38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

Analysis

max time kernel
100s
max time network
138s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

612B
MD5

e3eb0a1df437f3f97a64aca5952c8ea0
SHA1

7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256

38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512

43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86B0CCA1-EB53-11ED-8416-E6255E64A624} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000009320437b7c94174a9c700a90231c26baf81442b5381bf781bb483c0bfe944288000000000e8000000002000020000000ef5825e7f1c15cb6b72cffdb032c57ff3d55de891df77e3dbe07459f13d8cea02000000099c6a886d620eedea9014dabf95f90dd501f403251769e943ec0d90a6e3f4f2140000000c15d1c0ad60a264c7f795bcd65ded4274a63b37cd95ca60c08727d57ca9fa516b08c0aa60ab18e3faad5ee821a5ed2261fb9a5e42c5890d07ba80c09d3cc7b18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b9765d607fd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000ae26ddc4faa6e39ab650241589bb39532ea0d25ca6c476f85bb56ba4facc75e1000000000e80000000020000200000007b91afdd3c2ee815c5271cf3f3a7e25ee3b8dae86df36c89e56b84b2a27fcdef90000000812eea2e880273a126f88a5cec8efd781ec8df861da72af41e3dee9fa93949acb740db85bead459c0b4f8d16bc3065728df9f212cd368db7a47ee2ba58465a34d88c342cf05c6222c45f0e36ebb31c60782e347a68c792f3d182da9aeb9cc395eb1d78708913dbf264593ca960f36d572f1cc0d9da0351cb6bcd94a9bc29bc2c60a51ba0ca770d5f8a7bc11a877f3d634000000009e0edd75be8316cd227162b30f25c71bffca0bf43b4f8c8eba4ce294f94a10c890cb0c02a7c9ac4320df48389f17143cc4d12917d5b0fcc62c046ec40c82233	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390062925"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1728	iexplore.exe
1728	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 1744	1728	iexplore.exe	29
PID 1728 wrote to memory of 1744	1728	iexplore.exe	29
PID 1728 wrote to memory of 1744	1728	iexplore.exe	29
PID 1728 wrote to memory of 1744	1728	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a3ea86e49ffdc47cd9043b93883023

SHA1
921507eaacb4b2b65d8cdbc7b68bb52aca33cde1

SHA256
1c3c1a9c8ef07e32f7e868a58b33468b4ee3f7de7d4d47febc27ddbc9f224a0b

SHA512
0bf4a33b9c947369072da2ac903ae99f944585214b0a5b581497935a6a261131b7ccc142b43f998d98a681cb418f50d15e5a320f28f6f4bfdf43912c6b1756ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8636f605cc89a979a459a42e9d30f55e

SHA1
06d346f0198e16003a922b1e070de0b347af2657

SHA256
3a3c4bf7a58a69d512be044823c2ce8c21e3307c2989d35c485c3fe78b80fa04

SHA512
4c9acb3e31a5c2c4d032953197739df489a9725d88eda839552611ff29f2cf797a31c4ec249d0f98d40f9964271966528754439ae70fdbb0f060d356e607dbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1dc3f6fe0663db02753ad7d2b88030

SHA1
6bb9df073ee037ddb8f7c9bb58b2e3cdce684f8a

SHA256
3d595dbecd003b7d24215b4f0e12d5974a9d3974d13da1a1bf9f1f67e261b810

SHA512
972e7bb2d7ace432fe889b67f2d7cd7fc6adf09d62b7e2922e748b17e2084d4451a6abb928e502efff52d33057036ca8997235b7fb9021ca99d3457e1c3bfa29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3998c3ab33edc884e8835b68808201e

SHA1
ae70065bcfeaaee63138fad7227498aedbe26f87

SHA256
b0c260cc45b8b105e5c7354bb55d8c052b3d39768f957ad59e5174ee39ddd8f5

SHA512
4cd8c99d3d3d9dab9a2bde5674e1a1a8ed55e596b14db49d95c97f11fec17701fee8706a3cc4d9a370726d459fde7a9f516edc1dc19014c97e1aaef17cd052f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
477af80ddcbeafd5838196f68a9acac0

SHA1
952b30ca5e3735bc3ecb31e49f2cf98d436de337

SHA256
31343d522df5c8cb322f3aed6582481163100548cf3e30edd87dbe3adad3602c

SHA512
147a082b517d0dda3f9d39bce81183c6d1f75c5fabb3e34c86c4adf1eb628668f928502d4b6543ce56536a73644d42c712d4c4d4591340b0e504bc7de4af415c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c7f33ede6dc43473ff2649181a2602

SHA1
b74ea939341da9e4b8b6647cad271b65d98e600b

SHA256
fabb2d4da1848754f16756bb2c0465b12bb88a15e91aa0fb28f1e020296cbd44

SHA512
e591655d12c892878ec483a8caf6ba2c18d88d0923fedea6998cb717db1329f6473a5b57893bf0ea1be45769e5a0c45945ed1f1e51f5cb437c6a752b7836d9f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc12582fc281b3517daa134f1f72f874

SHA1
37aaf6b93b3f0d13c140036796bdf7219c37fc13

SHA256
f6151ef8b153dbdc71d3c38a1257a8337b7f1153f826c27f17519c23b70c1c7e

SHA512
90282459df91c0b705ebee6676983b4b12a32b45c1fdc47493b15a68fa2596a4a482b7d8b3547fea2bba3c9e040987bdf81eaa90004dc32f87f60bf11e800fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fffd73f206bae24cfd1dce00795961de

SHA1
67930e248e7d5f5d3a7c51e13ae0a6c3bb27861f

SHA256
6290f148488e384828373a8afd16d62dd5763e7b127afacbf505e1a01f38b3fc

SHA512
76cd72c29d212442ff07ca72cc153c7a5c5b1698513c051d8b65e823d2953fbb1c607532fd673acd2b457c90bdf8e22a40ff2bd953c32cece26e6047bd618309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16627299f596fa7a7048d2cea718ae65

SHA1
1010f18e6de3b55b3cc8373e9dd93b2640f8af04

SHA256
eebf8895787748ee2a202c7679d7f0577732f6437a98d588d9e38fc44323c4a8

SHA512
124b96476fd8369c1be2a2ae5840a381389a75fb1c3e259530d28c1b14ba3714f0374d7b9060fb43a1b679c48ecbe86b92c8a60407c3c769ff7250c5d50941c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41D3.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4314.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ILALUBR2.txt

Filesize
608B

MD5
c2e70e77289818f52963e8bb00d040fc

SHA1
f0bd9d781613e0b15a98a0f7fb216a33a9b2773d

SHA256
53d646e8112b4418b32e38789699f07bd48ca682529193ad7f6a8231520f954c

SHA512
5b87d66c1d0be50e5964b1bbdf192a6f452768a87c3f60c839c86581e90e073d53ca636923f502d4b00a4dd1209d202ee83f522f3b8139013a0d2b351ca6fbd6

Download Submit