177766d26db938d527a4757d101d1c54f370f1aef1c9972ebee5a8d77d900ccb

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

120.html
Size

2KB
MD5

343a6eed4da0a6a2cf3fef630666d67e
SHA1

940f67dd360cde1c13b3d82c62c4a5ed44b8a307
SHA256

177766d26db938d527a4757d101d1c54f370f1aef1c9972ebee5a8d77d900ccb
SHA512

8b9151306a811d60f9911a5cdac74b8c18ce284b1557dc6ddb40d207dff2200533769c22eb34dcf8ce3660e113ae4cfbe575e6f71e77fa4b4f4d4bd1cc764013

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000000d3ab696c70759e1e7526d4b9752b9f073f7051cdb1589c904265efc2f8b1047000000000e80000000020000200000008dd674e6f9a0ac987325bdcad11d0d6f8dda4e3ef144c3a00179bec2e92e170b20000000ab2e1aabcc2203ffb9eddadd5d39d8f0bba0f1449ebfb7f1c70500e1bd9722e14000000072944026900a35e0b59ba198d8f73b7ee4f49c4b834543cd76c1f1b08a5d67706b052d0805be8b9bf99ada74fffff8c2dd2e78709bb646e1eeebeef5e5cfe4ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e2000000000200000000001066000000010000200000003bd4fab28af089bd03aaac232ce0eddaa9e94fa216e325d09c5885adb88be942000000000e80000000020000200000000d689c71e716ddbecf6bf449240500e19b00d5e88add914e4196ce838aabdc6090000000fe39cb079df03357c1838137855b36b9479cb50a5811cf0f1a8f2d2866bb27a2b40bcaaee6a43e1f31b010e86e83e3696b7e12e629fea678189c4b6ab4eea1b6982177e518b3d87a6bf287a9ebd0d16ea698da0207827c8f8217b4e0f1d0e315a94e13970ab38c290368500774bfefa64a095f3f50ab7577a47a39e3b5e502f43e373d312b2f52c94b89c51357444af4400000006a346510cd44be1b9af10e4197adfcca76a2043ad93dfd492a08e3e29e79704a22cf20c4c2e05de417623042a07611d926a699d5633419e040eaa3e98c194f9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390591961"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e78a123084d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BAA94F1-F023-11ED-A813-DA251FB5CF93} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1156	iexplore.exe
1156	iexplore.exe
652	IEXPLORE.EXE
652	IEXPLORE.EXE
652	IEXPLORE.EXE
652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 652	1156	iexplore.exe	29
PID 1156 wrote to memory of 652	1156	iexplore.exe	29
PID 1156 wrote to memory of 652	1156	iexplore.exe	29
PID 1156 wrote to memory of 652	1156	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\120.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad87afd7026c396353d813e21b6ea423

SHA1
c312c6d0203f3d4875009123e0f86079ef4c0da2

SHA256
6dcd09e4b5fd0bf579e40cec20094f96289af7b8e10fddfbc58649a6b71ac896

SHA512
a484736b1790b0c16400cf244641d1fcc0976b96d5fb47ea9d173ceea0c400cf105e2c12c9c24d6db53a02d7ae83ececf418c4419ed1aa6d4ae5365419a689ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f43006dc2c0fdf283ca70d788d839af

SHA1
c744ac827b450907a3b7740124ad76f136363d41

SHA256
fb1f42c4b758d30c4da8f540f56f912bc375d545dc0c0c04f8fe87041659a54e

SHA512
d80b92af87cb8be7dfc63565701a8f2567dbc490b555157248154f6b75a149a6534d42aa5896b998fb56585471045953d5497282d5eba03f7428ae4a304797e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06090f969bac113527a58947c5cb6a43

SHA1
d7bcfd868455318e30a569d697b7027b6c8eacd0

SHA256
2df8827d72d640067cfd9282afbf725c4bc3224fe8a04b22ac6f2ddfd60e2ae4

SHA512
4ac7d38bbccac755d558fe083637bc0f056e19d7bbb61ab33c2646a8777bbfb03114f396394dc8b58c52f614a75d25f5539a577a80feea869af5fbfd67172287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d39c8d428a1c97cefc17e3fa43a2f54

SHA1
4a6eb4d426c22e81cf0fc9576eabbb64889818a6

SHA256
88c41a1592bb481fb8cb7fe243897ecbc3b113c5bbe127810c70a3facb7543c0

SHA512
9331f5fff12dd4e79f552c107b319f5adee152f47a9d62252ce57a129df2af454a7991c2cfadc21d9db8cca8ec23bd4abcc4309fafea8e491e9fead47c3bc8dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb102424ca20ff66e8f79d351155d5a

SHA1
2448821ae06052ab3dbded15cb1c71489cfa5f59

SHA256
f94773a4686d2170f0be9154d62f7dd349e8a679651eb6ebac5e8a3dcfa28df8

SHA512
150f687e739159212f643a7c0a4471a084731e49730c66e7870b7f12051ab1b3ea4d325253614cdc48437ed12ed5d037cc8fad66192284c53ecbb651347ff66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad3e5b9831110b9f5bfe34974ac0863b

SHA1
3d301801d18c986dd5af388660e455fe85c80689

SHA256
4ae6f44fa2e03a50c7ddc533d051dd2168e447ff43a7f41a2dc6e70f1a012cf4

SHA512
8f12f3b8f8f17ead6d5c5ce509562421a9c406e38bff353edfc71d1734970ef122c955285a715ea6dfc4db46fad8e3dcdaafef2e539dc184e31663e2f51b1219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d852d20951be688d723b869fc36f28

SHA1
81612b8948cbadf03a96b1bc2129c25d6c1aa3d1

SHA256
d527e4549a391940cf76ec17219ea2f22bf71878fe88b553bec972943a6c285b

SHA512
349d33adb59c33e639409758b11fecf406794cf030a5449462ec67b238268fdbbc3ae9258c2984d4fc461973a8466f5ea0597dbce5ce03e80368e5c9f080f890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df432b9973c744067345b9418d47333

SHA1
ad12f1019c29ef9feff1802b9396095c2264bd51

SHA256
71460ff5739ae5ef7e7874e66702cbdd1d8565cd59c290f14f68af2dd0d5cf06

SHA512
a3de6f3c201ba605c2525aea809c54a317825c4690b9b46fcdd7113963dad8d9583cf2b2126f5cef8cd26417b85c3e5f87a6ca068dbb8d8a43f773d5cea899b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf72955dbbd7993b5e7e3a1d319779da

SHA1
775184ff52ce5aad9f61e241349751cb563778a3

SHA256
dcd2b1fd311fbd3714cfae0a7950c85658e2b2ec6c2ffa0b1fcbfd0b30b7735b

SHA512
caba2b199a5524c215d0706a4a14e60419dccd7ec5c3e9893e6d6d483ac0cbb6da05b103702252e0ac76d45c8ed780cef32c4e2f7494df5a9ce831fb2506b5d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0ff62acb36c94bfda92d808b2c0640

SHA1
d2590ac746f3baafcf9764d642a7059f236df2c5

SHA256
253a72cf0c6a747893a5f91fed9ca1b471a95bdf4e85c47b4d171225d5039cc5

SHA512
354b4302e016972d3bad55294edeedf359803386068d6fb60148c7af97dded5490f1f1bfcefe635c83f628809d3ed8980c0372a9163890df5a311c2920e57b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOYUJSME\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6441.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab656D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65DF.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9RUFE2KN.txt

Filesize
599B

MD5
cf846d2922d275d2719e11ec0ef61dc4

SHA1
dee6ab1629f0c81dac167a8080cc50a8394adef8

SHA256
93c51a785035b4f0c98ebb02ef7740113544ada42ab77a58faa87ee792056491

SHA512
e2ec7016cb9d138d42b427123112605f69d793fdba2cff49b66e85356660f1d14918a644367ac426c9e92d76617147b5ef49ff15176a87ebe3ef7a61451cfabb

Download Submit