1943fd4317d3268e20305ec6fcb4a44aa84a7fcfdc35b18fd1448d9c76b0f6a3

Analysis

max time kernel
101s
max time network
141s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-46.html
Size

2KB
MD5

239c19a9079922d2072d191d8b35c25a
SHA1

92cf5f931c8fdbdc36f032d95451604daa5325f2
SHA256

cdea326bb526ebaad2e882950167f698a2c92038431bfd8c61529f3f6d99abe2
SHA512

0167896a6c4dd060075cc0626b5c8311199ede6864b058ef9697b018742fede3e5a1dbb4ea4854a37690b93e9461dc31e4ace73af99d7967852d63861766d0a1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000d8bff6c1ec6be7593245dce60cb4293d1cbfd1bfbff76a64e0c6dd137e9108b3000000000e800000000200002000000001bfcd6b1ef2500cadef98653ba047a4cc2ee2228dc88901256e3e212f067ff4200000006d77e37bfc6605ed8b337ef6f0cf3c122b1659c2e54d4a17ede1cc1214514f4a400000002bcde00085cfdd3981cd2f6ede57d20eeafdd8f183add484cd4ab8285e9afa60848304fe346911fb9e9919316a0024315591f7f32d0b3ca63b58a1e2f9b13853	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388654772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000005c968615457d391bba571cf5edefb9019cbe97c0e0581b12ed27e507770b02bb000000000e8000000002000020000000c582a97b3bbc390604338ad474c64f981b5f302365559dbd18fba82f279443b890000000cafad1aa7af2ed636986e61c3bf3c3b66ff89ef956945a3cceb341da06fda2966640992ac749eb804cf046db494be6b18ed996b798248d5474cd85f244dee003577054f49428118c07c92eb4bfd2a7a827da96aefce622bd299948ee1ad5022111ac9647ebd4801ced23ee284ed355f6a934db57ece1f5f86c85a5cc194eba96604b9a3e57ab183f552a70339d44c783400000003e4a2ed86701e48a7ae0404387a95e5726b39ef016b55654b5aaa724410c398b15584acfef0d9542828912afe80600c175935ea277efa28d805f2403351e761b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA64D741-DE84-11ED-AE25-CED2106B5FC8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06483c49172d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 556	1568	iexplore.exe	29
PID 1568 wrote to memory of 556	1568	iexplore.exe	29
PID 1568 wrote to memory of 556	1568	iexplore.exe	29
PID 1568 wrote to memory of 556	1568	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-46.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a9debbf7ce2a5cef90bca2afd294651

SHA1
f41376dd0f599b56e3b9862e671c0d5236aaa50b

SHA256
fb83f98572d274b4617c22c94867daa3d34165d34e29765c1c8273e318fbf418

SHA512
837ef662e4ca0554e17cf4a18bcd06e6c005f7959f648eed7003a968df46119146aca46aa9e53e4b6f1a33653449a4302d0252ffd1f067129f16060518673e4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a8414af6cafc35ecdd8eb0b5b3a3332

SHA1
d6e006374de4201f4ee074d0fe9f665b2244da16

SHA256
9135a462a4e2e1a84c12e7801c4528c1f21bc7fd345e57d818196328bcd9387f

SHA512
75cd5d83a9b7e806cd1a2082fd2bff0fefb35142ac9ff94c7c035a40fbd86dd98323ca166e1f4941ff768039b7afcb1f8286c37b054d0d37fce8471bf343196c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a2e239010cce4efa3c2c5ed95c78249

SHA1
bd120ed38f6bde1c6c46a546303414c877c56449

SHA256
4901ef35f71fde87d9c72beb76347054871d4c43ee4b96c423d9bca27cf42208

SHA512
1dc9e52ff49f5ef7555d3e815a0c633d537a1eda03a19c3574591d0caceafce8367fe76d56b44b31c45c5b5cbb7866181ab5ab499e919f0ac9b67b9e370311b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
584ff6eb14cf69ec12b5136418d6d841

SHA1
db173cb70f6975aca35862c698b453a5403f8e55

SHA256
97e2d5394abcc8a081d277ed9a52f89aa1834bc072263187694fe9a3682841b0

SHA512
6a3e74c028cf96c4a0689597e547325ee1d4a7221f0de084e5ceb7cd6343580d5bfdd75ad937df1ff840add95e0e24dc911af2429c4596135b2d806e3e4067b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a65cf353bd82a362b3bd91ec5f40b9c7

SHA1
c5cfc3ec8fe46eaedf59c99bcf3cf10402776a1d

SHA256
de57a64ddf0bc9d5f45e235bbad7fbf136c71f8410369e2eff9485255f663b56

SHA512
905dd33afb45dbd21f58beb68fe7760704bca1e4bce014e8922becb7e36d1dd151a1a08cdfeeea4453c15164700cb899f1a135dab9a0f80845fecf2e7e8ea7aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
855d88e7287f8cb759248ad0ce6938ac

SHA1
6ff9071291ea2884aaa1c0ae73c0491914965508

SHA256
d6d6443a8219fa1c9ecd0dcafa6209c3bbca8a5bb255b685c754b2e52c3fbc3b

SHA512
d89a53b303cbd9da42d691181a724c016976624cbbfee5124a5e91986ef3bea309ddf257b854cac658a74e1262b710e9723b2da2fc7c1832559523b2233045a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d4d88b0c3352e54b5b13f2e65444c89

SHA1
755a8bc1c17bba032362d479ae7b607abebf747d

SHA256
57d4d0df0477784beb5c32a17e4e1fd8e7e9209b45e18af6beb552f295b1de19

SHA512
f42e9bfa84c7e42fa7df39cc3b4d3960a7cf3289560439183b71f75f8b95f149990eb9adc113dee440c92c582b784c2f85ba43ce2505cac68021a21825fb8e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BA5D7P93\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49A0.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49B1.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B7D.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UJX0I13C.txt

Filesize
604B

MD5
7be1341732f58bf635c14dea552cee8e

SHA1
da9daf9ff0bada9aba23046b9e99b6cdf79dd231

SHA256
d660ef732e934a0e5e72b5c81817d4ff9fbf2d0bf460b82a63b63c66cf6f3242

SHA512
574afbf1daf58ecfc1013b2bc6aa2757cc5262d2c3c0a9529a53791f0a325d48358d29855bc218d3888581662ecc16a654e720427ef7557de3a260935ef17ed8

Download Submit