f160b6e3050d46a4a90b8a052f40b4d8fadca1b258433499dfe5c42dd2d3c9f7

Analysis

max time kernel
100s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

=?UTF-8?B?Q2xhaW1EZXRhaWxzIDQ0MjYwMyBNYXIgMjAuaHRtbA==?=.html
Size

162KB
MD5

0e2fe80daef3afc3b18a1980f95162ef
SHA1

5fdd75392124a7f09cef5eedefd960a6f29a89bc
SHA256

f160b6e3050d46a4a90b8a052f40b4d8fadca1b258433499dfe5c42dd2d3c9f7
SHA512

83999705bf741ab9268cd639869b16921cefa3217ba04f102d57078d9cbaa19521224473f0a44f3424453adc632216f41ca8fecf923626458d42a4bd6ae9feb3
SSDEEP

1536:V3msrYmsfmPx4iGAcsNL2nFWaevZMJKA0S/gdouarYmsfmPx4iGAcsNL2nFWaev4:V3mdG4iG6eJKAWdoyG4iG6eJKA7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000f32532c798e2c9b5ccb6c25a378c80304f38ed57e5058e756e4ee3aba889b5ad000000000e80000000020000200000002ca1ca580510a781210dc40651e90d33b088209b6157a982d684344668db685d900000001c91ce89081dbae26c41faa6c16dd5fc000cc56421b8bd81d4794d7309a87929bf151d9b05d05dc6be5c9b4aeeace551617700822edddf799bcb11a73cb0b7646e44297929fd1cd6228cfd7e8ac915d943fc90f1752176d624188a2bae53b5aaa48de55a45c6d03388b451aa64e15656d160ae65ca266f5cd0b7387be00746c60d032a5d975fb4a99ce440ea6313d3a940000000c384eb640db20b318ad04625870862e5ed3782b5e5d418df4c196846ef858b613adcbda4f6034b1093bc1fef7e152c25aee8bcf76c3af39832d501bf7b05aac9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7E92A21-C745-11ED-A85F-D28FF4BEF639} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000051380a359dcb9b816a03f7b9c3fcd1f7103eb7eb7ec1945041a84f4f220fd8b000000000e8000000002000020000000301afb2b969d69a4e3bc330f42465f9d3a94fc6653354b642c116dcb7ad218fb2000000014e70fd4b035d4bf35ad3a033fd5d6e6ab69ca8fb895a4cc1afa5adb76980dda400000004241fb6a89d0d18ac95c41d9a16cd25bccd36e613c399662ad3cd4e802193b2fb192dbf79cda43201e836f6f63d21896d9e081bb4785b7dcb6c1d57536aa149a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20797b8f525bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386098725"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
912	iexplore.exe
912	iexplore.exe
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1424	912	iexplore.exe	29
PID 912 wrote to memory of 1424	912	iexplore.exe	29
PID 912 wrote to memory of 1424	912	iexplore.exe	29
PID 912 wrote to memory of 1424	912	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\=_UTF-8_B_Q2xhaW1EZXRhaWxzIDQ0MjYwMyBNYXIgMjAuaHRtbA==_=.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef21298cb8effe606b1963f40b0f7b1e

SHA1
5260a78a8f4ad7a8f1a3044e233550e224a3a53a

SHA256
13d1cf461c976473bbb7ddb3dee40ff72a5773b16f2abb4231a00fc6ffb19bdb

SHA512
37ce97f60efb6169576197416c6518b5dbf56ff37ae9c3f1eaca3632474387316dfc554c5975711d5ec11588ebde2489a437a589f3e595e1381784404f8ab9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c479e1f265df6930229c517cd4739af

SHA1
8a3d63136b97950a37d8d290a86053282c3c0997

SHA256
3f5f352518e70da0bfc318622c7dba04ab803c30f486233675ac1e8f20a9ec8c

SHA512
40c13e740670d697044e0f2e055a2fb357b5f8c0e4b5288e94f6ad0c38648b8140abf72dcaf067572fd032ac80774df6cd825f3a2d6a75ace18ecc3f92eacabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a7310adb6408e714402edc10cf94403

SHA1
dc31aa9ffb4ebe6cd119cba3ee8456462cb847fd

SHA256
b0c3e72ce0845a59ce7e2f99e6bf900e53d4a29f96ce61ef169b6b532b6ddcc6

SHA512
2964b8173bf39cbf94b13f3e850cc51f7b031fab2985540364ecfdd961c95f87ff70862abd5b5bf084109b5d9663356d2cdb06c2dbf399bd057a1f1ba68f3737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
389887f425617cfef91d6f8ee0ada435

SHA1
6bb023c6d66d54d2868a7275f32c109aba251b83

SHA256
2216c0bdf6ecb25a091f307b9c2907cef99049d4268acfd488ba72e35567b0b6

SHA512
e512bedad7992cbc2e5521be2f4f44fc2547acaefa10c758fb65fc0d1feffd06938826a8598959b6e520ac5e352c2183b47e2cb01751d2e01dafc140e746d41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13bcdf1e237ce3f420fa1dd1b13d3aee

SHA1
42993f09c3fadbdd6bb79e8688ef36d49c0fc2c7

SHA256
0efb40407ed9a399409df6c24a7d6d5d833ca8367a4bf160e6005f85012d8974

SHA512
c61a56514aa0b36c85a1d6481734cf3abf84e2eda4ddd2d9f655e5e76b2c396c02a8f2c64de7712831be28e47b92dcffbb8364d923f8e4544bb7d1f1096f97e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DE9Y0H7M\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E10.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E21.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9049.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\84CK5NMM.txt

Filesize
608B

MD5
54fdaa95c9f2fadb51f7d8fb83240186

SHA1
1509b1d8ff3e9bae22ade138f951afa29afe9792

SHA256
8ea5f24b9e6978339608cac4766128bd8fe4a7567960271bbb96f8aae0c5385a

SHA512
6e87e776b09917de7f79721fd9c3486b8f2d45b6578e4d14e56d6a8cbd0c7001c0be3a3996743bd88ec436c31ac124c1a20394437d744f59efa7f220aa6d9e8e

Download Submit