dd9b4726f1bebeae976dcb2f720c8dc8350b5f626a61b9a323ac4e20f8a611b5

Analysis

max time kernel
1603s
max time network
1606s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

demo.html
Size

1KB
MD5

03b178d1ff60f7b47438321299c1e1ea
SHA1

b4097afe68a2b28456cafad4b70f28bb87020527
SHA256

56a53efdc143e241faafa8eb1fafbf8aa82ea1c630465a5d66a9c406a134c99b
SHA512

ccd7c1c2c99de385b4c53056d2e014ae03164cc3927084750716a100316bb94a42ce4c127faf0bf8caf884ef470df23216c004b5f75deff1a4b62721d233ff7f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b8bd87aa489b647a6e4b959974cf17d00000000020000000000106600000001000020000000ccd41d24b38bd553804869fc95d7e80bd3ff7d6b820a3e1aac9d9b6171ba2759000000000e8000000002000020000000a67af7327e6be980f063d1bad97717adc6c69d30f8b8f0fac1bbd3de24c6eb3920000000775e27171945bf6619e7e5223349be43a49b64eb09ad7f15f19c30c4e4bbd33440000000b8202556c79d5fa9fa0cff6df6ede06a5c719288948578725da3d81d38ddd1014b2e25359a5da3b7fbeb24fb061b65dd8aec2a0cc0d445b8ae3770232ba3f7ff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393113799"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b3a9bc1f9bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b8bd87aa489b647a6e4b959974cf17d00000000020000000000106600000001000020000000ddb7c8cad220872bf4c388d70f7a24c692fdcabf60329a669edf7f9955de1a42000000000e800000000200002000000068d6316efc08387e11fa172a99f295346f4d64d09eb5f990b8f99ffba493d00d90000000bc5c0947d41bc617aef5ac88c4a903c90bd5c15d3fd8816b6498a414a4d8492b4faf69745e439c65573ce2f8cc89be1a9c981cf6027403aa02388fc830beb6072dbc1c07586800834e57b1075307541b10a000a680c97c3f53d91469601cfce81d111dd0d8ed00dac7e70dbf9492afe98d920ab69a9958a8c997a114eede7928495afb534aacc1a45d4cb151370591aa40000000f34df471202e9c958fd0770321340bc9cbd93ef59298db29324ba4782a14000110d85c5093cb296faebb46c2c4413f7eb85528fdce9b93cf7f97ad6c1124cda5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5EE27A1-0712-11EE-BFAF-7E8ED113D2E8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1248 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1248 iexplore.exe
1248 iexplore.exe
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE

pid	process
1248	iexplore.exe

pid	process
1248	iexplore.exe
1248	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1248 wrote to memory of 588	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 588	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 588	1248	iexplore.exe	IEXPLORE.EXE
PID 1248 wrote to memory of 588	1248	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\demo.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4cdea8bff979ea48bb4f569345d5cf5f

SHA1
09727f5c1db6c22eebd3a1f05ece2d90712b6c5b

SHA256
f836f1babc2dd1f1f01a45c5c8ac2a819903305733fb103644b463ad4bbb21ee

SHA512
d198433791008416f144e9cc4a6dce7cad80023dc6c0416fb72e31d44a350d0d7e59182a591c30698f6b5d2a80591a05232add65ff426e304869f1f8e4e66048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
731785a67e024f16091263a71ef8cc7f

SHA1
373d0c28a4b4e26ace2673331a06bcbad26bfc65

SHA256
cc118ca53549bb199c141e3c2f40f5e48c7f5cf01d84e0c793041fea868181cd

SHA512
054c3bfc6063206bc8679478bea6f72adc8c4a6ecb721bc770f60970c531eb392efb52cd112e711f7fa2ee9b4a449f4528a47d84c462afb5fdd88a437f39fa6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
57b05f2230bc7a7d1f6273a7d0426525

SHA1
5db1cf5b0f15fb338556f45a05e2f3a36c57d461

SHA256
cfe0b791dfabea946c6f7e15cff38ab6ef5934974a231bda9dd8ab4ca880e9df

SHA512
608c59e94c15f1b860e87dea7e756fa104381358ba5c54626b9ea93e7ccb34c8001ae832e26d19d27cb0765624843f314e675836b8d54ac2a7a23b537c7f4138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e5d74e02c8c7cbec5eecc22f23bb84f2

SHA1
4889e8dfe4e7b64f87e917f99b56655cb4f5a594

SHA256
0ecfda1c3bf10fe7dbfc4265cf4cb617358d67d116d2f0a6d929e1cd27cbf4d4

SHA512
2278424e620bb968d6d19181097fab7938a71dbeb777c9f419a063fe47965960b76536cfebf972f0b03051b1f5846cf5f872b429b97034f2964c4582a225a448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1909d22e44a49b707ef50eb1684672f0

SHA1
ff3c13964d108159fae691316db8ea799c371d71

SHA256
275c361187fda84b1b5bfc2d87836f19e34021a8e06461e5ed89529f69522b44

SHA512
33a97311e48faafa13e1e73d01b158e567c2988ec265b0d1eda085b4bc8b4024f4ebd9543e49bde640a001ba60923b01914e2cf99f619420db008e0af17b0ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
34dac656068ebf179eebb7d609601b79

SHA1
8f93fecb3614324c1f741abf8ef3ecf4270417d7

SHA256
5e8f3a52cc35044ccb76bd3e9846e983f5e445584102f1a9347a79d0850f0d91

SHA512
47033e31115a241e43d34423d8cfd3ccae8ab38cec9daf1fc55594ce51eb901a014bf90cc532a12f93955780c71ed8191926db5f1b6a15aab6ae1824a9b6b7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b91b585c84bc19e0c7026f251df44a8b

SHA1
10410c479de14d899942da9009d1d9defefbe8a3

SHA256
df657b5597a2e6cf2e7cf62f0c5ad1f5fa5f118eb780f9df45c713ae57c2794a

SHA512
8ac9caec6b7d20fededfb0559a54c8dc7d30c962e03eee82176f39f344174b6f437fb59fe424cca7dd520b1a6493bcf7fa33830d5ff00b4b34d5221b302d2b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a208520b61f5cc8641e92c63743a88fc

SHA1
48a5c193135c0d6e9bb37cfb6bb4c8329a125fd1

SHA256
b819fd81fb03d899bf7e768fa8e149b870ad520fb8423138a87c7fa58a1b514e

SHA512
9d400b965b9981c1268d3626a64db96a8ae05f126fa0703759f3b9ecb772974957daa10a912c411fed88bb41deedc8b3e6b08cf40067c30fb9abec27a13fffe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C19.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4008.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TQ33HGJA.txt
Filesize
608B

MD5
b11490911e1d11175642eca71e8fbff3

SHA1
43e30d6342068dc45cc1d53cfc156e78cfff60cb

SHA256
89945db3ee2035bda04e7c9c634d6c2c183d523522cba1707df0f45ffe5fcb65

SHA512
adfedcceb37c25b239f45bf54015913a0802fe34208514a519d5d19d6062548d3ef5e37190ed8dd2b565f8fb1c80848c93d1b4749821730354abfaf971566817

Download Submit