460bbe603853611287bb45e77f38da9adff85210a283b433deb11684288ec7d1

Analysis

max time kernel
100s
max time network
138s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

error.html
Size

458B
MD5

3b6ba64075bfb3ab089a2bc1a60b527d
SHA1

1dadd622a621ec8e7d0f0e5bac3f134c74721dc5
SHA256

51f068e89cd1e3dfaed58c837d5a4a4083bba5d2bf33cb3528a3d7f48ab383a2
SHA512

1d419e9fbd3e49e67b02b86e112dcf9ddf01f1cb4c55c812c1d4bd4db6e9aa279c3937217f9e47f1c43e970d7b5b42196924e2fb5666841f9161b5f3972abac8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ba8348460b6184cbe176c59efaaedab00000000020000000000106600000001000020000000f5add1af613c9a27177cc972609efbc204318354e9aadb9dc600a4bf16610263000000000e8000000002000020000000ac66826a0c9b4bfb6a8dd7f878ac501139fce75792f1baa77bf5abbd8c6b803090000000c52f79470df587319962a29303714fe34dc52cdb8a5476b58aaff2b74490fa1967808b875f7c14373391fe291d0de2b1fe90e3467982b5d45526094b1f1edcfaf868dfbf0ba3f8b2c56b3b9bfc7d4789081846458d4ec934cc2b6376d5f20d2bed7cf85790d198333c3f76d13d7382492936bf3cdbc10f4e4710dd0b71d7f344b018611b66867e77ca343d76632161c1400000000afac33d35621bc988d80f65cd884f6abed0958754a1ec22a7142baa89022b28ecfea7ed059092413b3c61d7aeb8e068ee8ecc13f730259289fd3273d1ee64bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B08A4C41-0412-11EE-B5FB-D6914D53598A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d264871f98d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ba8348460b6184cbe176c59efaaedab0000000002000000000010660000000100002000000054eacfe5ee0992c06520eaf931e9036f9fbf786299084958f025bf87c127771b000000000e8000000002000020000000deb19ce817ee78d629c21753aea5f6a37f4a20885f04b560c2a38b06829e7cf820000000c875d43e350562537b279916a7090ae034ac3778f2b129c3062c09f9404b7f7f40000000ce89a946d23d0f7468b1b6361972c059330a433a4fc4c95bc98f37335c042f90fef5b3cbee4dcd008019dfc12934494636997136130d550bf2aeb53bcc42f523	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392783856"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
920	iexplore.exe
920	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 1296	920	iexplore.exe	27
PID 920 wrote to memory of 1296	920	iexplore.exe	27
PID 920 wrote to memory of 1296	920	iexplore.exe	27
PID 920 wrote to memory of 1296	920	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\error.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38764f3f0b2aa9bc3161cd3939e50de7

SHA1
27bdc679c6093f73e5a4b43033596f2fe156fe87

SHA256
197602328c9c577bac1aca34b645f167e586baa6e221cf5bd0bf12f1224000d8

SHA512
b3a8aff06cff6904c76e5a956f2f029730cb19d60fe6abb024903d2201cf18108b2b52df94de2fea2d30a8923954a54c4df7817d8688ff5688dec91e2702f4d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c9b81c91f7821d31e99bf60bfc7b749

SHA1
491b30c2dc2c6e4e69aff918b1b2608e30e6b4f1

SHA256
6886375675d53cfb670b612bf56ef35c6e68e0178204b93f7222c830ca27ba60

SHA512
2e2a11b665da647f3ce08f08fce6e27800156faa0edd55e465ac0a0ff11a96d4615288fae4b30b67a5644058d1ab0d845bb7067e222586c2af725350b1f85ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
866dab5d9d1db06f83e227b1a8d597e1

SHA1
a023c5e101c1a9efe8eaa6949cde787447574712

SHA256
6ed37e498f64071c3b5205c4311382257341c2b2d9978f8bc650518b9cc297ed

SHA512
c1b0f7567beb7082015b99aee6793827461755e3411031f7277a869e2c9bf25d82bd19420b9808013f0a7dcc21fdd7805ec6a4e616c01e62d8674f91f77ea13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1981c985c59e368b6f795a13911a2a67

SHA1
16ed60b12df166b4a0fddb85e3109ddf6f296961

SHA256
c46620394fffaa77c8d133159a86ba964f6c4c646668516430ec24ff792ca39c

SHA512
b88d6494519212b19d8579ab8a8c1bdc5886dc10e4379ee56f39df77aafac2d419e34a61edc76c3b42e282c854180f2ca22aaa5760d245f284e9f5b11cc5af66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6f2ce33169508d5986238ec65ac3d7

SHA1
d285d6bd5ca165d73d12cbd098773121f0683350

SHA256
a5246d56140060d86022d878f638e660754c97f2a38f6e955b8f59065168a1e1

SHA512
5585b3916ad66f874a2c6028b3625e691bfaf052dac9d0561553480d3d1bb24c58b61e842e4c3ccc81c9957524ea3dc9438f4cb97cc4384c5bdd895e7175ff03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aef0bbe73ed2fd15b85ce397c85846bb

SHA1
7a2cb0bdbde5938cf903d5d85ecb4574833fbd69

SHA256
ebb20406ab3d34f13e3e93b3abdc7c3274df210097362c19de4213401e3634b4

SHA512
84ad1d9193c58a910210eecc068778554b7c2b5548b87055d68c41f287867364dd3a53af915a2beb05c46b02e7bf8652a6e456916f1786cdfa6380041c56cd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d8e9cdb0afe7828066a11eefe666c23

SHA1
e8b74c2d1e737ad979d36c4ad165915421e56baa

SHA256
1d45e1ff6784d35a9b86e2ae11e72ae9151fb30bd7644c7de4ef0cf61ee6d3f5

SHA512
ea3e466da076c963a4d372558244a29e3e095e382e7ffd3c9a1958aafac28f9ee05412d843626694cee8bae061691db33df6e648d5b90bfca1d0b80f3ac4757b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de96a7c32391e4daec63141a8bbc4ba1

SHA1
4a6f01985072c890fd73998744edacab060662ef

SHA256
51e710e074da7925dbdf6feeddf21ae6b4472f74fc47a5a18cd560eab7bc3afb

SHA512
3b08e2c2cdbd131722e096814fe8c2ba7212a79dccc25daee92b3699be16b24b161583dbdfa566e26998b54f1a20af40d05f8696cc0f83cde5aea6807da83de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cfc50d0615a048018b79869ae879f5a

SHA1
b497bad6bc3797b55eff1cce398098efaa0b25f4

SHA256
8aed4c1795b4939c71934a3457a4607b79f0fa975f0e9167b313a1e8706eb8e0

SHA512
6396ab52ae00abc253834d83ca7394536636469d8842bc450caf87578c24432561acdb4a1d31ef015b4632c81d9564814775f340973c9498f9a7eb4facbff717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac86541e96813f88800d3551c8602961

SHA1
8d7abc7384b913db685c0794f88a0afc6fd6cf1b

SHA256
edca926188b63cdc17749e76eb0020b43b8837b102cf9902243965f3a3ba719f

SHA512
1546b8cc6e1c423104e966d0ba6bd95f979848cb2b2817a0a016f30e2d78146396b3d6254901a23253fbc6fb7852e96af96fdeba46cbe150b7f1c380fda582cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF41.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PAW8I9LX.txt

Filesize
607B

MD5
e44158091ef69ea3be87628310aa3e22

SHA1
3c9c619dbbe00317bff8a6225fbd92f6cd5b74c4

SHA256
3deeb3e8b614c551984879ee4da932d6b425cabc3f422ceccfbbb1ace9b635e2

SHA512
7c936e6c9c804ae326ff400fc80b770896ebd169e589ed598058fdf9b6e7fe33a243e4c152c9e30ef502ea8c46791f70484777d1076970ac490a6ebf237c421f

Download Submit