd0925fb98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
482ee299a2bbd3434bae3e251ad8566b

SHA1
e78df554acc4d71b00b22b3ec4a3dd7d30d21920

SHA256
0bf45e1abe67f0c1c723f70e6acb3a1cc4005974ff8f9135bd3fd7a83843ceb0

SHA512
f08e032c9eeba7d7268b441b7879924fe0939499fbcb679263062baa1fe1a8af95a7c3576c7be02ea6d2ab7a1642846e671d52f79af2c6bcf3bbc4f2a291ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4732.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4731.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4880.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit