d3f984c264fe320731d92c53d314159c28fe813fcb9b5ea803c959e9ce4d46f4

Analysis

max time kernel
152s
max time network
145s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vpaid_html_template.html
Size

16KB
MD5

e276e92e96646fdac5a1988074f33954
SHA1

1a7aa338deba5f148ea18666ec1ec4fbf5ea148e
SHA256

4b8fd03cf268f9cd2f7432e13e8a7862760f7a6ed10bbf96dcc8232d2d382b42
SHA512

8425f53afde718047c310fc74a8d3924ce47f61f33fbb99d52147364244b9252b87ce1ebaac80db9d27151d0969537737c042e0f615e354bf2edaac6b13ce065
SSDEEP

192:mrLYJFkVvGFQshArPtP842+Lw1wOEeR6kad8bWXSrJEBOn8TsjNC4ck8aanlDTt2:8U42Fn9qW4+EQNuSXIlodoG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393110935"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009bb36f10bc2a545b41b66a76397da5f00000000020000000000106600000001000020000000284b7192335011de1551a49c5f1abc9e560e5d39ac7643c7b6c83e099aebdd79000000000e8000000002000020000000a466cf0fb3375946b784a9e160de9855ac81ca5ee224addc8a17b8ec1318080b9000000065ba396966fee34d73e0a67683e6d8a229c2d9935a76657269e957c0b0fcecabf7a55a2765ce798b35a2f7f89ec76f77e0f6afbfb6b61228d8e089dfc23669634a55c97ab8bc3452e51b1004a5898895aa30793f82fd89f2c12ffc88f72c67a9318451df4eeed166c0d673faa90e1dae9efd8c968aa8e9ed4d6d1ce6535ba5c7407bad3fbc70b1820e2849ea28d246074000000067448dfb7085f6b6077c6a465781f9338205468174d5bf53bf72ca497e2c6a23b848eb8a193e311cc21038f973b2e39e310aad7540faa318df87ea930d6cf243	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A0126A1-070C-11EE-9CB8-C227D5A71BE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009bb36f10bc2a545b41b66a76397da5f000000000200000000001066000000010000200000003854104db63fb9444e2821f6b2891e73b0c15aa1421ec07d9aaa313e21e1c0fd000000000e8000000002000020000000ece43ebd002438d86aa19f553707eea8562a81e6b589d9d9c047eec0e0d157ee20000000190eb313cbb76e929ef5522851b6d516fe64e31d0926d83fcb2dd5501ee7400440000000a0fa7930417567f740a7eadc41d1327196e5df635d00032e2505648ccc681fe22ebe7c04cf355c53ae8bde31c4dc3616be67fcae24ea6cbabf3e8ab31c720135	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b7a413199bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1720 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1720 iexplore.exe
1720 iexplore.exe
760 IEXPLORE.EXE
760 IEXPLORE.EXE
760 IEXPLORE.EXE
760 IEXPLORE.EXE

pid	process
1720	iexplore.exe

pid	process
1720	iexplore.exe
1720	iexplore.exe
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE
760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1720 wrote to memory of 760	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 760	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 760	1720	iexplore.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 760	1720	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\vpaid_html_template.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b05874674559711f678966e85f0d048e

SHA1
3db058412116d19ec014e67be266768115bb9d6a

SHA256
8fd86d6e6955e9db5da4c557bc359e7a2e4e49a4faf803f42ed68f9d88414301

SHA512
c662aad4883a7d9d7d0990856e73d74353d55792ca12fcedba374b203ae7538667e12a47aa14604d0ad5b6890cc57bc96f23941e4c55bfc470d56973958b4713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c6042ca53044375f00928efaf29f4755

SHA1
385424eace50faa385768b712989d867ee25cb19

SHA256
6ce03dd9211a4058b11aa0d2f5ed657d413b95886174ee0d4ce25479f05a029d

SHA512
3d5de3c2e22cba35da23e70627cdae414e03b86bbc3b3cc5b6873a03628fcbcfe7027e24004c95b212919b15385dceeba41ed2321bdbbb982db15b68f064e454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ba8cfd4dbe3b7e8379d75b69dd388dd5

SHA1
44b37ad947cd3921809db1038d0929a99dabaa8d

SHA256
970d66a5f82c6fd398db8b98b28164f3e8e4d9a05fac0fcd41d42b2d626bea77

SHA512
2c27d8b5d0b9436b010404e81ffd3464e9621a89a1a266cfdfb782aaebac2a4300ed125077045eb7cd84e54009a47a23de2493cc8a4e7d12fc467e07316615e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b35d875e300938e3d2baa9637e90d047

SHA1
972b6a8621b9ff0c83ff6fe943fb1e7602fb1cdf

SHA256
4aacb2ae53a8540a5b37dd40486e50fbc2c6ada461b776e5024e7c3013bbbd7d

SHA512
969102b8dc9f5c504d00808666540cc678e2fc29e798542f6b8b72a898466bcea606d2be1f59e5d8f4061705add79682c3a1275f896c0e7d9c5d33a17d8f6ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
569bc26a406f016c7b3a854cda38e6c4

SHA1
59c0a463fbf7c9074e2efb16bf3b00ba8bf4344b

SHA256
8881eb061ef9cc7eaa5802b384078fe1bbb543795792f6b2d6ccee77e74f9a3b

SHA512
4cdc363e800d21a538229bd487fb2cb0a1b7b6cc9287a8c4192683ea9761e34803868a892f7ea31249c718ba35c410c87620bdbf34602b78f186c969e4e31df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
faffc2ad442fa2645a419846fdfeab60

SHA1
7669cc0f5830599de8327010456eecc227947645

SHA256
5ecd2952863f6f5da45dfba93c077409a0675287838339bbe8216e69ba7d4360

SHA512
12f7ea8ba197af00e3564b7f7d760ae5ce36d4e2d4e7e63b1d9ebefbc165a673ca434cabc3be9614843956c6f81d2bfc6501978e7af9fcd7f12643600afc5d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5aa795e3b96aa6568aeb3aa931ac6a24

SHA1
86b5f18e8a4f8010fec51087c59b45605aba8237

SHA256
403cc3157d4306114a8ec03ebc61069678d92ecde36623e62f77dabe06e6082b

SHA512
a8bb5f57803c89615eab0e1acac0459a954093a3a105da95d29441bfa78c6a6a1d828327237a905d3c23021c3aa6076cbe7c4682d6c5810b79a33aba2c8d3349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cfc4a683feb53cc64f74a93afa9b3c40

SHA1
328285d671f7a32e9afb6fb61d5f14f5285c80f2

SHA256
b7cbd0198e36283e9938c8cefb0cb05176f304669b872e3df6a4cfd41fbf230f

SHA512
50cfb8a7aa04aa010131df0c84754d4a93763c41fe36dbeecf73245eefdedb3cbe8b05a8bcaf9f2db71146e8f77c950a9ed362abb4ea5ddbd449f6753fdb8f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7572.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77F9.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8JKKTFA7.txt
Filesize
601B

MD5
710e625fce7566cd4534a0e9e28cea8e

SHA1
2b597ca760a86a57fe604d9964c4d9423413311f

SHA256
f6fdb86a4c0b3c6fae6ffc169e5e87edcf13acf56fbdb35b06b1bafbd4d77c10

SHA512
0348e8865f23539c67a6d19b44b2edd97311e1cb9dfb4816e347271daa7598704856704fbaf6b4f2bbee7da3ac577561ec3e357dad44c56ad0ea7796b45741db

Download Submit