0dd2b43f14f50be2801c608d11c65b161606451f554f28bb9e5cf9db5f27eee5

Analysis

max time kernel
100s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

1KB
MD5

b6f6ff28df3d9bc7f57951e2a2f41ecf
SHA1

00ea3584feaa2af2253c905a7c99bb57e97f3aa2
SHA256

014bf157a653e4967b936483bcb3ecbd6cbf284557ebd172e4dd178f468f05b6
SHA512

707844a82bcd4bf4bddb58119e718e0e6e89b9250191af30fe0d3cefbc5f50d4608c972cc464a6df8eb5051a567bcb7126d603cf655e5478f5c4d9ab5e92cb3c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007907357f5ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c000000000200000000001066000000010000200000002961e83ff43028d590c56e22da90df28aede293eebd6730f3ba69a758c6df8e3000000000e8000000002000020000000ecfd383c0d3a4bac09d49f979601fe39291dc1a3287cb2d1bacfb74b911102dd20000000ead2ced4984174cda0bd614f0471844f403cd0f5684df8cb28cd8727c3ba727140000000bfc4dfa23a9ec76d23285c7f1123efffbad27e8ab6f199ab511041f63af2063d39c6d6e37ab1cd11003d15d4081f8ac62b316871e77fd43b5982e37a31b4e707	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c000000000200000000001066000000010000200000003d61faaabafbf14aecc6ed7ecd6c835b8a1be90ec97ac82caa6a99fd268e9549000000000e80000000020000200000009c8303a8b391e29e8780fb30660093efca98123bf5dba26b193015e45bc46a5f90000000335a7dde3ac13a36e1e72beed4ba9bd7c15df2f160a0499fed36b0983b2d52f614565621d34193f25a952b91027537232a8407c4566869585c5bda5a2544214bcfb14a0612c054b1f49489d1c81ec62d512ef3dd763c673af49e05fec671904fa5fc5ad2f46da7ffcd0ae19f6b25d1c139d1a23e303e4e059d61eb45d540eca95071303d604f7aadd4cc5205f61549c8400000008265669f7f1e8783ee696f1754e0284c8a3ee9821434ad3824f16ebf17382bc440dbdcc2398d16938c1efd0f6f15cb293c83ee2c06ba1009b9802019efa7b8fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E62A901-CA72-11ED-97FC-F221FC82CB7E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386447783"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b384366a068fa85037707def0f64f4f

SHA1
7dc9eddd4795dfe0c2f57ea96664ea727f36e259

SHA256
c91f8c03322c3b9af3268a74fe2dc5966f7b5f74ca5420fa66ef1bb9ffd24695

SHA512
9cc4a44e6148b7e71f72e67ed9d4202d2f4c03f2e5698f806615673c6418f724b0255bbeafa29262cbd21bf6d5305a465b75dfe213f244230b4ce8715c752faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c97113602e1fdc2367d4c549b07daec9

SHA1
e89ddd0a07c21a7c979bd9172430d96a9b1789e3

SHA256
5199f5ba214da0721f808d467f4b5d6b88fa6c89297ce382e385b4ef80253b11

SHA512
54522097aaad2082085bac6c1dd8d8b46e1cef804af188a8a421fbd536939713070f1bd306aab8e848b676b5e6ebf79c0ce4fab1d4af68afe6acbcc25ab868bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4182102779892568005b9de4e035841

SHA1
f201dcdae8e189c6f9f83bedfb6830fff7f33142

SHA256
2a4a90f49090f4a857c0d779463d85dfc17ac210cda118626b7d2da8a57f26d7

SHA512
74748b30c1ef9daac2a9cc08fe4cb1040c2cbcf7bcd0a2b31a10757ff73bd631d36720041914ae3026dc943262ac812408005cef2ad5c40b56ebb3df17638669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d20689eaa30745b0feb42989346881a6

SHA1
10e3ee8436d1efc0bea26f870485595ea7e63c0c

SHA256
6bf96bd4d47cb4ebdd37c3e80f0ab42a764398ea737783322a7f83585d734299

SHA512
a946273a6755f3a4b378432c6b04bb0f51d4c38a6f72e8fc875261dc8341bc71335f2d9e6d62e462fe3485a836f56dac90c69e2171c8951eee49a465f0b2d9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2707f66ec5daef038a9de16357d0c1a

SHA1
03037d10c4f16ccd3d73dbe0041940703217f810

SHA256
44158f79bf305d07d928beeadbcd6c8ff4bbea4a2ce32d13a60a095381cb4688

SHA512
7c5a3b3cec782531dfab2b45627860e8c4fe07a97fb4f3168f246c313e177273e1e2868f8594df8c89983a5cd9feb2137767081bff049ea5d8c111f2178f8765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2cb94981f6e15d85b3a3a2838e908be

SHA1
8c2e9beda86ff2e179d278c2caf72327b27cf30b

SHA256
30dbaa1ed1a36f599af45e75a763ff2ce12874ed889b330bb9196bb98675ba0c

SHA512
dc8301f656ed33913a9a0d532890f7b309743174754db727e1a919f111cf482ef8d0d40b2da6216d0effa01b53267448c1a97180f296833c6169ce5c60fec1a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f7ea71867211c48ec072990f4fada68

SHA1
22166670b37c02203f18f7cfee0c1d1af6016d7b

SHA256
552ba30f12447933738013c6907e1c141600bfb448302f83e18706ed2e2ba456

SHA512
f8edee3284e8573a03b38aa6f440bc12e07477d6f3ef21a654a8ac572fb2df0db5fdfdd464328c5fe34132e1d9e64ddcd4e09fa0aeedeea8c38259042019b864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cec0e7353bd282c97ffecb896ec3126

SHA1
6497ddc24f7c7f748e55da0220c32a2a76dad54a

SHA256
b540606d016c26263a431fb3b2384be475b2969fcb9f613817d4886a6f2facf8

SHA512
5d8db3ad5e53d2e134845a737afbfd8bfbb552516825f4f73185b6e97b926765c6e652c569f081c2b7269fa64393bca9124c4744e16ebe937fce61474da278f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f77ac290881fe059cbfa675d642aff1

SHA1
0b1b66ea558f383f7af646218cd6b6d6dd7742a6

SHA256
79894561778ea1318271a35d7eaddaf44a12779505f229cd6950dbb997ee14c8

SHA512
400b4d687599bf775559e146f56cfc3e775c8284dac65d9a90d53d490f05abd2d4474dd3b93ef7a045e3b0f99d0250df95c751c2b47b55edfa6c5e4059c94081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13006ebff64139e2a70bad7f1f7213b

SHA1
517c9937cfc614941876ce7b234456153eca743d

SHA256
44e6b34c9fbcbe95cb2cbb35a2b6459bd74c29540486ea6a3fe17f855da973ec

SHA512
970e1c18b3f202352991aeeb070eeed55c6e84b85a7ceb9fe070c97de1ebb28f7aa01b7bf3b5eaf79e0c2341572411fe188fc262fa9ee94d33722010957ca996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b3a1b6b25003636ec3217ed3a7c4ad5

SHA1
ab0352a08bbf753707464462448df098241016b9

SHA256
c776db7ca3570c12e990970f1379b61e52b76c90d3611346fbb217adca721ba2

SHA512
6ef033570204b3f15b044f164a6d16f3d19c81a8812943d153305e294b493a72a85267848a2eb0a5a66458f2a4dcc5dde31f7d7ddfb10b6c3c739faacfce2d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe55d2f0463e2970c0a6f894653c6121

SHA1
c4bbb7f5fc7ca54a4b898477e498b955804ca12a

SHA256
974b5242697cfeb41e82a3b2bb62693d159cdf4aa8dd40ac318bed091ef40872

SHA512
00501105b401649e17f1be2c2469207995ff070fd1efa06d7426a8489d90b2fad3431f84bd98de7f1eb5266fde9b4d516b5667ef502f22eceadfb525015dfb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61E1.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6469.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0T3MW9MV.txt

Filesize
608B

MD5
f586f10437ade7a7c64e5571efd1681d

SHA1
02e17f137cd589dc3d876c23b28596efa5e691a5

SHA256
1bacf81e2ad8f46bb57d74f7ba2f4909f567dcdc919ccf6aa4f2e0ca5760d4d4

SHA512
e6287aee1a8937c6a094de7af4c960e5c08b3a28c5a45fe51248eee3ee9ad435927b721f38ef5c92ad59fb6661eb3c328ac127448536e5288014266f00e27328

Download Submit