e22a8b20b5cf6691841d8723518bf577d063bf2d08324060d246ee9037cb790f

Analysis

max time kernel
100s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/05/2023, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

demo.html
Size

1KB
MD5

03b178d1ff60f7b47438321299c1e1ea
SHA1

b4097afe68a2b28456cafad4b70f28bb87020527
SHA256

56a53efdc143e241faafa8eb1fafbf8aa82ea1c630465a5d66a9c406a134c99b
SHA512

ccd7c1c2c99de385b4c53056d2e014ae03164cc3927084750716a100316bb94a42ce4c127faf0bf8caf884ef470df23216c004b5f75deff1a4b62721d233ff7f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000022ca2ab70b01064aa040fc7ea3cef28800000000020000000000106600000001000020000000b664ad287a71f5ec182235c2067b79376c9babd87e2ec8c38b0ee3d65edfcfe4000000000e8000000002000020000000ffea25531446417cb50e70614b8b781e21b13a2d1f17b144eaaaafc4a36b651b200000007df5a5a47ca9f164222305c960564e5f7edcf3762af91cdf67497beeed80f3f840000000e2aad92300118c571ebf81f1ccdd36c5c7ee1671ea5857eec87a360abc4e4709f01f0e193cc08834ba44174db0a97b542f19e01650ebe5c0a12ab4d7458277f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000022ca2ab70b01064aa040fc7ea3cef28800000000020000000000106600000001000020000000f256543243a6cf4c87e1589d8451552ea6be8f912d8f071cbb09cff8d9d65723000000000e80000000020000200000007f28c473d622180475b0e339b3aa28757589a76f0a0d0e5ef2e0b284649d2fb990000000444b460d83cc709b661e23989fad8ab65dffd40ec49c16a3a6b836f7c4aa2c3a74c7922ea312a2a67e09b3de7af557ae72cc3ff884c24f9d839638858783b071c3645585d87d25f30c4c178fd49dfef27a7b1457b74242ff95f494daafbc005ed767beedae6e1733bddf3a0332ef88cc1e607244507a8c5ca2b86f3ba1ebb37a0c3f1c18bce0fb1cfdf15ee195b367214000000029a4eb02016a1384b69d8352845dfe7514fde610b4f2814a7665be5f5bf947d4ec71b246b7fa3de0477cd86e020afd87777718e89c70a81c496cc01d43907a89	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BAA8051-FAF1-11ED-8F11-E6D401764DCF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b09102fe8ed901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391779900"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 432	2008	iexplore.exe	29
PID 2008 wrote to memory of 432	2008	iexplore.exe	29
PID 2008 wrote to memory of 432	2008	iexplore.exe	29
PID 2008 wrote to memory of 432	2008	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\demo.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c1645885670461bc3d81de04342a81

SHA1
ed59537934da2a3b2df1ab8b83add7e07c589ca1

SHA256
d2d0e960e651937dc2f5bb98688c297dfe311654059f130f687f8828c6b7c023

SHA512
a4e9fb9edff975623db108f2969d7599831af611b26f0143403bd98bf622908331ec961597a1c0722c271eeb9f14ce43c0f62703ec9f145b116dfe6fd0cdcc59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cde2ca3e7703d7b3201dc7c202add417

SHA1
3dd52ae8b2921552be421fb0a435dd6507166a32

SHA256
11ece791da58476435a01b5aba4ae2783ae074774a243456be9c0e71d44d1f11

SHA512
d42c7f4ab2c5623fd702c9a9462b24df05894d338f141b5554df25f804c1f2ad262ff8e0926c5af9c8f963b324e0bb22fa14e80a27a01880adf433a8e007fa4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac679a319e079530b5c46d0ff49fa69d

SHA1
45e280359dbfd36ebcac9b37efcce6078f456dbd

SHA256
4104515cad4eefcf8c7ba3ee882a10a73de5a68d659a97a3cde54fd2338c3a9d

SHA512
a8eb2d268f89b4403df2b9fa368ed1bb54403c4d2e865cdced5d3f4130ea0835cc237d7d718d269ffca4de7ff8beaaddf2ccb2a56ea9968c1c9db56fd1729e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
848410327f37bad84ad8ee7ab0f604dc

SHA1
948efd461d1ea1b3abe84411a476b51aa406f3dd

SHA256
e530dd60024de96e1daf9e0795dff6204f295852dc4edace5352a2b986467d4c

SHA512
0fba991d2433158ecea3a2c3d99e6aeb238096d066416aa8f8e5786bcc151c9863b0981e0d7e29c736cbdabdd04c0ad633eb45fdbd5507008b33b295ce284bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93bbba130177faabebfa206a62535ad7

SHA1
3130d8e3fbffae998b6a025e8b92c4faf01d871c

SHA256
a28c11b5febe1a117724b44085bd275caf1b3cce9e27313b805a351568bda599

SHA512
b6f9e1b9be3456b2e1272852fc434be0421e17b6e9cab170049d64e3c98b03d782d78f903cad7e51c667681f7114d59bec3d289c15b86f7ccee3a79c63280060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f67160c8228b04a8ba0103f338f19db7

SHA1
e48d95e2a71e325c686b788c060fb9e8dd2df7bb

SHA256
727d56ebc2e8fc7b1e33c8451a1de1d14ef7f91f4829af4e3379b2ed4c211bbd

SHA512
db6a9266ebb2ba9eaa4af055d0ae2eb0490c5922e83bb30ecf4dff4c7d66537553b1c3927b28d6e12cf6e9f4d516211a04f0e538c4aadc4ae339d0970f21c6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9480f523b8e076805b1829096f50b71c

SHA1
3d9f7a465111c1130bd80ec4b28ab5b63670e253

SHA256
5e574f94ed7c03377358f92933d4b9e89734bd6f65b99d1e385a4600bc48d38c

SHA512
a3e319fee185832356a5a6e4c651847f65cafd437102661a98469261ed332135d2a97ae2cd737def438e19e743038d7b0483228ed57d86c237eb8ad8312a1623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f36f3f9159e4afd9b10be73dddb03e

SHA1
4c0bc5bc485373fd143162342af851a71707afdf

SHA256
d2e9b196557d0c0a742887274b88e44ba998a0550540358a9983417fbe656623

SHA512
7db21e91f892ac1473e2a471d06dff8cd8e1de2cd303472981146e837a5c6c8320b021a20ae3a9272a0b6ef8db9deb8d34f0eccb5801665e90139d251bd9d830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83182bc9413bee4877399f704443b77b

SHA1
2aa5125725692b898401bbc63dbf7a4245e51ff3

SHA256
c34bf4c1838165d00e693c4bf99d9c1321812105f677aa8c7cca44bbf1b999cb

SHA512
2fe7ba31bd8da4361430f30cc09c00d23497ca9d7afa1872bfe898aada2411a1f4deb2e1e56f9440def6fbd0c1c3520983ec6beac02ac9d68275a45cb5242dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c6932a33c3afa6200d52a53a7c5049

SHA1
1863a629256cd3c7dbfea478d788864d16538d2e

SHA256
5df41940ec164e4f24a6fb02fb18f358f09e770b2d7274fe66154d9bead88360

SHA512
7e46d429c6ab4ef323a3dc428be859bb6b620dec3ebdf9638b5f885394815429bda8655fbaf43f12554c9e3cbadc44d8dfcb8429816d13c5352622d85dc9dda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
554cd30808dd63ca9725292dd84472a2

SHA1
445a181ee16de6661ee68fdc844288a20aa40e76

SHA256
e0cbd16045d141ab404f3d8c0c2700c404e2462e535275d91beba775924ab136

SHA512
b4160489b1b32334bfbbf313a062f05ae5ef46736820e47a8f0ca189f022c08ffb6beed63a8192d980fd94fc4b7b679b6bbddc7ef6a3721184377e4ab156f4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5965abbd1ffdcd46ebdbfa6ccb90968d

SHA1
0729698102d42501bd5786f94d39df450c349d8e

SHA256
789c47f185d445bb4a85634a918842062557b3de82832cedc06ab07709b2c276

SHA512
6d30acc9642ae6f4bf3357d2d3f7dd5d06610f35cc5fa56c32a665beb798c09f2f3616bb02e037de2b2f09ab7262ed2852092c94e872fdd811a1ac1750767e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6107.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab642A.tmp

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B92LP2UV.txt

Filesize
603B

MD5
31b6146531ef8d793594b36bc07c273c

SHA1
b5154a3d61e64b27123612a993ab74082ebfae54

SHA256
2445eb8d2fd78a7c823de962c8306bdd24d990e2be67193a6e915ceae2881082

SHA512
1ca3b927bdd6af77abcf03cde3d6ae9030a51b0da242d74c5559a395c5177bb2a52ccdc7d8633aba7be98487d4fbfde46f437eae1bd8bf2adf9ff7913ad82213

Download Submit