beb4c93a5d44006003052d6b1e6e874ac2c3f176818e7706c610cba7cf31b340

Analysis

max time kernel
100s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/03/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a175ff91-9e6e-479b-a778-45bc48c530ee.html
Size

71KB
MD5

4e2184d9e13b69ce82f8a1dce138c432
SHA1

7c93f63d3028f67ed2171223504fc4665fe4f93d
SHA256

beb4c93a5d44006003052d6b1e6e874ac2c3f176818e7706c610cba7cf31b340
SHA512

f35d6ce99f3102809f09155f53c546ebd44fa2a6a29427bfec312b52f41b1da6faefadbc146985b431647ca9e5296a67c89fa8603f433ca1a299f9b71cf2b42a
SSDEEP

1536:3HMtInQrSafhtQNlNJa2UdOll3tvreyxeclJnTXpwe66H1pa0feMAAFNJ:5nJchiDasl3VeyfKeXH1gW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3BC6E81-C66F-11ED-A76A-E6D401764DCF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386006914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06ac0b97c5ad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e200000000020000000000106600000001000020000000528a8d0e305d0fe1b772147672d32e3c8b0c368a9c39db00237bc04b66c67ffa000000000e80000000020000200000007be5226bce67b04075b68e747a5d1db043010a7217a89a234bc1d7648de1d59920000000b29df353c0ab1f4b89eb0d3566d730bc5e0b87fffa06e762e743b77ddbdd53f74000000044b0e519b63c58f5d54fdd8bb6caa76d0a07bb112af39df4d2585056c69a5efdac368e5974e7ed189f21aff6e50f63f7757477ca323a1b2317c2136f39b6147b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000009893e816cde6da4b559f80c3f90c48dbe9731659a271fe01362863277327a5d9000000000e800000000200002000000056b094dc28f4c51acee393696eaebcd190d8b9b35f83bffde9b862643072915b90000000e1189994db246835c9b7e14e47e664819d7e85f57c6548f926e2a28d81415b7e951cf61158cf2d60a8682c43c88e1fe7d2764c9eb4a817b0699cee80edcf37f0a2248200aa9a1599e534acf32f9644d26331675cc819cb6c41209eb1a2f9256a8c3a183569672169ba96de48f7b1aef68b7b8254db1a0b4cb1f65a9b151da4e5c2428d192bbce5c51555504cc248285c40000000bd68a0b7140217e80752f8b8052a17a1fcd4c160d9438439817492c906d562ada83b66efec679bc60e4ad60f45f4dc20fe14f13c6c794132880410dd363e3f0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 588	2040	iexplore.exe	29
PID 2040 wrote to memory of 588	2040	iexplore.exe	29
PID 2040 wrote to memory of 588	2040	iexplore.exe	29
PID 2040 wrote to memory of 588	2040	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a175ff91-9e6e-479b-a778-45bc48c530ee.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71fc3e0db1ff82c46ff050f27409dbaf

SHA1
137a8e6ca527cb49314cade39daa63e9038f54a0

SHA256
6c748fbe1f73a950f9a9e66d04a89924521f26cad82752287f92b97a1a1257ea

SHA512
409f9c797deb730f36bcd915ec3f69ddd936a2ad93c8823ebc5793b18cf8dc4480931e2dcd01b7107b6d8abec99b6348bf6b88497d800209c270f6108c1d3075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef16322a262adf1751ca093df03999e4

SHA1
591be808f6e16810ba2a3f6c03a8274505e313c5

SHA256
994c9ec9ec5c04ee30b2952025730c4cb4160df230c10618602c297cee860508

SHA512
da472e1554fc269dcb82819381b743e82b8a4d9ad7aa522d327eb9b1f70604f1ce4ee60e2131ded7e1657b846f1d5f17dc37ae2304a3de4723334c1959fcc55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f5ddc3b505d217646ec40d428a90663

SHA1
84e3a27181765d99c2631fac6e950fe0fec3306c

SHA256
d61dbe72b8ea6dcee30bf81cec4b06cd6c5f1b67e7b8344e7c6aebca9c1bf100

SHA512
f901b42142b8f3bf92d92b1a773177e374209b041ad68bb00cda48444672a03d899c84569f7beb8859e8abe5a073159c25f642957fbf63e14782c91cb66122de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee43372919ccc65b90095228bf7db41a

SHA1
da11689cea60700660f5967ebe855321031ec028

SHA256
e93a0620a95ceccc8f806bff5123584141c4dcb690fce660d950f9500a936918

SHA512
24fdd1c56860c6285aeb02dec6d25d58e0cced330b100359df7a350aa11bd977f31415bbf5ee6a0211c89f89535d0465289d3ccb6340119fae8787076751cd8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a0479ba4af33955b78019b10de26463

SHA1
c0a964595cab18e9c776d074840818c0ff603ea3

SHA256
f964d6b0e713fe8be89619c1d9d4ea1d82777983336cde1a36a857a5eeb64d12

SHA512
2c90b143d850bc410a877890e1e86636cd44d53e0571ff909cc954d6ecd83903f9256172af9293136a18e9896fa59ff84a01d6e8c8f58e5ced5eb4394378fb1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4e8806dde962768b6e8e22c58ba360

SHA1
c9e591629a37be46de885811f9b5af2c488984c7

SHA256
1d81d380c26eb82bb80e756796120a42ef5fac597c8b3a0a1f30b8e01503a2d5

SHA512
e269a5ed3ce37626b8e92cfe1d98663c3bd7b8ed2da0bd10125b0490abd32fcd4636bcd9a1c7a542f2fa46a00d039a5ec03c2aa620df33baed1f5eb64e3aae0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e669dfe11a02ed42b71e3cc374884019

SHA1
ccd07f4c32161c7e1e46effb1a87ca5ee2c4b5f2

SHA256
bd48ea17aac85d44083dc39b7a042ebafaee6b167548b86d873d48a68712df71

SHA512
fa19fb49c684897072b286d8438e5ee082551821233b515656ba0e78014c4e4ceeab8ca6e0ccc8432827c00bbaccd1af8d52ac19524ba417e8689a64e00bc6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d3db001928a62a55682ebb031cd0859

SHA1
0ef952e27a5a842726759f097109f6ec00de39ad

SHA256
ba017fa28ff90f796139ce91cad65147aa5e5c50d7a0afde3f993419c5ecd9f2

SHA512
1230b464a27cee2382b1487eaf16b2623de554b4bd5a62e029f2798c21d02cceee719d9ceffbdcc4057c7b789cb6231caad587313f42d6a97f2ef48283c00f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a73a206de1c579f610b9080bfe686205

SHA1
a9585ff69e35440e05db0a91fa4de185eabfd39f

SHA256
cc9c210847862198ea40645f8619c4870af61543ec3e6fb22d50d1956b95c18c

SHA512
191c0eb7e0e8de1a5504e4f5b314dd6c310dc0a9860a3ed7d14b17484c06f491026df7011267de891a3b67ece9f4ec1c1fea058b5cb0d02d8a95629cb7fe67f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOYUJSME\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab425F.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AA3.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BYNDQ670.txt

Filesize
604B

MD5
2f24733401077ce2cbde53e9e038f8d5

SHA1
3e5c4fcbb418b22d2172e19f221662dec3182ed8

SHA256
257cae6ef47b37883f10e1e195653548ad963ec5cfa5cbb33ce0a1e959904b06

SHA512
14c13898d925ec8efe7da84b306cdde408fb31b3192cc6ca9ee7a0bf4120d7b02a86d309ac740596939933df088b9f589bd01e3d88cc24454e9631f44c4f0f14

Download Submit