95982d09c162f5479e78a532d304864680d46cfd2835c4b44add20e8abbd2b8a

Resubmissions

28/05/2023, 01:22

230528-brnpnsec2w 1

28/05/2023, 01:22

230528-brfztsdg46 1

Analysis

max time kernel
34s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/05/2023, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

l.html
Size

1KB
MD5

d1de8ea68ae3677b2209b5627dc8743a
SHA1

b271b54654ab3ea655e145854ef392da15a7e583
SHA256

95982d09c162f5479e78a532d304864680d46cfd2835c4b44add20e8abbd2b8a
SHA512

25d79f3d91d27370678292caf96148d6b55f8791430be6bddcbcbb758f0cb8371b609d70805807ad4669f7f91762fa6672b7397a86830122044678a1de5df9de

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fabfd2c03f3dae4db88b90aa42b16dd10000000002000000000010660000000100002000000069a8b8452c6ff06d0c0316270f9423bb95d3f4e2568fc1905ec04e68551eebdd000000000e8000000002000020000000a40e04e2009db5d3de668edcbf6cf37ad72a2fb6521d8792b00a53c338dc496a900000003bafba0483b7c0a2264546d48f0856e33b5cc883de35174f20b6ed66ac31f54287beec517aa2633ba6df4ad9b61038f567c0922b939dba8637b5a6509b31c403c83fd711aec77e2dad6537cb3c98ec15ec0a95a5267eba26297b351a68341ee41788f8f117f0f99aeaf6bdaa97220c71d4e2dcdd2d1117466403938ef9c0add577a45e5d6c953390ceec455bb2db572b400000003b44fdc3e47558aa126ad8ee2c54881cd44c87f7b87a3db6f8c6f756528bebace82b0ee357ba2eff0bc3a31325da1b93236d37afb5f0bd19b15d49e00f124572	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506e3dca1391d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fabfd2c03f3dae4db88b90aa42b16dd100000000020000000000106600000001000020000000cf325fc55ca04be7e89e67528499be977e76a6d5e15edad9bacb27f3aa1e7e02000000000e800000000200002000000041f7799c645f90a5519e6c4d51bb4670019d99a6af98b4f60907a6c583b7054a2000000067038e4290a192ecfa8f23c40a85ac7562026490cac34e865c51ca51d1fbf01940000000f8dfb3ab3af90ddba97d156b3a10c82ebc5dd8f62faba1d43982fd9d23b45b157e1d150d59e2245e4b06ed1c95aad693e41e13b2a30b2056dbb2c03f6c345a0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3557AD1-FD06-11ED-9688-F2A4F945A9C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
836	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1472	836	iexplore.exe	29
PID 836 wrote to memory of 1472	836	iexplore.exe	29
PID 836 wrote to memory of 1472	836	iexplore.exe	29
PID 836 wrote to memory of 1472	836	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\l.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d062ed53e69326acf43ea99aba3379a

SHA1
4d2024d52751a46c9c41a1fbfb3a07535415b49c

SHA256
9126eec54f706cd8d5cce716b6836f11835c72afd13fbf9c720f0abc7ff42795

SHA512
25bf0e2b0b77fb6c6eaa6f22ae458002e4d37185df095f59af2e5f67beff4289ae4b57823314e0e8141adb87e13fe777943abaa147bfe36fb303b1e61d61aaf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512c9c9c94c428216e0b18ad82ef514b

SHA1
d34e041ddfa47686f82e00330fd18f6d75e8e399

SHA256
9b05c056ac9ff09fe13c46a200343cd59054023f2190da0b48c5e6d841b9d897

SHA512
9781452ea8f4426f3970ddd876d27ada11b0afdbc8ea11d6c456eb37e44b3d7b2812eeb82ad8283d6595ac95955211141ab8619c6d805a818b08bb9368fb2fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c7abffbdf032a02a4a139ca7557631c

SHA1
cdbad7defa2020e6b16c5a2a14db2382de0276e4

SHA256
d2ae355c4e52679c6b65589ba73ae139a708815e9bf49cb8cffa4b16deea1cb5

SHA512
3907e9924d0b2bfe5c50320ba81cfead5e96647f2367091cee4143c569f2e42d5cbe7c8b3d58906aaac638472be07b318d825c562e17f45e67a1b7454896c898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09fe0e490b01b8e0357164028725b4c3

SHA1
ca8d74046c744c4cb96bff46fdf571949d465952

SHA256
4f35f98f12c2c840e25b90a084274c1b9bda316a6c5c90264589724cfe67656b

SHA512
c79ab2c2419050e7f686bc7583a693ef97762ce995f0fedbd24da47e678f950f51305297c90c78c95f84b48278c2d88f4225a539fccc36e0c5947d84ccc8069a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7fa5a5257556ae18e9e8cbaf3d2f55a

SHA1
baead500112d40926d216a089657629b86331d26

SHA256
1a9f67c1b42f3a2627625e8d5f21b2b0061e2ba420286a286a0cbf91e2ac2d67

SHA512
de1a0f588ab6e78d0d545ba6d7b971680df2588272e64900990066677b198b0ea0e541dc80bb535c725d7ff7c7271f17da276608fdfd85979a77f3b8b70d1f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814a418adf1226ca732df4d502dfbd31

SHA1
d57e903803d7049a65e969f3f55c8af17a1a01af

SHA256
3f7b5be88aa47c4f793f33e0cf3e6a7eaa22cd29eb75e48f0432432b099012eb

SHA512
5352f735563254b04885ae4c8896c386331d722826229acf45b05bcc3f5c030532860a27ccf8cacee21e6179b7a9820cd48b4b5debd3fcd3b7d2b6740cc86a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de92923c47e7be6afe23d6b195d7e1e

SHA1
1e4b13703829a05f2302c988103d883619a2e6ea

SHA256
e1c147b96560a2954bbfab174f7aff90162612ca54452c38532fa109764aadbb

SHA512
65d7c73c16a28e07b6a47fa3dcb3489b112468b0f0b3fd37f0ec4198f715192e2272293652ed72dfa7679d03d7cdc634180d4223eba8a0747badc62ce70fae6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7374e355da1db379608828700fd358c1

SHA1
0c8bbd1d3b7a8eb13d746466214a12add82cabc1

SHA256
b547bbe297ea68e0464171f7e8e44be00addfcdb2456cca9895cb1ccda3bae3e

SHA512
f09b869b4a2892466ebde13c49393755a1a82ee89d78142c59e120473cc415381e42dd9b02e2615078a141bae0b9b3c8cca45cd6d92e81adc68e78cbf71a0c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d171631ce30cbd1f2965ecffc1ae116

SHA1
ed67d352919c5633ee2959c409a7b19ec21c776e

SHA256
154d700392071e2bfeb0f1badea6207bd3644e9700ef86a1b76d0a4b986d325d

SHA512
8a9b8d6c19afec93ff4f5d0706e2ada235698026ac464c60a87679e8902ba0d5fe5413ca12a0a99dbbe6ce2ea9cf49d5ec2bdec706ec8ea341d70a3f5700ef8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda6a336aac4e6847c33c95b4759e4e6

SHA1
eb8d6a21001671770b9c8319e8af1b6ed8ef6257

SHA256
80784bf8fb9a29a00d5277ffe3dda900611938a0b68986253eff6c741acf013b

SHA512
698c6cfdd5d1644b355633adaa10d466f9a2ea2ebb0d75a823c00a3f5864be8125e6d55618e3afba8e82cbf9ac8ea6eebda0bf037bebe68ee1998e55ad954dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48C5.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4984.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A06.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit