2344feede0dd8fd4729b58cd5d02b245ba00014357a67056d60fd830cfe8852f

Analysis

max time kernel
100s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-05-2023 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

=?UTF-8?B?55S15a2Q5Y+R56WoMjAzOTkyMDEwMi0yMDIyLnBkZi5odG0=?=.html
Size

5KB
MD5

63929ad08850e4fb05c17a41df7bf296
SHA1

f5a1d1fbabecc44c1fd380d185fd65fb3acb9198
SHA256

2344feede0dd8fd4729b58cd5d02b245ba00014357a67056d60fd830cfe8852f
SHA512

c78125cfb414846b9d8c7fb73c59527c1acd89fc5e672ee5ee267fcd1f275d975830e0b3163498697229f533614b3439c4bb61f80dee5a1f431c3acc540d9991
SSDEEP

96:hTTdXb+xiTb5NLTbpvNsvvR3B5v+mbBJM5KJL6wnq99q++t6BVARWMDqxgtQ296N:JRL+xiBNLxCxXtjM5KJLnqPqztaVARWH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bbf4656a8cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391496593"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B6BACD1-F85D-11ED-A558-E6255E64A624} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f658f2db3032544cb8daef63bca1b4b600000000020000000000106600000001000020000000338df68c3384e25571b4b156a8cdbd20d43ceeb725ed9f815bccb03494a5416c000000000e8000000002000020000000137aac96bdc8754d9e54b10ff59114da03411cae816b6e62285f7fd05d5ea854200000006dfe4800d230d1edf592db15d17549a9b6ab711bbaae5e2120d6a07bc4527b54400000000b040c566b7b86e63b07bef3da24b14c768cee67c10cad4ed04844cee5dedc4f97d3ab794891b1b1e017c08e29455e080158f1a182a4c4346fd07ed89479dbe3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f658f2db3032544cb8daef63bca1b4b600000000020000000000106600000001000020000000a763bf1315a0ef376acdec5c95f4c7f3bf3414e3a9c50c40ddb031fcb2518bee000000000e8000000002000020000000ecb8da9aa6cda9b3ad9042a2ac4cbd48ed341d7bdb7031fc2b9fdaf57de0eca4900000001a6c3fc5789428bdc0debccf83a99be5f6f5aafdfcfb3c146248da5a2f4e8ea8d05f1dccd3ee7b2a6216311785d23684cb489a19bed1a5818d4dfb545a12c0f972638230acc502e74b594d1551692f8dc98a77fde85b9904bd4a8334b6e33c5e194077506d181fc32909b0dec5b06388938df96c3d15c983e24566001cc603115b411f04fbb6eee89ed70483ef4fa8ef40000000da1496b77dd2bf2df82bda2454fbb15330040a48737b85bfb31816554802e28a0a75a4f2a69436b0f7590715a82339ad4d1b5a149fab72fd343e8771161bf6a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1208	2008	iexplore.exe	28
PID 2008 wrote to memory of 1208	2008	iexplore.exe	28
PID 2008 wrote to memory of 1208	2008	iexplore.exe	28
PID 2008 wrote to memory of 1208	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\=_UTF-8_B_55S15a2Q5Y+R56WoMjAzOTkyMDEwMi0yMDIyLnBkZi5odG0=_=.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbb658fb894cb40b4e29abf9da179cf

SHA1
4b939a562ed8f2922e12b17d8d7778b51888a0c6

SHA256
02b702e7a1558a7afd0b419b7cb0cedf71b44c72928f7a56ce1af6a2b12481f5

SHA512
e0ab9c1e4ff5c6354e1048c4d62c82d7d27b72932f6c014a29231b976aeaad9c815cca04bc72d141b3fa0ed0077af99b6f63c62adb996102fe70d28d14c42d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077d2a304a6d7bb998befbedbe28ab00

SHA1
013e3f2cad10cf86b0ce8bb27a4d5c4de2da3a36

SHA256
3989504832e28ea9749b3f041a4c9c7477ac7848769f29a358da884a8a17cd5a

SHA512
15c8210c2c34834f58aabf071143167dd147bc88563982a2c861dc7f7da723698b20f5e55a44bf4113a56dd13d5be43e0ea773511b2f477cac8bedbf500a06b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4e1f2cf7f8e737af020b608446cfcc

SHA1
a4a15710e4718f1b18b8e3523851eb1e5b6cb4a3

SHA256
b819a3f9562292c3c64853f1cabca6eebe7521ce8325037b6580d47e89661b49

SHA512
1b80b86d2be3ab321677481def760095e6e9cd91adae02dc6ac1fb4b26d757913e1e4be1bc31412884ae1557704df6078ceeef3567ee21be9febbe0fa72e229d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
611dba8deb948ee987e233d9714cf1b1

SHA1
f4349c13818953b3e7ab01c384d1836a2ab4e9d4

SHA256
5885072dbf337e221fd81e8f814b9717eaed432f291e69aa088d8ee606ded469

SHA512
8b7bc628d61df5b7c42223f94d19d71828fd430e4b1df3fc0113b6dd9f28191d5c63369d7b7a9499d9ae55bc4d7d70baa2c6084a94fecd9998d025d6c6a299c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfd47a1b026fc18c2cb11c8a24d328ca

SHA1
6cb5426c0bf2352bcd88fa027ff12e8f832fd5e1

SHA256
3ea4272e7886174aeddc626ca017f5a50f99dfee287ebf4c3b0eed74a7526f26

SHA512
015ef6c7fd92231f317592288f8b7923681521e905cf55b63a0afa01d01781e3e3931681307ce73800f62acac9084185c70e01bca955d6646a8f042b8994cdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401a2db2539c65ac73a2437a123ad24a

SHA1
31e4e3180325ca8759d3dcfdf7c297fc8d5eec25

SHA256
61dc2f642731155d4f49bcc425998b9f9ab27b86e280b1b108d83092850fab45

SHA512
d559820402d7427a735938d6a88ae1571f612d43991f48a4e55665d4f5e1e86089ae018b7aa2bc64f0288d5c19103181eeb6cb2f89e3f9c4761c785852ab67b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5faad00b175e19985b469324c1d37b9e

SHA1
52ca0c6924bbab8cc419f0b926bbbaec2391ebb3

SHA256
a2860d95f7f95780f7f76487880f158236a554879b99c98e61267af1e802ba92

SHA512
d0972a3c0d097f3b8ebd1d4ff188c98df4dc1b6f24643c89d8a43b68c7f20bf912eeee849cf316d284b50d5f6880e18e225449e45e712e21f6077e20ab6ecda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93b669bc901172fb0f0dfe0f59b6f09b

SHA1
8e28a646089938a6152e981bd8a30ff1d619ebc6

SHA256
bd9950c1c2035cfbeee9b7c34657e38c72b4956936fa7fd94aa71c7608794c5c

SHA512
f94f5413033157b8d8cdff9dd1527de0df9c8d499a152854bc16243787dedf0340f5060cbf1a221b365c41888e250228382c814c0662e4e743b463a9185d95c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cbed92997531dc8383cff0476c99280

SHA1
02de90170a37fe0f2a34c9544e6c6a45990b7ce3

SHA256
b429e945ff9876f0c543ac97ce3ec1b5259051f27157772c56f2141147ac6cd6

SHA512
eff0a77024edcbdbb7e09ff65066229431d9a276d08e182091e4bc87f045951d3a32759f7a54fc36d1bcb15e3d5cb0057d9bd46beaec4800018effce76bb0b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMIDRLTB\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F5C.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F5D.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5118.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5D6FC7HG.txt

Filesize
606B

MD5
345a36c2c7715e7e051ba193e4491a24

SHA1
c1b9e467de9fd04cac4bbbb8956b04d7579d46db

SHA256
65184f781d148dfd587f54a4832dc527446154cb49b7924fd5a78f6a5b124e4a

SHA512
a5fd6539afa806d86658b599fd0af472bc2e7c1056a7cbd663f78e27644092e72478b0ba46c70dbbcede791eebb9df3746295668551a309f545a769b25cece05

Download Submit