8cfbe588190be5ea584f3d13b8959ac01724e5ef480903984adf5c444ed46796

Analysis

max time kernel
132s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-06-2023 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0906fdce18accab1a010b4d7c4f9f4d7b99f5578293989481a06012424ac57d9.html
Size

207B
MD5

5ca041df2f6199357d60e29932f2d40a
SHA1

f98a3dff29363da7ed8f7d90375c8c7377ab1e5e
SHA256

0906fdce18accab1a010b4d7c4f9f4d7b99f5578293989481a06012424ac57d9
SHA512

2fba702f118447818c883fda05505e6b991b085eecc4e974eed0aefdaad9b8526d0f15f5cbf05ed439523493012641071c98921174b65de5d17ba5e92a8439d1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7d13992dc4cbf41893762e2cb2a06c000000000020000000000106600000001000020000000a1e8cb83748f687888c7d9c2996b6a19db7aaf6f6080562fec75099f81c5320a000000000e8000000002000020000000e8296f3158ca4af903f3f421d845b113756b0f060bb0527fc0faa9688e3cc80d200000005b60e52f45c22d38098b710f872a760523f56fad7c0e9a21d8f79676d403685f40000000e2fc40e928a3504c449f1a7eae40008bb017a5c904f076a991c88b4fa8311ce260f8527b894ff19a1fd035285d7f9149c7e976e5b6a59c1647094dd921c6abfc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02e16379c94d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392397600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7d13992dc4cbf41893762e2cb2a06c000000000020000000000106600000001000020000000225a371a98338576a4ff97f38109e5200c5ab0052ee5ca4574a635ed95156a04000000000e800000000200002000000013632db6e63653cd91f2b7fb671b622d39ae682560e8cfe825ebe3afb996cb5d90000000c09c27cefefef41714f49778d8ea8e3f625bfe60ebc17dda05e11c1e020cd27a3c0962d627a6c863e7e072301c1fab61dcd055de53853198c13c2b2e91a4887ac6446e8db50d8344bd17e474efbc2c7cfb73abe568f3ef49635aa8f631263931dda8ef07d4afd5a440e6719a97b78080a447aad74b94f0bdce41505138e2cbb5c1f65f09bd61833f3239f7c75cf5df2d40000000dff0ec93f5a4f4bde3e8432e6eb76f4696522ea6be34d286c0898cf993df4b4182a6828f9de8e53de1c6e4bf468c1b7f4dd278e570456ecaf3f44b80b1fb89f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E01E591-008F-11EE-9047-DE010D53120A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe
296	IEXPLORE.EXE
296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 296	624	iexplore.exe	29
PID 624 wrote to memory of 296	624	iexplore.exe	29
PID 624 wrote to memory of 296	624	iexplore.exe	29
PID 624 wrote to memory of 296	624	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0906fdce18accab1a010b4d7c4f9f4d7b99f5578293989481a06012424ac57d9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e851ac64c08e5b9da4ea9edf35594b

SHA1
a90ca6fc6636e793e71c0c8063b89bb197812a15

SHA256
a036e7d81ca70138e8dfb65c070ce3fdbcf5b1c9f8cd3e5f17efafd0e7c047a8

SHA512
1f691485ff05e3b6661222cf0205627460a5c56c414999a9d277a05996b7f43b233fc1b37ab6f7855feaeccd5ca05b890bc28f0a655fa2b1137597a9f9266c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03491bfd18876c0edbb44b9e608b2b35

SHA1
52563f0a82ca4e0d1467dcad1bd4e1e0e8bc6a80

SHA256
48fe1fb2f37cbfabfc8875820ed97887d02244ca0b165940072ec96e5d76b44c

SHA512
b006dd75be35f693b8efb1095e175b3d33b4327e7760ab988a0b2bc7f4f246d882a9f151635b22f31d6324507c58ffcd542493b3a55e368d805cc3d96bf69760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e3c9cfd825bc2bc0e2fd78bf58584c

SHA1
afd54c583209e50799582219127f754dd4110162

SHA256
ee0df33ba98c52c77ee80a19e332662788d9176f3438e9c1b8520b852f21d154

SHA512
d82d1e8a216b8423efeb90982fdada0f6a2a084d9279d6a1237a3b56c5c8083edcb8a8426adfff189d3dfabfdb913d7e0e2eb2b8243f4a5d704bbba1d751a859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e445bc3639a21e2b9f796dd4486a1610

SHA1
6756e5fb12af6f3b8adb84473eb7927dce7773d4

SHA256
30f18cd412d24520b32cb1c7a3f2c6197b4ed7ed6fc037c5fd2ecb43eaaef6c3

SHA512
87f1e983c0a948bc6fac866ddf831b4ab963ed593e0b9527a40336d43143ba9041f02f67e917fa3b693a245d8dc193c3dc3f13dfebcc175dd7424b92d06141ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2815ed3d6f61b24455d158c663c34bd

SHA1
7828c65b9fe00fb7e9034a3cf4c5b3bc28ff48b3

SHA256
e0bfd7fc3aaa0ad6acdf3af461fbbbd02a566492b592d0d335b0cbec3088a71d

SHA512
65ea023a90430fd6673b10591f129bf659b08ec28993aa018d912f88bb67842e548bb0bebd5f18a2e3930fe6343ac7109e4a2c7aebaffde0ceda7d2bf4d6d6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26c906fefef12722b8fd2980094f8ee9

SHA1
7cd684c744ab4c07c6191eb8e7d3e1305d3308d2

SHA256
16dc33b8586fb38716e60842eb0ef857700a5bb687db11e6bafdea8cbae3e760

SHA512
976a8e308b39a0caf107f98fe240356696e735abf0d6ade4cd94fad393a9963b49b51b2f403bdaa72328fa39ad3d00ba19fe70626eb61d4e507de5cd56b7d7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dafa8d468a9824d2b08d65eb6040d81

SHA1
9e9e46632d92d722bf9ab0f0d4c76f72713eb4d2

SHA256
daff4713af9313f8b2bc8fd7c9d2313ee35f0f1a8070f8b305d67a4487943efa

SHA512
14f2b5c5d8df89dad4d9dbc9e6fa8fcf398566c21e4b62973d85d8aaae0b4e6bd0650f3a6501c744713913aa4d6e53d4472e4c9508216c2c05ba481d4da68ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e60e289076a8aa9333fd1bf280841389

SHA1
5befe1c21130be4783f4cb9899b41f822256895a

SHA256
f9ce3f4682a03e8008a4d222d1f9e83c3dda54523b547bff3ed6b2f120f18ad2

SHA512
504bf1bb1fbc3454d06401e42ca2a366dc0d805c52b122e9d3636ce607f5de4cb7a8ba49d76e777ff80ee2d6a8017832baf30a901d600fae2f3319946af58de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d351d7a0c5727922211914c1656e89c4

SHA1
1525971d3b10393e95dd66b820e71c328a320e2c

SHA256
6147eaa007cfb833c23f96708b61c7941b6f1420031719c4182eda287d49ad56

SHA512
bcccfb09d9326cb0bcd063f1aaca37ff8777923386116ab6d04508bf8250e979d2983fe9386ef0ba8546f035e9dd0181bbc9bd1301318421f47cc642750993f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5355ab2da0c3e3476be42ddb3107a41

SHA1
b3eef044e5f3a4ee643b537203fa45d9739710ef

SHA256
d05d5952b45d3d39e840ef48c89c2bf9946e77dd7d580d6f7f8fc8f7cf75aa37

SHA512
fdafb5434544840a8d2f2016d8d245b406536e0fa8ea6cc2e6819889fe23c797c70c8af89f59d202da88d9afaf918c2a9ab77156d6a5e022ebec7a853fcc2575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4D33E1QE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CFE.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CFD.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F07.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V5623S3H.txt

Filesize
605B

MD5
03045d0a9332fa9f5acea9a36090ac7d

SHA1
3599bace6ebc1ea6bed80cd6a0245965adbe2c4e

SHA256
46f48bc14cd4c749ff4031396d844c962a0035b1b88f07f6345fd899211864f7

SHA512
98666d780baef81cc2c354bf0c93a753784ea334f64947c6a7d933d5ef1de3aa1a4451c3f98fb2d35130bd4e3c776452cb509d688080406394b336896cc9cbc6

Download Submit