1943fd4317d3268e20305ec6fcb4a44aa84a7fcfdc35b18fd1448d9c76b0f6a3

Analysis

max time kernel
100s
max time network
133s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-04-2023 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-54.html
Size

106B
MD5

e44de33b775a6ca866776145aafd3c78
SHA1

a9079dab1e89170b39c1da665c53e733b00c498d
SHA256

efd4595fecc095473a8a523dc934dfcbc565075ce46a4c662563112f0f878839
SHA512

a54a60a1b1f2e04fcff54ccc8641bbe5d0aaa1d1395e7ba515609afe36dbab28a910cc7522abfc8c2f7afd18914f27f0210fc6046aad8a04912ae09bc05a6bdc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25A730C1-DE74-11ED-9C7A-7AA90D5E5B0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fe47fb8072d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388647570"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000007936875d2cc6a25b01fc621a9533d8f1d108c36a6196f5088d66b96810885a000000000e8000000002000020000000a5fa75a0d174b88a670b02411987277d33141bdd6a672840eaadbee1e5d12d1220000000cf6c7be9c473666c43101623e71ad48a5ec430902e762f00c342ec51e2b6711e400000000b27e70e75c9d667b78694a1ebecce0e95b711a1e2b5cba1654774f263740f31ce2555c3d5994c7ff71a580567d54d754d9eb7e56f62020132fa9bb11d4d1256	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c000000000200000000001066000000010000200000009841800d3aec8ecae582fd1a45ac963af7ced0b30db573d9eb5e095852e413bc000000000e800000000200002000000003ee360eb97c1eb04df7b213f1d5eea35a7bdf29debdcdc4b81aff0c7cc206f990000000c96af4e7960d31fbf80e067a21a5591dba5a91df2ae1ace40738a1b017f647610bb24f0954b475710528ac610c469b2438b26f2f9f7cf9a51e16c00c8f22602f07080dcb569a4dc3b366e480ddc68cf833fb242504d2dcd5949b2380b3c65543a315dae8a560c521807a04372ecea0c347463219753a7e4eb30ab9d6dd5fa87bbc3ca43ecbdc6402bab942a96ba05c4140000000ec5b41fdf66b7d201160266f0fab634e066479df184987d50b6e9e5f4f7621f45231d1dda52bcb89187c49d39b987c99a349fdb7c807a9aa5e5ecff37ff74798	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 692	1692	iexplore.exe	28
PID 1692 wrote to memory of 692	1692	iexplore.exe	28
PID 1692 wrote to memory of 692	1692	iexplore.exe	28
PID 1692 wrote to memory of 692	1692	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-54.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f7b9f2af5ec01afb130213991a4d68f

SHA1
8bbcf2833db466e8e0431bcd1e4d927432a7eca4

SHA256
771de418bca6ce391df5f73b39f55f2a0354dfba0fab7e536a55b4a67fcd6de9

SHA512
13a383fb9d1d079ee4fed37093441451f3934f95a3dc8c2bd6c9e1d2466000381ca4158d95fef04a636e3cb2c6dc50db32da75a9c1a724aa7362d9fde20fab03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d8a4a3a80df84638aba57744c60a64f

SHA1
8254065a9a123e4061b09429e4f10ee7ea265855

SHA256
73a4c24ec7e020d6ec45452ae1971560fbfa70bf4396804725884db0607fdd80

SHA512
c865035ad9fc3a8f33b5cdaf6914e0a85b7f5c7cdc3ba7dcfb54eaeb82ba76f2ec97301c5ad5052fc040a3f935f9a4b561d415e911bf1a2107ea610072c0d430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80fed36f4ee28236701eba5368c8fb9b

SHA1
f523ab10cdec6d732c5bb99f897d51abdba3c3bd

SHA256
972740060dfa3e784d8a9c0fa8a2be9fe861a7eff94091041854ef188a1f540d

SHA512
403c69e7081903c76b8d615795beadee1737e0492163c6701d4f3172626a87ba0bfec1c71461f21660e86e8f2f9b179568709b79506080ea1e00e0f96b8fb4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe5d8aa62704aa7543ff6d36ca997449

SHA1
baf45eaaffb857eed57f99c29322e1385df6539a

SHA256
53150ac34619a0877c476fb74216476d41231997b5bd91b65445070235a15662

SHA512
44c86abf99fd1c9a7b3bdd285430349789b7ab9f88af4441c7dbac14fe20a271d93da2de532640d785b29c5639722256b7e1a1de14b6492fdc6d379dff9fb6e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4628bcc8451d7d6872ca936d402d490c

SHA1
ebe82541d1fea703390b4aa72c7c5e9d28dc4e76

SHA256
fa787d5ba65f12272d24f98d83bbb64a6cbf019f793a3251606df122e30eac3b

SHA512
3a365e7c7f98ca86b098732cd143e41ad50cb6e4e223a178430716b49dff5329fb276fb014d04ec9911deddf1c3e1196f8fa2422174c6e9ac3fe77b30c2a95c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77f149ea6d16262de6077adc0a848e7a

SHA1
bfc984e3db05de520bd84d2591f1add64c6ab0f6

SHA256
3d21ad89fcf42a30b4cb2bec1cc7593acf65a28d7b8da7f767ca4bcbd07dd08d

SHA512
ecaf5d4e57cd20c40d31521396bb3b7585bbeec110154af9c2f751de5bb53fdbb436ded49b0a030ff154bb0734d34cec8ff3e62c15913acf8369ce17b9568af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1412976558a328d87e7e433db2e42bfc

SHA1
421f8a67fdee62d356a021d6c6eda4d4a9897b46

SHA256
1db844790029ecec07a5ff6a586e232ec90c8c9cf20e263cbbccc171ecf1b942

SHA512
31ce9a9399ad700f3b27e549fffb6a7261bb6940311aa4ea129ef36142df2bc00a205f382b960ed8ca5651febe66db7ee1a5be5efaeb07c77a567220bcda1d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49718320ce296604b0660c9af045b97a

SHA1
6f08618f5c6978ee91d5504a3250e2379c2e6256

SHA256
24edeebffe234b27bcc3cd45924f03821e2e7b40e3664532ca91f47b17f2811d

SHA512
384de22bb3b4b92a1f0e956b745b9927ef7d12582a430c4eba031f34964af5ad900cba611881025e097a5bc083fdfe6903bbd446236138a9bbed26bb3069992c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194518a41bf6e978d83fe2255be2ed83

SHA1
e3affe588e7fb05e637a9bd3a3e16d3f377632ab

SHA256
1b8e68e1c0529b0e792cc7c15e8ddf860310c57710fbdc21ffc90b2f115f1ff7

SHA512
43bc9463bc1f48a5e2b904163e6dfb1cd26ac9496b43fa38be9d2fe23457a8d6384a441a4b5335346cdd408681aea047c7eb477a5cd14364921518c56c9c0cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B80.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C00.tmp

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C92.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OUUH6MFU.txt

Filesize
599B

MD5
d9328da2d4195752830367741b0529e2

SHA1
cfefac6e9bf01bdddd62f693b6be8551115ca805

SHA256
39d9c348328a48e57c794b9f77562a9388cd9f85c3c7e58011f0247edc3a9865

SHA512
e4c317032831949e97add222b23e915a71022d9253e4fd6c15d0fa54eddfdefe7a89c0a427e9e33ef0b32f9a49b30b068c008df31ebac748b8efc09573cd82e1

Download Submit