d09617517bbb2c6aebec4f6ae8448c467652e6986e9c04d5e02d0a29808f06cf

Analysis

max time kernel
146s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

legal.html
Size

123B
MD5

af9f0ae5203339d6a907614460f154c0
SHA1

8df913641e9f5f0d9c688106494d32766f651454
SHA256

73ebfad8c6f565422fd1b2c9bf5434d16f0b8dc64ad283c0c857ed686ff46010
SHA512

ac8d7a17170be883f1267c4de7253cc5b355b6da77f338c5b80a860f32d394d8659fda7bd55da2f0f4fb94da2b1ee3859bc4c53755bb41c1c14cd41e0ecf0946

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42E14EB1-07AE-11EE-8F8B-F2E58DC6BB35} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aefa99dc9c000a429c530fa4d4f9113600000000020000000000106600000001000020000000c84ff477baeb9ccad969bf604f2647275b12bdfbfabaab55e2f3fdce238f5b64000000000e8000000002000020000000dd8b5dab79441105cb0ad71a4a12a50872258385eb9e829ef5ae5c7f9c705a2f20000000825f0602031ff297205e779331654a4f3a52589db5c7361095eb2656c9760f8940000000f8dc75fdab97fe4cf62792d0021b3bd764b7bb87fe1c79f0f9bcb72858d051f8565e1444b14f38a175b42a1db50988065e874ce21109b27d2db819afc1ca0cdd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aefa99dc9c000a429c530fa4d4f91136000000000200000000001066000000010000200000009f74562ed2376eebe6609d29312648d005bd2cbffa0888b4363c2f7004eb0554000000000e80000000020000200000001a35887785af7abd2f1505b576a99222496afbe464e2e78e2533fe8c32605da7900000007785ea48f495c963f93a8e3db536321c5815f07d3f57a7d06aabf7a89760580f03209ec4c368ca1dbd386ac5a786cc949f8bcc004dfdaee96f029d88b4750e4b19b9179fc81c37b6f35683cd57a784bd7d6df5df0568dd5df80db72b1b2ef44d1154752b6c0446d0f3909d23ee70a28493850d29f5efcb8fb6cdb2efe030e321372c13dfe010825e2602eff8d04632a5400000008f6a5866adf55181cf36de291e047421e5cf08f5c08ae515b4dbdc3f5d0754a8fe75d8425d583dd38b7cf702c850a51c3420d7b26e6baed97cab0919c51cc354	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393180527"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8084a019bb9bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1380 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1380 iexplore.exe
1380 iexplore.exe
668 IEXPLORE.EXE
668 IEXPLORE.EXE
668 IEXPLORE.EXE
668 IEXPLORE.EXE

pid	process
1380	iexplore.exe

pid	process
1380	iexplore.exe
1380	iexplore.exe
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1380 wrote to memory of 668	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 668	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 668	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 668	1380	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\legal.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1380 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
6cc3a3eeca4771af7f3fe7278c877341

SHA1
b93869851b8716a0df67b67eca9bbb6adde654cd

SHA256
1001168380dd2574b252bd95bca516c5f7b79c2633c2ac49f259b1fdf1eaa5a2

SHA512
a9dd078e449f1026fac3103ee4a4c925b6cafa13e31ba640cef84c740d5ee3c3632f12f426c5c986f1cbd72bd1fed0696b4906424da1b60f1588aa01256a83b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
80d44ce5ea8cd004209baffa8fba441e

SHA1
94e1929eec1abac4452324ddb919073ae81200e1

SHA256
c429c0296d111d4980cb2e57ced7c40ec96cb329031d2fa56a2bf4c07f21534c

SHA512
c6d1eb2844ba3f8bf02231ce67995683ac4e51aec4249ea36e8e97482ddfb157b3f2cbcbe7f0a187aa27d51bf71cd32c214df22694a042501cb0ef17f1a2ded4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
44803025b2964dd22924c6245b5b1a34

SHA1
a598f834341a13a0e29ef41e7ceba9eaf33309d0

SHA256
70d6f5343d4a9ebcba692ff361e57a0f66657a4aa451f16e642c4787c0fa41b9

SHA512
26a00a06b099b81704e7c125d0147534f7fd35bcf5436c9001413f21d4668fafb1d43e1f8cd2487074411966a52241f1d48667aaed2d5f52e250ec612e60b78f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
23ec3c7c39cb1136830072b930e0c8ee

SHA1
9470035b68241055526451195e697e31c34043a6

SHA256
925784d957f89072a597b444cd373b4eacaef7c81c263ce967840f5cf93f313a

SHA512
281fa82a56079037a8a2c7340ab6137a3a743349b51515b28b1f4180cc5b5d70072cf7f99c35604c7533a12b7d310ac323030fdc2d3d1e4235ee5ddc9ae72e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
71b2c8b1a9f6bf0be907f1402513ac1f

SHA1
b30f11a551e1cb21747025e9e92382a15d32cd09

SHA256
be047083cd157da1c53219a589bb5a1b451797303c9de9c3999a6d8cbcaa4d0c

SHA512
84512f6f603843a0f1286c57cd0c178bd67cdaeee23b34fdca1c5017b30d72557cb5ea86cec3a7a4264b2a302ff54ddb32388c74be0d56d2f65045f05dd95a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
ebe4827e5f9828f541a029146e755161

SHA1
303d07d779a01e5648cd9ae05137ddc862cbdcbc

SHA256
87de654f6aa46120fac203a633d187ce2f5e902256dd376298a4f01fd658f3d0

SHA512
5c0d2fd7b2a52e6c1ca5e4e0e1f5d8a5a6ee25d668d98c1594878ae37bd2326330351eccc59fe8af2f1040dd4093dc41fc6af15a26bdc0763dc2f9a70d5d7448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
4dcbc25509e3d6653c8dcf8326036de7

SHA1
82cd167dbc0c15263ea79d81a2403f0eab06e5df

SHA256
74649adf4412a66d468e7dac5af653546d664be59d8b7b6ed0001f5432c65b16

SHA512
2b06bdd98ed3fb5dd2036cbf1e96ad661ddcd6acf5879214534c7b61e99e5ea1bc26fbd2c835930e91a1e6018bad30327b700a6b076e48a757c6915480dea3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
61bc4482b888a3c2ae321873005b6ed6

SHA1
52291990595e3f028a688495bebff68e8216fc1f

SHA256
d391bb83871d020ee47e83d0a131313e637609672d385747f319e5978b66fdcb

SHA512
d1808aedf3b19eacbea58c9d8caa4eb808b59c53112c82cd2ebc0037cbfc72c64619eccf6a4ad2182e318d61ab6d7b862a8a70588e7a4de0acac5b2105e0d5f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOYUJSME\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32F4.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab347E.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3512.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CSTLH84P.txt
Filesize
601B

MD5
d00841a50b6298ac54fc20d43c532ddd

SHA1
1fb35a8d69645c5b66bd385a66c2b490a3178635

SHA256
30c1cf38f2fe644173cdaa1e1dfb75b2941c5f2411a256955b579406a269c01f

SHA512
70b43b3fab8f15df74140ed1be6fb908e4d03eb329a658161c9de34b096193e5881ae48bfba5fbd13b70c3e72969d1c9771895c809cef384e81289e9155d46e7

Download Submit