d1e2fe87c0de11fa03935710419017826db42d559e74bd5785a319c752c703fd

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

�ļ��м��.html
Size

306B
MD5

431210b67930191cb0475297338efb4b
SHA1

81b0ece4320fd8cd8f80820a18e7a31794d70774
SHA256

d1e2fe87c0de11fa03935710419017826db42d559e74bd5785a319c752c703fd
SHA512

398eb7b4a6d436ad42738ca7e6812a5160947fc11d634f4d258f606c4fe792329914765d4458c6ed55d35f5924eb3663dfab0eb8f97c275f6ec6ff1d658e1bdd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C9FC2C1-0A19-11EE-836A-C29BF59226D8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80879473269ed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010b14fa9b15f6c43a6a59c24171734a60000000002000000000010660000000100002000000085d1970009cbe1c4d82f06569c7a19cc272dbd0a7106127ab61608294458a22a000000000e80000000020000200000000fd06ddb1e6f77b58c65196d0d04193797498439fe670d5fba6cc6a0fec710c890000000ff6309fea029d0b89660fa4de2534ecff1667221ac5a1e068e5c2b3bb7dc39b45b7d0f7bfcb0244547b90aef652c073acd70ca75f3817b619355012e1dbf1140ec663cef8c1c0d6dc7349ce9fd796483b5cf43a628f4d9bb297acf54c06e154944e468e1192c1c5428c08d98417a3aa623c995feb232ef0f4257d957fc627825783b1c188051b027ce4981136a9c85a340000000991c5c2e9aebd42c86b6064f30e5bd635902dd5e6e7c29635448b30e2fb925e91bd8a1ec26e81aeb82639ec83acc2161d6d37974f001c97e28aaa9b1bfdc6272	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010b14fa9b15f6c43a6a59c24171734a600000000020000000000106600000001000020000000146dbfbcae8c92d78d543b904ae76d39d7355a896c5306753f0df70cf86ebd48000000000e8000000002000020000000d47c39db2581ec578825a88a0a3a138fdbdee78f64d99e646cb6f0c77851839d2000000025b8fdd59c8a5542d3f5bf719e9ea142531932515197aea592aec7f1746bb6d440000000968cc8008b8d06be559a841589994a316be43a90737d619164c1ba3a68579b39b0055e6450d26b4074142d806aa41fc413f15401182000c37d130e729459502c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393446537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1760	1948	iexplore.exe	29
PID 1948 wrote to memory of 1760	1948	iexplore.exe	29
PID 1948 wrote to memory of 1760	1948	iexplore.exe	29
PID 1948 wrote to memory of 1760	1948	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\�ļ��м��.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c108dabb66db2b8b967c3ce8266285bc

SHA1
8032473a2064cda3116cb44dddd8f1a550fc2f72

SHA256
852cdc2169fb307c32fa9eb79b5bae4dae880b86e76f1bd3dd640b6567180449

SHA512
16ce4daa3701da05ae68284cc9adbc4bd34c0d9c6024257f686d3eb8b2719c8ba112f739e84ce7aa149c1c0984b2765aceb4d8d7db5ed1739d80acd6ba9d33af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b292ce4e1b29360d3114167dde59ae

SHA1
9cafd8a1593bf1ad4851b5465efce1decc03c5f2

SHA256
8282cb05a1ad938c6a1285d7e983fab8fd68b4604df109a0d79baa4688cf20f8

SHA512
8c612e57839320fbe3988e8028239bddc5b45744ae13f1cc154df4a61a53b6d93955ee2af47ada48181cc450a564640724812b0b744fca377e0abb848b97a5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a787448e7697ac5907016006ad74408

SHA1
1a11c0c5063c1ddbaaaad34ed33a74e9031fdd0b

SHA256
fd8dabfa91cf1f37d573f8c23fe2c8b2bf34a3f2c437fe462260d71c09c099ac

SHA512
2704ed350d5f393545f4eccd46284f4804e53167643796c4ef723366c9c519158cc9f35d0a7eb49ed0c6c3ef45c43708cf0717302dcbe1b7d155aecf25264d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10c5a4cf020e3a63e0329aa1ff6fc476

SHA1
9fe0b4f8cae297f154fdf78ea5e66ad73665b68e

SHA256
7f2af1c9daba315f4e2bbbfe8dda3547cc8a7ed5d003ca0acb118625b514a773

SHA512
66ebbc9fd4369e26fb3d3c87e101de596505c686294f44302687b81881b4461f6d5eff618b34b432bcabfb95218a1c7516ed1d058d3f9e0e88ec576d096efa6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36dea42463e37c9bf6b1cef0b17c236c

SHA1
cec969f0bc8ac39fd7f5c89e0b03edd34649d586

SHA256
2025f7e8a335a726486e71d76997d828d010b4d5b208b8d99c68b286b2258417

SHA512
b47e3847bb066140e05c1fa7edb147a66947cbf5e617cc7f42b7f18075a8d8b5210e35f296af14b6a23bcc99034ebd2a5f05dd3198c3d6c2279cd205f4cf5feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
834c4e4d1709301f748f7517dcccfdc8

SHA1
571cc22756597837653c578e38e1ac081ce3d229

SHA256
37e40a7cde5db718dbc00ca4255fb66bab6ef28465bdd0115d5ed25318511bd1

SHA512
6d4334ef51d59a62e485fcffc02f14e7193ff28b036f557628a7029f54d7b24e4b81e924c91b74c51d8d88845a1a1422104974fab98afe9afdeb27040d95dfe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d11e796f43e0bbae68e5d684e29341

SHA1
a86983c2203199e2df00b90cbe1b53fdcae90aa7

SHA256
238eb9264c3a59b45f7215fbcc260add8c5a8e6086e2581ddb85011175d244e2

SHA512
180b31eb5b6f10136fb33be191cb0f42798666514917aef12d83299f18a1e27f17900eec7b73300d64b020fae3c3563c29405d512d5ef9698fd388922db86359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee153eea07e28060609a78d1bb604e1

SHA1
8ae07f55274d7da6b97653fe6cbaeac88e8de011

SHA256
c9393782d787f9bc2f68ea1121d7ceb0e6d490194eee410b4d8ead7720149b50

SHA512
3d1b255a1132b41d67df1353be280324d6a9d87a5647c53be22ef971489aa4d175d622daf58963800d649a990c202d7141a5b5cef221405b4dbbeb4ee30e629d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab250f79530bb6c138a41638adf3ceee

SHA1
cb83a7a8af449f73c3c069bc41a9f3d5b7f7a0b3

SHA256
eff5db95b4c02a6f5de37c1f8c5899b8c09fe09c49e6f9e02f2ad564d153fa5a

SHA512
2ff34e3e971b839510a14250c5a653efc83ff38d2909aa6d406eb5459a17353448a9e15c27bc68e30f356a8f92aa7b46ef79596ace1fe7f535d5cd5043d9b0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce175a9800eb51054fa279b492f3a26

SHA1
24ae819d3687f6373322c218247074c411f22548

SHA256
0e901311cb3aacd98718b3ba0f6a7b5d60fbbbc6f8a353e9e15f0c8a566c379c

SHA512
bdc42b37d69fba9c0348206c0c4d51e43d6400152edce86dd3b8d879881cf7b3d21659ee477cac08f9a8c5170bde95e68418e20178a126f4c29371df953cef82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52F3.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54A1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2L6VHR31.txt

Filesize
607B

MD5
26ddf2154fdb5fd51d7f9e5cdb3b48c1

SHA1
0884c3163132685494486be94183919581afd556

SHA256
f4cf2d9468ea0638020e52a944639228aa4fbf68b571466b0f17f60458d3f9e2

SHA512
61859ed93f7aac83f691814cc4b47bccd4787f91346432488b70b7f9b5f1463dd3b68450837f985a3f3cec10dfb296319133b29f5804d81936770858b373d5eb

Download Submit