460bbe603853611287bb45e77f38da9adff85210a283b433deb11684288ec7d1

Analysis

max time kernel
100s
max time network
139s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/05/2023, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

continua.html
Size

6KB
MD5

7d6321780ea71322ca45e67a005d0921
SHA1

fc6c6aabdcd4413de3e4dd53031ecaddd41b7fdf
SHA256

2af1eb500cfa4ae019958c3c7af92a826f1ff5f9320315b629dc68460e72b4d5
SHA512

99604161a1db28688530fccad00b82106aa1fa5acac20273e0df74420d5060072d31293e2e9b863bcc0cda313014f349402273a4ee61c466006583b46bd22d0d
SSDEEP

192:XtKC03JQTS7vYBnhnsnrGKHEanMW8qX3IR:9KC03JQ27QBnhnsnrGKHEQMW8qX3IR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392013292"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000af20e551ee52664caf41491454a43ef90000000002000000000010660000000100002000000003aa9dc49dc98307cca28a7e190aa5f8cfd8dd8c0faeae87a228aa8175ae8afb000000000e8000000002000020000000a7ab3afcfeecfc161ae2f588dd7fcbb31a726e4da16b8f4f6305de26aee774ab20000000a31c9a3c88f1d39a04d7bd2b291d1de97a643122961b6be1761a6beade335ec7400000007d1a831d4a7cb03f89eb4e3ed2b556e9de31687b4677b96af8c8071256ecd00a340d4a3075a0dd4342ad254e138cbe4b337fc890474ded45af993650dc33ecd5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000af20e551ee52664caf41491454a43ef900000000020000000000106600000001000020000000d27bedb92e84c537949b49b9b8f40ff698ef2db927387aab2368f10ea0aa9567000000000e80000000020000200000000ad10125da97e5c23638d8783b3b5ffe0c61207ed781a76cdb5532aa379ad08490000000d6ce8699146ededf04c900e214c0529f7a88a7a86fe24d42e4d936e08de8265a5022228ac461d495a4e1eebedeea0fbef0e647abe636fea5f4c8e6181fdbf367350d82b827d7c232e47130029eaf626b8e38285f2918d95bb1b9ee216d2174af3b1338a5b4ade0147977175ef7b93882e70bfd0efe344edc75570289244b53ccb8dbc689eb0f14cc8e857c93f0a32b5540000000065760b5d9d390be92ab8689e36cd840c36106b88b93d5ad1249152da5323d2235678e49d0117fec02ec10136526f0edb753aded42918b1d64c6ca760ee9e67d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94446DD1-FD10-11ED-B609-D28FF4BEF639} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c026106b1d91d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1212	iexplore.exe
1212	iexplore.exe
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 432	1212	iexplore.exe	29
PID 1212 wrote to memory of 432	1212	iexplore.exe	29
PID 1212 wrote to memory of 432	1212	iexplore.exe	29
PID 1212 wrote to memory of 432	1212	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\continua.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7081bb9e9cad2d39989fffccdd0dc42a

SHA1
22063020ed52977b7e6e64b5cd877d5ffbc30cf8

SHA256
5adc9b0f80ef4798c49a1d4b1bf60714f331803f2fa27506d7ca567e99a018a6

SHA512
ed350dcd4fd91f6955b9117ce9eaadd5159de033e506bec8a829281edd17e6a82284fdfc8aeaff3c4dd97230e0842ae74929ffdea2fb683b2cc274ce44417205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f4113822ee5f6896315743091e8688

SHA1
a7100fe2003f00cfc99c997b51d0b9a83e45fda3

SHA256
255ec28ad77e6a83cb62bd577c431e9929e47a38964c80b4cfbe6922c005cf53

SHA512
ba234a34077594df71dd994859b02f5062d872e4fafee9d3cbc7de9ac459ae8f439156416f76e3eef74ca8106c4bf07f74ddc079ae6f7e427ca8a73e50061e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c532b0fbc4fcbfdbed09ceeaf1baca2e

SHA1
a85b8727dadd946e0cb7dc8a8fc90e7dd80d49f5

SHA256
6591a783cc53cbe6bdf12340e588c03e989476315c2bdabd61ccb13ffcd2d4f9

SHA512
4fc00935f0003d8664c31ab869214c773fabb3781fb527a74807af7dfffaacb022f0c4df748d05e0ebce4645002044f7146e0a371a9d01cc2fc4b7991433252b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86956aa44921a3d5210e505c0390cc2f

SHA1
9e4266462024380d0fe16f8111abb7cde44448e5

SHA256
4fa7072dc23ad62cd284756ab1d4fcebbe1bdb38bbcd74b6a96741fefa525901

SHA512
987067ef58a0994aee2b4d03d281f079791ff0803c5f6cda6fadd3e270bd2ebfee71c5f9eceaba45a04b1b62250bfd7b582f04b7a9a2ccd802885ef8e72b23b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e258f7bd009156ce7f760494e894f848

SHA1
c36b50b0e1b004822c1ab0d9469890e4d3e9add7

SHA256
775a10430c5f262af9b712f982040e79a3cff055db3b07d9ac52a07f7557ab8f

SHA512
73323ff393d553d3ad9f8f2639320d41de3809da78686e4acfa39135bf64e5419de0fb308ea25e27d499f211a31276528c76c28b55f9534a316ee0cf91da2321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c0979188e8a7f82b72632bf56ab2cae

SHA1
c11d0f1cb4d6c142efb129079426630acdaf5f9b

SHA256
5d7ece4c00b2063ac168fadad6a4b77e78d37d08d67d023baf7bab3c42fa8283

SHA512
00c800e4f087927c93c5df4818aff11ce52311f162c5846a25b4600e9bd11b7b63079894a4d877341462a08e5e822c3495cc0b4ed636adbfc0ea09ba78258bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb4641bc3a7fc7c7ba7fc03a61c9ea0

SHA1
91822e486054bec3dc89d97b23b878aff4cca02f

SHA256
c94ef5a00bb229df328098f6b2e2eaa23a7cc59eb85dee9a30993765d866b637

SHA512
2767afe05f3f636c3926d30d7361d71e8723c85bfda064dc361c641ac250e0ebe7023d11d9e614c14aeb37295b48b2323ae62a87eaa3d92fe8d689257898374c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e46cbbb66643d7006c2cdfeb9ccd26

SHA1
baf4071364e14fdaeeb4b558f779b0ab7176f149

SHA256
568d0a6b3317c10aa6c1ef07a4954648f365efdffa214ea06a8993142ed3ac92

SHA512
0bf9cd95427377a3ffeea09ed35c202f8441ff175bcc9473cb7acc449fdc783a100c2e05a845f48bb8502070b84b82be8861c76e1d26c91ef3206105758699f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf57356f363dc4dcdbe6247d8ec6406

SHA1
00bd521daca402a259ccc032d0f564380af02dbf

SHA256
095b04dd007663306a4e122d4861b4dba95801f494428ce4a309d8f3d4230f41

SHA512
d7f463c13cf4366630ff36843406dae3b78d27e1f9c58a66507c399bf9db6ea24563ba13d7dcf37e045a25d1d6577604c6dae0cc812f6d811522af3f4cad6b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA066.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA125.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA188.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5LNNYC06.txt

Filesize
608B

MD5
926d65a03b3edcfd84f1e8cd75f1474f

SHA1
81889990de0439d91598193c9ecc6d6a3fc9cbb6

SHA256
bd570edf17ed18bcddbc301cfb67e8088f01021bdd29339db0506af112281a2b

SHA512
1ad0dfb0949093ea83c768bed2b6e28286073e84a1894ae88380c144f2dcd3af7e3055ee444a731b000d2c98c085035673bfc99a1dfe0024bf805e7b2599c048

Download Submit