af80a961e65759a5d348f2fc440729ad8be178318cd87a685a8265b5b2d4b929

Analysis

max time kernel
100s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/03/2023, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ContractTerm 803192 Mar 22.html
Size

114KB
MD5

b84bfd5c7b1b0b0a8385d75ef288c3b0
SHA1

85f44f8e802a697d0fdb906e8314570ee62c92c5
SHA256

af80a961e65759a5d348f2fc440729ad8be178318cd87a685a8265b5b2d4b929
SHA512

b4d71a0b0d0cf296f412601705a8394fb0c924c5ebffaac3d9c48cd89679f08684b12ed8c84a9a630c3112ffc5891106cdbfea172c1008b1519a5fa09ccbeafd
SSDEEP

3072:RcwH+3YarcM/dB1RCdobcwH+3YarcM/dB1J:k3Ya4M/7WyO3Ya4M/77

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000df6f46afcfdbf0f4c05040ecc9b43f0ec542ab021e03a364dc2215feae0d7af5000000000e80000000020000200000000807af1f4f173f0f3232259da1430a83bcd41e715dcb75a77ae43a1b713b74de20000000ceeacd92f6ca300b2fed1a314d260e27be0606d574652f918614917260e8e83c40000000d2a953695959dff84de8c80e83b00d52d525dd2962bea71dcc1a82ed984a31af69f27dbf9c5f164532c864a40cfbfa47a2b91521ea18024b4dbdbaecd42e12be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386328503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5B4D7E1-C95C-11ED-814E-C29BF59226D8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000182ebf0b673215fff3726d7cc853fef8729bf80a08d48fe07cc87f978986ea75000000000e80000000020000200000004442ec96c8581cb5f38f7aff82cbdf9a75e5fee0ff890739af7c0d36266ee941900000008b9e538980de65b7c501b745d1ba7e01b329dbe3164f29b26002791a3e43665002a88b239476ee1c9c74674ede18b933c63cd3e48ca763343f9b06b466e1123cc1e8ec245ab3135ec533bfe44264dcf6769086bb13f01e9ee1e525983dc4d07a17af1c3b81e96cf11fa8c8bdfde00ba1699c7438105d77d86b645f0629c4697289ba96daf7fb2786aa5ef9a2b6031273400000001bf98ca2ced3b3125e4e905095d715b0bf4168b57781aa56b8a289a354fa715a233e61f0a3b6675c93376735bd31f6d6c070dd7038f0a5ce01b8a16326b3d7fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b046977f695dd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1256	iexplore.exe
1256	iexplore.exe
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 868	1256	iexplore.exe	29
PID 1256 wrote to memory of 868	1256	iexplore.exe	29
PID 1256 wrote to memory of 868	1256	iexplore.exe	29
PID 1256 wrote to memory of 868	1256	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\ContractTerm 803192 Mar 22.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae1226bf0ca5194d12faa8b7d4e7501d

SHA1
fc3a4a8d1f3a0a6a18f0fa3b3832b25ed7ae3bc3

SHA256
2f66432e532a09dd27b52527dc0b0c8dff868e4bab3a011a0debfd2767f22dd2

SHA512
ebd0f9d4008c027cd756360392ac4ca6130eab5470512733ead596a61f3e8242e87a33967a305c17eda46026fec13b5c9356928886ea1c36a3a9f4ce8d35762a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61bfe6f65a809e9f579023a079a8476c

SHA1
6e1b14a417d7972851bea5ea2e5f11f444bb65f2

SHA256
bb252c66e615b462b142f649ab8f750e67e4e3ace5913a79eba4654a210dcc38

SHA512
43e5a5407b8186f2b86a8fa609ffd295ac47f5eb59f307e040cb3e87df42ee6de7d6df5ad0bd4afa0aa1f2d3b15b988fe102493d20a7b44a66f4c0ca8bb700fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac9b938399a28e0db5107eb98f8a06c1

SHA1
029118884afcf7e9215a2b02e273a06a854c1fd5

SHA256
952a295185dd092bb0457392aad77ac789a85cde81e8625517b2f04a546281c6

SHA512
6d89eadec79571730e602e6688532ee892759a1ddd1354df6595fa9478d7ebfd7c8d9d49c093bd64c4b6bfcf200cef2d89060a816ffd3c4f29d9782538d1a4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775db2b7ac63dd0fa7ec258cc359cb79

SHA1
3ce914b0504e3a00a2ac879340e720b0e209c045

SHA256
17fa5597180f7af6aa2b7c3f8854ff493c63655cd2dce2e6d7623fedcfb7d840

SHA512
a962a7a04b2c22e0a064f28710701d939081ad776e61d312da26049a43ad6a92bdf83cd359d6ae57232cb7e979fae02b7017f7b4891190fe7b94d1aebe87d698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89eb13806fdc42c1c01120761291dfba

SHA1
2a170294d1e38605abf2b049ca1517ed1f634e0f

SHA256
bb596d2ad777375c64936d615c5f8ae5cd44cbaf73e15f607d0b294e2c8baa80

SHA512
7fda92437d8531d618df72f7e81d2ed222f95647e8863672d0d7bd81d4835457520c3bf7c02e9c73eb5fe1908d0411d64339a2f27b516334ecf67436454fe7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04cd85c8a6c7faad6b9f0df4a44468d7

SHA1
ac614b505fd322a7eefa203cfa7ea4fdc2cf6866

SHA256
77b4995ae15da559ba5e5a14c33a4b4458fea227b6d4376d2e100f4f835c5750

SHA512
6978a37333352599ef87c6bb486a6f122f93d8756320da5cab73fcba37431d828aa8e92d950f4a832365f84751e417dc95d6337add22a4cbce423865ae98d037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
facf30102dca7a3602113e9db7082b5e

SHA1
2df6170db2b34508ec954f392b24b4c070749c20

SHA256
f4525dda35385548ebe4892b4dd2613fd5ce990c0193d12b473109fc1d831161

SHA512
7bad271d8bcd4d2eb7ddf7c4d463036942edd05b2f4e1e92e8716e9c95af1c77dfe2ceedbb99c33e23f8612202619ac6243efc2573ead19f357b3e0f4f207cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c08daf30a7e18048f5b4a1c28af242

SHA1
cdbfafe4b9937a9d61235db80efbd55f0bf40438

SHA256
d15738552b107a29f16bf6423a23e801274668b8d04023b26a872ba6cbc63f76

SHA512
7879b7c1bf59cfb1f8d4c061072df9030be8d5719067b6ef90eaadbbf5771b6653fc3da96effd4797526ac349f4adc5a41e429b7a2eb3605f365516e272c9d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ba46d3d388802b3eb0ec101393467b

SHA1
e29c2a72b2cc52090482347652cd2293ff6eb0d6

SHA256
24715c5559c7b21f21c3f601b096e31f14171d76b81429a69fdf9c8311df5e1b

SHA512
4c57c2918a8b90b9daee62bc914940d20181d9e1aa8dea90ec09646ac7d1e48d70be03b2cb243706b81989501854e7bf50487b6e00ea53c2a3f03b3499f298ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SKXYVKI3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab479E.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47A0.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A54.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9OWCH74U.txt

Filesize
608B

MD5
19f22634bd331f5a4823a1659b228196

SHA1
3cd0aa4e3062148dfa9ffdb41945840d9e2b0e22

SHA256
e09fc9d6985d2a0bc1ea064c362ba044a372c0c18207b6b26c88eee9fbda304b

SHA512
ec5bdaf3fbb94b02854d2716dbbe13ab8c25dc4194b260edb3b3c7a0f4e1421a4f4ffcf7233ea28fc065cf555c6b3f2a77d827ab5964b4bb0e0eaecb297ce457

Download Submit