925e5a4981779086c61bb0964c9c8be7633d7d4499716dbe2f02978c7c2b4f3c

Analysis

max time kernel
97s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dee.html
Size

2KB
MD5

4c5e27b2d6471347c93de4832ad5b260
SHA1

e1e1b50e671d65226510e2c060913746b1c8e587
SHA256

925e5a4981779086c61bb0964c9c8be7633d7d4499716dbe2f02978c7c2b4f3c
SHA512

a524833f6bce50fb395a2c7ba0a484357ef4af73d00bcebc59e74a01968f34a03057744795a1bdcb9bda99f88d3a5986ab95caff9a6750ebf9c4a2d381fb5324

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fab0a7e1b1508a45b985e75daf83f0560000000002000000000010660000000100002000000082fafbb994906cc6e1cb23de0e9070125e172b89f98810a4050992da1bd8a6dc000000000e8000000002000020000000639815a5c6c5452d9734c16ffd2bedda5ecd82b10aacf21352487e7e0ff10973200000000ece01b6c2fd4da6a793f57135281b9d418c59bd4e16b03b48424ffe65b86c754000000058d3f4d042d7e47e07aec86276668bb5845ecfae1c036ee863e81538ca2eb8077ead7cd4704c27e37b0dce568d00f680ac69cd5d11c425afeea77144e5114ca1	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806e76159a9cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fab0a7e1b1508a45b985e75daf83f056000000000200000000001066000000010000200000000e95e7914ba513bcd6dbf7ebc0e95003c67a4543105340f83cd179e48b544c0c000000000e800000000200002000000004bf5db30b134a33ac020f95d176eead2af50c8ba3395b2f8deaab16ae7be271900000002fbcfd7de0aa14d1b7ae262f0ff097d6aa4c008ff622cd2388765128b121db54f01a56f78cb4159521d7b60f3ba432dcad536f2e06c6b6514f3ba23ac58157f7034d86672cc1046ef642e79d1bb5b9a2effce28e470566f7b1deb9881a0104830bce328426cd524f0b315db6c7df89bbf6eaa243516512b99067a4286575b86da6fc5c14435e1db179a4f15e42ca561a400000008787eba1cf534c10e2b0ccbaf2523cb9a48c87c6786665fc9d99211feb52db6c7bd00d7bdae21ee4bd1f2247139282bb95da4d83114e36fe3392012e1cae858d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EE79781-088D-11EE-8698-F221FC82CB7E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393276298"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 428	2024	iexplore.exe	29
PID 2024 wrote to memory of 428	2024	iexplore.exe	29
PID 2024 wrote to memory of 428	2024	iexplore.exe	29
PID 2024 wrote to memory of 428	2024	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dee.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aff9714257a525ac4ed85be1bae3b542

SHA1
c947c622d3027fe814f17df050246b111f1ca035

SHA256
2d2627b185ef9566b501bb07734a6af01e3b822c916616c76f097e19cca7634e

SHA512
260b290744f0a58824651182ea2261ddf6adeb676f06ca779aa3488614e26fcdc0b325539885a7057759fdcd6cc2c554366afc6abdb8b4dba8b62dd3b4269afb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc4cf33ee3f9cf9e95ba6573c57c5869

SHA1
49da00adf4e008413c061d80ab38480522080e7b

SHA256
76507a14277d5bcfc663d5517ebdc5fd5ed76a4eca78ab99e2bb0126b24d5c45

SHA512
1b7081b7e46ae3cd2dc8d84f90f3972fe5785af5902850d4cc1abfcd67bc3347b3f9da8b7da74fb59637613ef0207ada3c9abb081caada90f0279ddbcf105254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
044ace81c6c6a8b4e848c8804259cdf7

SHA1
44dbd85c45af01f7901043f388cecc796442d5af

SHA256
614530093a4e3408a66d7d0a8d819471954e082a6b59ead9938ca143e8c89acc

SHA512
2e3f94765ccfe437ce0e161bd9a2349c73e7b1f8618dca8d2c407eebf7b71ac432635118ebdd9cab8e0b5e12fc5da3e23959c4753bc8ce3a23479916be55eba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5fd761f36845ae3beb27e24b28acdd6

SHA1
e1a0a839f85f90cf213b5c4607081e641a2e8620

SHA256
8bb4104ee85299050726127832b07be5b67a7d55046233b67b994b816e1a32be

SHA512
5b789e6c1a98deecfe4194dc7a51a78a6ca197383d960df178211ca43899abea7c9be13d706a9a6430026dcde0658da8540a13dc4f324568caaa10ab87c712c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8832e0ff001d206c8d7cf8ed448c6dd8

SHA1
ece7df94870381b4dbcd10e2d5527795f009f871

SHA256
f1bef3d6d9a5b03091d9b1636c8f1030a5052ceb137ec737ecfcfd0faf1dee58

SHA512
0f24cda52282460046ef341e0ddf745c739632afa8fbcd1edf5b8a4d858b6b2715003b8a97b5fa8e00416d7b889fe51ada5e87bb6910e5e4d74d6456d35a2764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e3c65c81287db9899e88c0663ef355c

SHA1
db89b23e72012b78669359048d2a42af43590c3b

SHA256
e5b6ec971fbaaa07bb9b5a43743362fb023f634637c8219966035e331fe8c44a

SHA512
043627a3b4a34278399a7ac74b4285b9fa3359ee302a11a172d2b7fbad51c0662c8e23d2b1b2ebd5876f83c1b22107b4bc30a4bffd3a5362a24446bf86a7a11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6039efc353e9f3a7ec41dd08cfff8ce

SHA1
8404103e8b1af11b8a6aaae4cbbb89f3e038a6f3

SHA256
45f113383f9c0d0eca51083f1babc4bb8cffca3b15731a0e8214c81a437b8f69

SHA512
2717aa5df151ef5d6ad52e3762c756e03181bc48bbb18669de086c8722acac188684d44aba46c7269fc126f4494706830e29aa62aeb498975931756dbb2b91a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f85dc1d0ccab21a44051591c1adb9092

SHA1
dc0763490a5964cf9e2fea0bef5e1b1665638f56

SHA256
ff48db5f29df922b90c5e19bd837719bddc3c072bb7e1e910d38f7298d732d18

SHA512
edf21ff876844be92f41b716ce96b1a0e7c4cd2e06bae90d2cc3865a13fcc388d25ff7a8a64d595df31c5fa46a767960afc207ec9fa00ae95ce9d03d943b94e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
67a0cd3f288b7da40bd713222a8ccf51

SHA1
85bc3699cec44b79bf1ec3a47694645d8cce1b6f

SHA256
121948519cb275e164b53a431b87ca29d05d2b7523b3d8f07001483e11719c16

SHA512
79f9ecd8445bcb0e7b0b39f3060e0a003b79429a8798b452024b4e19440de993718221a5b286bec2cdf01a9b830825feacbe30580fcff94331c1649854007410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3872.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3984.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S280TCK7.txt

Filesize
603B

MD5
acf64f08151713cad5a4f1d9e277a403

SHA1
b1ca3fb510831025b5d30c60f8e8b938fc5ca736

SHA256
8dcddc26f8609d03c038c8b61a35c0b8189aa8840fe348699944eadf64b729eb

SHA512
592fe445f7e681aefd33e895da6808d0fcb44aa8ad798d1e5a59cf555b5e03db3040a82e5673c915f435860c72ce7c3d8b1df69652c17ca2682be40e739fae40

Download Submit