45ea1d597b5d6e63897371216df1ff04ff37bbf7b686d6108c798fa5df5ba853

Analysis

max time kernel
103s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WebRilev.html
Size

1KB
MD5

f0a2d5139e1052f6b4db82e6bfd82944
SHA1

0b29e2480d5f43da42ad7f7db3a7974e59b31861
SHA256

45ea1d597b5d6e63897371216df1ff04ff37bbf7b686d6108c798fa5df5ba853
SHA512

9dc590d7060915cf0aaaa58d0b787a48cabaf2656628faa92efd6271864dcdb7bc11666384e2ae055ae5b1457b5c45821bdbd08ad4665105e2aeb13bb2010f7d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09c536fda9ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffd5c5ad8d6e69449577656708dc4480000000000200000000001066000000010000200000008b5875d2909345aee8a0ddb69026cf0daae51b16e9b4b906ebd87d5bfbf28728000000000e8000000002000020000000330cb3f9248ba21133e63fb485cac6c0bb6be11fb94fc41a2010c3e6564ac03820000000aee29d56b215ee95094994fd93d43edd0a1468c2a2484eba4350688e73d454ac400000001c03ac54aee5e468336383f26fd7109f2f7493589685f6dec1e110857a25e5857ffd39bb7b74ad281d1ee415f8ca0f41684bb4a863949b4f953a97428205d47a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffd5c5ad8d6e69449577656708dc4480000000000200000000001066000000010000200000005cc1fdb86c694eb09c1f5e70149b2463fb1d19cba924ec070c8e436a8a1861f0000000000e80000000020000200000002a91f8ef6ffec173255199675496934cffb32b9387aa7e1a9eaf02f49c38ea74900000005ec3ec2bd48cd2cfd0c6bd8cb92d2ace1f0a3194490655210e840fc4aeff97ddb01520b586e39c47e33319b8bac3854ad894483809e09a7c43dcd3db2f24435798f10b81884101a6325f9847fea93beb8353b853d63f73c6b8a4f5b9a6b4d0c569c28df18a2693646ced9827fbb4a8459440a560060aabe05c71c17ae0ff593294d8312fa711625255a3604feff5eeb940000000a99c6d0ce7b53e3586f066dad08f3afc7bbdf9c3177e614e599abccbd70c7d40eab1a7af05a4a6be6806d6ee37c49c2d16f1532eac5a7774c9ec5dfd6dfab8b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9087DAE1-0ACD-11EE-9310-DA251FB5CF93} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393523830"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1364	iexplore.exe
1364	iexplore.exe
784	IEXPLORE.EXE
784	IEXPLORE.EXE
784	IEXPLORE.EXE
784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 784	1364	iexplore.exe	28
PID 1364 wrote to memory of 784	1364	iexplore.exe	28
PID 1364 wrote to memory of 784	1364	iexplore.exe	28
PID 1364 wrote to memory of 784	1364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WebRilev.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf39fbb468cf4912736c55c0beb23785

SHA1
2e13f4c3e2dd005a0764712d0a2f3cf7310bcd61

SHA256
9116335027496057d0f629ade044f367cfb406e8f42bbc36bdd03c75afa8cf49

SHA512
55b5d21b6477263cf5b68d310d6d93354bd6229b2487435cc923c23ea26fbc8883fab41e6987df724e46b77a7a6ca967b51ce83ea423bbd09c3601cd7f1ecfa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa1ff2c8c7377a5bc8c8cc463a971a09

SHA1
790c2effd62759bd905df5123b1ee4e1b38d8ae3

SHA256
490b532da26379cffa0dd99b7f2dcbd13f8380c7b0785686623cf9ccb3614475

SHA512
10928f49a4fb03db217047fd0f10bdc5fb26aae029523391e822bdd90f23d143ef3c27026d31dae1fdb9b9feb9cb61d0403196f7f19b7e4dcfb85e3fa1d1217d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
714a703cdab366a01a44390f7f5967a1

SHA1
a96ec5e6545222230ea1faac5684dc5745328583

SHA256
85ca19f6313f13544316b7ddc344546d4aded5307a4615477c771aaa43e2f313

SHA512
edb6472504d14e6d18b5c25f157d243bd6796e24a86dc6c6acf139d6cc26e57f31e5bbf5d5a09e8e09185cfdc51f7a8051dabe1cd672c7a968cdb0bafc77c69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a2dbf731b7c7b0fa5ff70d38759a0e

SHA1
d90ab0c57c9df3e0a507ca46fbb73ebbaeabf398

SHA256
66d3f107e6ab13eb72a6dbb0339a8627b8111eb1c80dc1b57dee9d585140c7ab

SHA512
1115cede678cceb8eb28eda5a66d28779643cf8ec2a5926b0cac4054c38e4f582a6f893356e5470f6eb49708e59516bb7cb43bb326a666ffa46aa7ec92e5e0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ea54a80c9c7cbd95d0db69a18d43ea

SHA1
25de840fe1096b05f408fbcaa534309baa8bc649

SHA256
bc002ab27f472dcf297b364bb9aedaf21eebe5708a0bb14046dbb87f1d67281d

SHA512
1cf1ff530c4dffdc4cf00ea8290c1ff78b27c19980d69b0571f890a082054354d94ce4941e504f2a1a5ad5ba4e6f13898883346260fb8724d249e51018af7933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88c078ea1dfec34522cd0e4c6ffe571f

SHA1
e1166c274d250e7df53e577ea3b90c7251b92216

SHA256
c681c0e8cc53508b0475afbd323d4d77f655a53f7a3b03f412f37f618db3486f

SHA512
3d42b87f753714a801197852d25c254ee69b4d5060081e51cff95ba5e442e62ffaf05449e66881450488a39af7efb7c480bc251f6805e40114626a5d36ce5e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
903b1239088ece66556bdc5409b1bb7a

SHA1
e4e7d60da52244d486b95782d0330cae10d9727d

SHA256
d5b52d8ef4dcdb29dec5295fd422a0bf77aebcdf45c585e15753dfd12104f5c0

SHA512
d0b85a5c47852f69e557e2bb18cd4bc63eb8f954ffd1b8b185ead88d8d98e124debccdd4e5acbc741624469e9e16b8ac413012b5abc1d66306bb5c8700f73808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f0d2d2240c0f544786cad33613fbc4

SHA1
30a04b47750653c40daa2ad2ed154ee999ce340b

SHA256
2e42d2e91d2e72612565880d164f70ad1d36104e9afb68d593101680baa1a256

SHA512
2feb58b9ed69a677f61d7e3d31904168b3d01a062f4dae30f6feeeb94027ddba70b3dfaba5d19d1bbf937a0736c394045458a9b82a99e35d6dee91ca2e8913dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36d852df8a894ed1b2c69d94d5b4963

SHA1
d1f3a580b3a4596fa9e2d3e1ef4d166bc5ef0d21

SHA256
7dac2dd828c4b79ba8ce5d68689ae2ae8877f205b5dcbf98a70f0e801fd4194a

SHA512
3b80935373828fb9c78fb1cdb44c1290211ff3604b72cf46333a83888f3a4a5fe07f8d2128cd55c44088865e71677c7240fab142e9434c40d90d75b00b3ffa47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EV74ZOZO\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4B1.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB804.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6FCDR0JK.txt

Filesize
607B

MD5
2e2e053fe4813f78f3f4649adbdef5df

SHA1
e8aa4c7704a9ddea995b8251776582df3359b6ad

SHA256
1a953a7c03a415a6cf4a9b47f4c0f6824393882ad6af6e9dda067c5b328fd008

SHA512
7eb372ff8989c6c2cf01edd2997e2d83f9c5980dbecbf8b39f3268614675a62eab34dfd564f9d52b55664c88e88d88c56f909588c51f2ef3a553ad4c6360d082

Download Submit