16af0efb107711d7f1d72455bb5c0a13803c22d464bdc5230b366c42aaf76968

Resubmissions

18/03/2023, 20:22

230318-y5xaasdf53 1

Analysis

max time kernel
100s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Voicemail Audio Transcription.html
Size

824B
MD5

ede1eb0a597165a9ac2406d769b17ef1
SHA1

5a32ad4736aeda7dc4c5be4f117f7b4a1423a913
SHA256

16af0efb107711d7f1d72455bb5c0a13803c22d464bdc5230b366c42aaf76968
SHA512

e4c8911cb4cda43aaf0836ee3085e72ff1c7a15438e6087d44e8fc409cd3a263fa5e319eac33c84b06d88982f64a30de8b10fcd1946e14fdd8653fb235accc2e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a000000000200000000001066000000010000200000007e4dc54fc976d253a2e21f39256b77c14ed963de594082e357222153adafdf1d000000000e80000000020000200000006a07b5b391f17f98dcf1f8d3e529a43105068c27d9499ce5cdde7dc5f2f467849000000016a9622a72510ec4806b0d1498a134fda8ed2a01960b43d2768bf8070e7504e899def8662276013837107609bd82ce27fb5888af860a8a5966e638994059bc551a378bc65c67eca3ced61dce19cde22d7d99b705ed9224784294c1678a1f4abb4074bc9cdcbc6d36339c0893710fb7abb456c5d2fe025588fac5f6922ae085901121d78719e9ec905b5ac6c7f6348b1d40000000d5d7106db4625a6545dd6a2ff075595be36966c963c3db9570e5d5473cdcf627762bfd27066d89cec031bafaa5af8f1b70b90f54915de0bd587166aed2536e37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000d05917371f6d8d68127e5a00ada6419acfb42b2068ddc567fb54ab41b8a5d877000000000e8000000002000020000000675afdcd84b6ff6d6aabe89417e329379e49de10842f9b0ca8d127e565b9820e20000000e04cc23c905282476e854fed795bc3de9c57e188e48a6b1a148e911c5a57b85e40000000ea94ac3a2d5665c28167e706af7a1e0c82537dd839b8bea3b44a006ee85776187739aa1833d85088f54b1510fed5dce1c8ea34462d066a59188e835e3fbfad98	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0865feddf59d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385939570"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{179DC3E1-C5D3-11ED-AF51-C6A949C40DC2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2024	836	iexplore.exe	29
PID 836 wrote to memory of 2024	836	iexplore.exe	29
PID 836 wrote to memory of 2024	836	iexplore.exe	29
PID 836 wrote to memory of 2024	836	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Voicemail Audio Transcription.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc678b128c860f9593b8574175eb0f61

SHA1
db689d6be1e04b99750bf5f92f94cb109279efc2

SHA256
e83d820b79a89605c8d7f206b92539a6e5c80329e62718b2605ab4c9b41c9ce4

SHA512
bca462490a204cfa87ac9a1402a7c032e1e4d657eedc8fc4f0c8d76bd0f2fa9f931c6d6d7ede991b4cad85514f89e259bac13258eed6b654e79dcccceb4a0b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54e49924ea79f590a87c6ae60b017231

SHA1
7e0bf848dd6e4cc49469abf735c9084cfe2e8397

SHA256
1dca5a4c5b09aebf968db66298294c17db5a278174fc67add79ba7606de31e6e

SHA512
4b16a85c5c535e3e5e2173caa001af3f84c20c440443b7b6590956dd5db543b3af30a2bcb1152b8f8fdb9842ca4623deced2ef66403cf8aeeed5f65a346ee235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b6203cf247515073056a725eb695626

SHA1
b49914965e363c2ae8eeeeb7b7434e204d1dcc14

SHA256
958bb553509e89bf764d1f4ce1bc42e0a5f2505fec4057a3d101dfa1b17a52eb

SHA512
5a5c9545ae5144950f7b44344bcad8423286915f0aaecbf27561a1e1cec35ba646576664b3ebb46457a45479769122a776f62c83bc36b9631e4acebd94ef2a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97488c3d3fecafeff9a67973b5044301

SHA1
dd571095bc65866ed47368e7c23395a5fc21e874

SHA256
d817fef057f1227db0d460902edf60e7d0342f9c29d8d324c916c31090666f57

SHA512
f9cdfee91f89f379c4f97fb72637be9379978053c7cb8a32621ca388e3742b1b5e280ceb0ce7b20b39906f073a31afae6ab286b6042e8661a453298fb59e404e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52193dcd1b4f51168f93f58088e12b6

SHA1
6e123c261e0eb6e89dbff7e6bd233947c014dd72

SHA256
a6ac529d11ee41cfe5dffea7fdf285e39946ce3891607caabd8ebc7f34dae8ec

SHA512
60ff451ae03217a99ba4de35b71ccecfb4a1da796160b4e975de3eb9ffa5739ae1ddfd04a78732d3dc111d57396b48d0576d39f8bc0bb6741a7af8b844df2676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26f24ee1d2fa8d4ade65bbbb3ddd749f

SHA1
94a1e38c3470669a1d99b66386b637ad72b1d1dd

SHA256
7d81e959b6c41d299d3deb1f5a7cc2550f0e014ce31cb8918caec8862db75876

SHA512
650c41d92396ee496375bd3637bc6d41fb0bc69e0727fab5b78c9e1b2ce814e722483ecae2ce276e6d3ac29d903a952d1622c989f9cb35952af407673b68f4cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
886991591bfa757cee375179e2b7d240

SHA1
8bf809febf635d1623103ddb9122c9597efa5196

SHA256
7247374aaaceca983c0ca6c2dc92addbed6d5fdcc1772abfc23a3cd70869c082

SHA512
f8aa82c82b8104f917b2409e4ebd03fe93244e2b72283cd9fd44193bc4ac22437c4ee42cb00c09f14d783b39e79979def1dbbcefc471d7d9c1eacbfc84d4074c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a59f1288f1a35bf295639403521bdff6

SHA1
cf94a22cc5358a272c711a06315964e34dc14ef7

SHA256
a56162a7fb0f878020292903f4a41eb8d7738b5d05db61f24c96d686d53125c2

SHA512
97d6a991a8994e9cbd0815e9a2a08b22bcbb462f7d0fff85d497d86004694685216dbaf08816dc1f19578d04ff4d3c3fa6c30cb3d949379644c2d2aee575dbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb5edac19d00547036b51edae6a03d0c

SHA1
35a4198aabd19eed81bf5d5b98a2fdd02d8d53f7

SHA256
88e94632006dc6617b893fff8f836ae93c5a86b4ce54163d0c668f0a370b62ae

SHA512
9997ba869a8ce933022933218b92160d14a6beb52fc113132adf41c8c5cc3491a53021f04fd9bae0daf642d4538d11a204216c2b53a9e6a1ef8e9256143faac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed9fe74b2917121e5f29ff92d4ba9b83

SHA1
6ed018e30fde0f36992804884ca4f53de410c0bf

SHA256
cc8949183426c243ae5d6c0785864256e5d53499b20f099ed6dbd3972a46c931

SHA512
948eb71fe95245d2caa1fe76e1f160dad184329ba918e60e298cc3471686d94dedd61eefdce4023afaf7da0dfd1154ea58f9742d241c5dca9e4a394ea8749909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcbf3315bf8d4ca47eefcddb8963b628

SHA1
55e84e0593f1642488ea67437ce6e204b7118537

SHA256
0526a4f82e30b0eb7e6da97b98896089ee12e47bef8ac11b2967b65dd2e2c04d

SHA512
9c7a3c15189b52598f2df5b0c4001efe1224566f203616a6cbd5ecbdf1750de963362a5b9164af0c5982101e62c0acb9863546e4547cc9fc394c49a3a650759e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3749.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38D7.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GPOV8WCE.txt

Filesize
597B

MD5
4fd2dc2e73a2c1fb61d25d64e197181f

SHA1
216ce59fe4d3f52defa7f9014781cb0e4905ea3d

SHA256
244d95ecf6395498938ad0e863353c3b217e727ce4f405959dde69af4d700664

SHA512
4adec73fae68609f2fcb61c54c6645b7fd8a7e25c6b22f42f2b6a2b348d1469857345b086a8dd90632b531305e3d2860aa8ea499e261580e492da260a3098225

Download Submit