a00a02298eefac2df3ca745db4d6a9657e2182967bbe2cb9dafbb9594410d0c5

Analysis

max time kernel
194s
max time network
195s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/05/2023, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

➡️New_Voice_Note.htm
Size

1KB
MD5

ed3c5e25227cd8c8c70dcf589f7d60cf
SHA1

75047c65012e1d57263256efea850fc7affd3354
SHA256

a00a02298eefac2df3ca745db4d6a9657e2182967bbe2cb9dafbb9594410d0c5
SHA512

163f70a0800d92d32d7ea1307e2c887e6a6751056523b28d90b9bcf22c660c8b226202d81536be8acdd80320020aae60121aa0b58f0ba03f00a7d5eb076e5f1b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00b8109818dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f3511cf476a1944bfac3d53fe7499030000000002000000000010660000000100002000000094b1ef9b472a94328db714cef6d47439c884e5d8b150276865125521c4bba8c3000000000e8000000002000020000000b6cce53cc6923b93603aa53763eb6c2075f9e9d0b3d845c6f4ce7ae679d006fa90000000a3a14bf071aa5382f61b27caa3caedf0a301eba22f9fa0d52ea72f186cb332f7fc93aba2681217f9c47639ee1b048491ee4f990ee07b11ab16d1e00ca7faf7474fb1e351f49c7b6faf907355b4460f7cb3f38feb578e0c8811f8df937511911f38d22074346ba1ec476df07b65840ca77e388742fecc2bafd6f2125a01731190cb953e4e5dc93fa609b5f709d35e705240000000c89aaa15d085d47f13328769a7ac0ed4a5dee31f0a4282e4066d7c754fc03d33bbcbd7923ea3f00752ff3e33012385d2acc3874a769fa74487572c442e2f367e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391616267"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f3511cf476a1944bfac3d53fe74990300000000020000000000106600000001000020000000bd992aca5f28e2f8e5f7edad7b30f790c2d16eb5fefd9e83d8910c440c042f08000000000e80000000020000200000005e577abf4b0b2deb7d6bdc4cb3d0166644ed6b2c9ac0dfb7fac7635546a97fc520000000c77f354e648f44a9bbb4af1333edb155b5f84e92be44fb3007612bd63687a000400000003f56da48e1018862f26ab969283a730f3883407bf57be40e80bb416c368db5a1e9a39038683235d87a2e90018d4ba76c034ddc86f3e440ddcfa82d9875cc5462	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EB12FC1-F974-11ED-97FC-F221FC82CB7E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28
PID 2000 wrote to memory of 1484	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\➡️New_Voice_Note.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6982e7a371f26af8651bca6e8cda5535

SHA1
97b24da40787b93c6f74d40f19bc4591a889751c

SHA256
3f0b6123d2b62b66a27955922acdbde2cd27edbe1b5d724bb57f9ddf5f01956b

SHA512
687c5fffb3f6c67fc8e104b636cf5b2e9bf99e5331f321d74a0813444f7eccdcb64c1093d1845bd04ad648ee27852f77b948b98c087b63e9a8b922b27cca0077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989d39d046e11f63ca029122dfa0cd15

SHA1
6346f87d07719012bde7b8137d36037dafd0ca8f

SHA256
f680a50b23465be978e341f1d5e275fd424169e1d23b2953842e47e3fd4d5eb4

SHA512
b4d4144efdeb2d08c591eb8b6f28eed88a12e2c45f8aba818186469fd914b3326b30cfd36bbf20786c161acac37ac4000fd942505fdbd34470772576577fb577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5efc8db6038bb8607f18a8cd723afb

SHA1
a9a4b64a1e2e7ab94f7088203ca814d952b2616f

SHA256
46e80befc1a5ef06470a96f60bdfdd145f9bc425d6782967ce7edbbe1e351193

SHA512
038ac8d8055da70bb470a31c8683c6be1a4bdc5f330f78db5aced0c0693814fe58b6455ec6a4d885dc52d323f1a195e5642d86744605b959e8d023dbfb7314fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ae09541eb0e0cecf62a9192356aedb

SHA1
6630182555e35edd172b3c6b0692335da8b7b64b

SHA256
1b4ace669de4de252ef327dba97d9f14876520f18770c4f7d40e50c170e1657d

SHA512
a9cc2f55c84b1da888f06421968b3e7e1c77eb97ba2338baa9213a84d70d3641b31a01f386ad905226170bbab65e5f5cef7422ff0673e0401d9304400d0b22f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b770b4df49efb978015ed297492c299

SHA1
4e5afe703c0ccf581ec8c8c9a0e084e61b45cccd

SHA256
a71420d4dd883277f33dba01caf79c3c8d3a0c854586cdcd882b2912164db8bc

SHA512
1625ad9e5dd6cbebe04fb5cbcecc9db9c746f0eb577fb114b9207a46dc16719ac52babf50cebe0e9ca4692039f7ccb3c0b2db2a4b1dc64dfd7a852ea7f7b08da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7585dc8217d8f0a7b299f8f172235f9

SHA1
20977b26cd6d080b25dc154282c6acef28dde1eb

SHA256
00692e37c1201b816ba68e428d5a86e3638aaa872908a2c15b872f5c301cb376

SHA512
c4178bea35f12a143a71234f19e7155293da0d1efd657b1faec3d8348c8d731b3a17d5906d4a4d2aa65b8a11c6744dc7f5aff1ee2e8ec4c357593c5b2400c6e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41f71f7e403936b1ef2d85bb0e796644

SHA1
9389b121ac709948ede328d9c5cc7829a73b1d2c

SHA256
f56742c83172ad255d826951e7b0ab24e78850533318a74116e659f6049f6b43

SHA512
bd093eefd93de1a135bfc68cadf45bf9feec2399593e9c741ea0f62d2c1bc90b99aa54c568df7d2a194ddb2a73bdb03c5635b2a15bc9cedeb43524c925b07f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf337adbadf02c35c8ac073b7a1339f

SHA1
37af7173e6828e0c54ffb2d35045cf06c043b83c

SHA256
597558a9982bc0784089cdfc9cb9272045fb09afc9a914ec5805a2bc4748b476

SHA512
557d9cb18ab38429e0d8beff9046ec46032f43d95bd7be19fdb25c30f4bee925a804712cf82b491570d0a9ed56edd25120d46d3bb57addbacdef9603b05ddb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed487524e048b314c59824ca5fb8dd7

SHA1
ffca2dc413547d362d587b58889f3a33e5274374

SHA256
9ab327f7e7623fb9825a0007147bc8a18a619cb0966de235a22109f3c617d8d9

SHA512
22d8274fae155f6f9e2af31ee60f40933e043bb582d0f250691261c61a74be34b3093d6d3a2b5fedeb26bc176649a014299595e04ae2a7cd88f01a2c870f29ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af895a9c583b8ed0bcb4a05a54705c83

SHA1
5e74e0bfb417559af435892b210e5eda813b2dbf

SHA256
4a4559690ad60f81351342d4f60283c1b1cc257d1d28658f87fec0ed7826c358

SHA512
dd5ced2f9689582a11d492ac3a224dc7145b6500fd931ee9ff8bb70173313c6e0bc4fb329f41a8d4505e68625d150c087230db414cca3c9f60810ef99a1845f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2771201546d438fef40e5c72cb69ebb6

SHA1
654a75d9dfbff560864699775c8e29fc4488cd3b

SHA256
134bdd48ebf3c1bca78437c158840c1e17dcaf676bc8d2175db854b8e40a4dfe

SHA512
24db6e69f45f0d64c5cc2cfa66c8e58c239bba9dd34fd91ef2757cd49f7bd66216639662d871c7d5495f99b42197d193a2812c22c418693b449928621f5e394a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c7c3f1cca01edb325054f2a595f248

SHA1
27e36abb8de80610e919507203a04ece20c8481f

SHA256
ec3b3a5e0ac061ae34bcf3a94b3d93ff402b4e0451b8a56270eec5a948155b72

SHA512
878505fc265495c7c9909173a5c0d8a441169a18d806c86480b58c259feb9ccfcad9477dc780de16df046f52804189f0bd6acb6fdce3b6abe90fbbdaa7bdfdc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T22XS5WA\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4829.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B5XB92VE.txt

Filesize
599B

MD5
4fc4274c22dbd2714f5afcb737b50319

SHA1
1304b6420b169966bd1ef0354718f38f8c4fcfd7

SHA256
9ab6d2b5a52e24fd71d047e9e9cc3073d05259e5291ca9e5480d8a1d508ddfab

SHA512
ff1c95f7b2da525f5980637452afbd1d1a9969d00399426a05c1127fd489653d499847131dc498a5d5ad7dfcb3f6bffddc090df338e33f4f6c78c31978d4f92f

Download Submit