2f4a8edef25e39e339bb631b401a358d3806e44823cb2b503690e0ec24b3e06d

Analysis

max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2023 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecureMessageAtt.html
Size

12KB
MD5

19aa4a9d3e7cfb0c99970cfd0b56724b
SHA1

84ab54982a9ab85fde668f49f07a384c8d75b418
SHA256

2f4a8edef25e39e339bb631b401a358d3806e44823cb2b503690e0ec24b3e06d
SHA512

171256ef7d676f80b2246e82dee12abaa16a084742127bfdaf80522302f31341cff7ff82a33b67e50cb3dd93276c19c7e9881eb326279d8ba5de645da1321d65
SSDEEP

384:CF6Bw8Gl5KvQY3E6KVV1JYIepRGJDBGD+Y:Ckw75Y47V1Jxe41Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393605497"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b00cb81144d0d4c8983317cc71b7eed00000000020000000000106600000001000020000000f7066bc9a3e81fdeb451cf4a7e55b3dfa1878a9ab1b9e45c4c5f9fbcf0c93005000000000e80000000020000200000003d39391536ef6aed2be8f001fd33c3403b3e6191997d028abad39e3cf3b6a476200000003547750311601b301efb40fbf1153d122f5a74d2543b0b4f2b5ebe93039887fd40000000d009b2d10dc7660860521773a5466508e98fde7d7eaa794a9fad56a04e99eaf4d9a12dcd77686872aae36f43b4e4ce01b379b67267adf2dda0df8ec32396e1db	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2374833643"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B4B71AB7-0B8B-11EE-BDA1-4221DB3A75C8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31039384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d053b581989fd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2315302485"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2315302485"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b00cb81144d0d4c8983317cc71b7eed00000000020000000000106600000001000020000000863b7e6672f49910652079adb8464a293f43bcb574943417ec366aafa07996d5000000000e8000000002000020000000e8db969b5d8a32afa149e79d5370257d2683800ab3dca5b4de2ede72bfe5fffe200000008503b9a9c36d66802baf75b0e4244c0f73d44fc4294340f1990e31dacf724c6e400000000f1aeff9d9c9443a07f39528308f8b87b032a78ca7624fe1a3f0a66b26ed82524d74920d55343073f3756643fbd4c96532acfee6ef89e3b75b467a971c5c1d7a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039384"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a3d9ac989fd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4716	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4716	iexplore.exe
4716	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2184	4716	iexplore.exe	83
PID 4716 wrote to memory of 2184	4716	iexplore.exe	83
PID 4716 wrote to memory of 2184	4716	iexplore.exe	83

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SecureMessageAtt.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4716 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
82b6e24e9d7fe90d647b5b81389401b3

SHA1
51f3af35027bc77cf6912e6dd3d6cc3289c19c55

SHA256
3483fda8fbc0fa1d77780c1c46e372c3bc834a45b19d149d0dbc8c2fba26322d

SHA512
3454b31c7111bdc0cf6ec133ef1dd6755abf0b006f77341b904fbb8ad25a81b548accc510f1590c2a3955f5bf86f8b023404e1acb9d2b028bb29067848936f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
b3a15ab08b9fcde20390da6aacb52485

SHA1
89beb0af3905cf80b033152c1699236af80546d8

SHA256
c9b4f635dedf43f9c7c375c18a108b51678128e4a20f4a1f98b639f297fd2597

SHA512
906946ae72c252aa5c206a10e597d080a2aa51439d463f50afffe2f2b5d1297a33c63b77acb6e1cda18a1ac49518fd86b307d6bddf97af9189d77a87185927d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q7s3h6i\imagestore.dat

Filesize
1KB

MD5
a7d986566d347df65ca237a25d96f921

SHA1
6e42747e2c6729e00e3453b221caf2a99dc1725e

SHA256
e9cbcb497a11a959a8b789e3544d301f429e4a62e191b7821d208a4ded49a73b

SHA512
66d495dad243f664f8a54fa9ecc7ef6aef90877f5074e4d0b6aba3b3f277d3cbd649e3f6419aa79e328bf226a0a7bab9869b89fb01ba06f783a1a81bbf5dd029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\components.js[1].js

Filesize
420KB

MD5
1ec2e61d03a4c0ef91be8e321d07c5d8

SHA1
31034a0f1087c879bb12d3e16d85d341783e3249

SHA256
a73d718ded1e36a2b0330ee5c0b5806ae9da6306c406149ef0d4d7d0db1670ba

SHA512
579cd2f97b2f40480b31c67fddff882cad24d8cf26016084b7e9a86c605387281c5554e3607c567cdb19c30fead53acef1e8bc56b6df8561525110cc37d63a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\core.js[1].js

Filesize
36KB

MD5
5b3c7ac6a53b9d9bdb7a1c7b27ee036f

SHA1
e4116a2af7920957c0b26fe3b8b6212bfca3b876

SHA256
60a0e7bcf2f261816807201bb2a09522f62c399293cdf4b0b6443a42f6228c8b

SHA512
d769330b8d78ca256ccdbc9473a7e74086b6d49cb7be743c5c70d46c44f72f4b1543eff477ab3554ce49a9955db0ea638895ee87265b54c901f1c6041d990c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\favicon[1].ico

Filesize
1KB

MD5
a05a05dcd6158cc4f8701173734f484a

SHA1
feef99dc27e3db5bf07a255b8ee509cccacff245

SHA256
ca9a42575d5ad76a2915ed24034a512413392423bc5ec029b4605aee7edf5d46

SHA512
635e76cbf85bc1e9af0168a9b87d2085cbc68bedeb07116df062c2aaea0f105d37378e37d881a8aed91ea3c0dfaf700bd6cd628620c5dceea6626eb3547e902c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\favicon[1].ico

Filesize
1KB

MD5
a05a05dcd6158cc4f8701173734f484a

SHA1
feef99dc27e3db5bf07a255b8ee509cccacff245

SHA256
ca9a42575d5ad76a2915ed24034a512413392423bc5ec029b4605aee7edf5d46

SHA512
635e76cbf85bc1e9af0168a9b87d2085cbc68bedeb07116df062c2aaea0f105d37378e37d881a8aed91ea3c0dfaf700bd6cd628620c5dceea6626eb3547e902c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\jsf.js[1].js

Filesize
46KB

MD5
1ee5300441f6d2204173fde1c4aca985

SHA1
2de2565c49f7548efd6bf3f48751994a870b1200

SHA256
a1d563139c7afa362c35519099d7018c09a72c05952cae3ca5ed3c277c5554f2

SHA512
9155637fc8bac573ec106b8da46a98316822b80267d56ea5a3f6ca61ef5e3a0919729a43d404b0beb8832df329b2cbbc1b5dc587b21a0471e4cd540f82229517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\sourcesanspro-regular.ttf[1].woff

Filesize
125KB

MD5
03adbb294261977089607cdea10b520c

SHA1
4dd8b4ad179f3f9b64ec980418f2c9d354a9983d

SHA256
d79149c9559597effb066e4ed38c2c4b429c88d0420725c296d52c40363eaf68

SHA512
5c40f0b1b41b832854e786ae3b6e9fac4dac0ed82f7fe3f6b3b8cb5034224dfda5c2e6fb1b45d04f7ccef7ba0fb48fd005b9fa527e72700088f9093a952025c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\hotkey.js[1].js

Filesize
2KB

MD5
3ec16aa44d720657743fb21b8843a42a

SHA1
63585295acaccefa397927146cdf66dd4e61b2d1

SHA256
aa45349925767e946b92475663269f3388b684612caf430e23e5080c60d617df

SHA512
c2736c0f0c03033f1391aa2f8e6200fd116edb9d074f38246e8ddf7d02ca9407ad656cf6b42733dcde2e32e23fa880e4b749bcfdcbed70c063a6df8dc1f4809d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\components.css[1].css

Filesize
91KB

MD5
ca00b2bd616ffc3c6041350a592c7426

SHA1
ea082a42f3bb7a907b5a05e1e5ea5f6b967e3efe

SHA256
19846dea837aa2a28869f608db27827473e96713c9de87ed94906af0a928ddc2

SHA512
e18de16bd4f1c2cefcb9e205a5daf48cb60925961f3f6de0c4a93529b1b9aab2c49f0e6cb08f45da673152c8a333f622002dc229172c2fb804c8139caa5c21df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\jquery-plugins.js[1].js

Filesize
260KB

MD5
540804dac5a11df20e7119a35d01e2f8

SHA1
6d1ab351bc7568acb90e29c6abdf4570a907a431

SHA256
52d03b5ea1d204f7e6917075ecbb1c562f2fbe9029fe95c4bd25a70eddde2728

SHA512
f458cc926ecab96eb1c771c7fe4dc643e0f217f8aa362daeccda719b2b8cc0059192e5baeacf5969429ae1a2ca7b59b7773cd1f7a003c079ff871556dd52d9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\jquery.js[1].js

Filesize
87KB

MD5
12108007906290015100837a6a61e9f4

SHA1
1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3

SHA256
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

SHA512
93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\theme.css[1].css

Filesize
24KB

MD5
6c9193eaca3f3316140c7a96d8e2edea

SHA1
853589df20768e14568c2a37177f440ddadb95d4

SHA256
4e4a1edd64e32c55bb71e49fddaf41ee58aad04bdc1570a93a89645cb3c09895

SHA512
7bb0e6178dcf0bdb7871924a92af01ca05bd37bad50c9b7fa256115cb6ce5906d6bd1018d812ea5462ae434bdeb2c7c470238f795495e28bf9516c663951bad1

Download Submit