e53819b392cbb790bef10d3fd746b6f857eeb352bd787858b53393f7333e5933

Analysis

max time kernel
100s
max time network
135s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

terms-of-service.html
Size

7KB
MD5

3008377d0ca53f31494ba8b1f8229577
SHA1

c74d85a90674d469a92e022a4270525c0c6a19b2
SHA256

d40d211d1aee8e0ec64aeb1edff12334bdf0d6d74596972d089a929e0f96e35b
SHA512

aea5b8ebb1a98dfc5a5eb582a2e916512a1cff16251435316abeca0fee5a13daea8f028027404e6ffd424458d8436a5907be3aee48e9fc154908c6aabc3584b0
SSDEEP

96:VjGYEVxx50CoLh5tqN98X8hB+VwssPgJAXomX4uRuVK5UV3Bm8jrItM:VaYM0CoLhXqN98X499/ReKM3BPXGM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECA31051-0B9B-11EE-865C-F221FC82CB7E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d5365c5d8a6991458658a5067eb012900000000002000000000010660000000100002000000066fa468879b05686d40e76d60ef1ba3ce93c4cb33c768b4cf47cc1ba1307e176000000000e8000000002000020000000130004ea1465b681f2ebd6a68dd3081b3fceaad08b167fd4f6534f4ddb485bee90000000d7e366c101974bae38ec69e6e3f78f5c38cb5a5ef96fdf7a6678ad04e4a873f1b4f8d3efcdbecb9444d75d57e864e37c46dd6b35a02639a1b12d2c1306fd314470f152e7adb5d2fd0976902226ca6db139788bd314566802e9e22fee195b751e76af1a89c93235dee7af1bc7223184e9b08cda07db32fa04a3e38dcddbcfb403e0011c15028bcef8e63795322594b672400000006cee724b53cd364a513941a3b234a67f36aa57759ec506a1c6b80a5222d7c9776e894f312d7e03a6c71164272f01fc4be6b28aaf13d9f2addaa26b4e70d89ea3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d5365c5d8a6991458658a5067eb01290000000000200000000001066000000010000200000009e79e3b4d847bf0163bbb035d2afa9640256564cc9954f0e675627af618ae5a7000000000e8000000002000020000000e14664ed260183ad66ec1aa0861306ccf7d4d0a2f5fc8ad91b0d668acf8685af200000003abf18cf86460358d7a5a0801829ce619f7ec719a9f20fe0c3cd01127cb4467e400000000c721255f3320e90ed609c047897b01818da0d42360f4012d5a4ff0852c7f1f572c8b595f84150b1231c6f98ef386fa1cfb2a05d7a5549bc473be9f3724cb589	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393612457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c092c0c3a89fd901	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 568	1368	iexplore.exe	29
PID 1368 wrote to memory of 568	1368	iexplore.exe	29
PID 1368 wrote to memory of 568	1368	iexplore.exe	29
PID 1368 wrote to memory of 568	1368	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\terms-of-service.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0747edb7620305e33cda24d418eba9c

SHA1
617abd09b49d70f799d2999664c1d4e6557289c5

SHA256
79b7d69007d799181b92d2ec2129f56d8c73f2b0552369864835972585a7278d

SHA512
fdfa7eda1ab6c509544becf76c33f056502e85e8e28b42c12440b0d64f22c18cc64c48e50f21cc17c4588af182ab3d7ce116deebd76149e9f5b968f905c22a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
048561679882d4a27f61841d3ac2d50f

SHA1
13983fa4a1937c60f349263b8dad979eb4b9347d

SHA256
c36a0335972e19e7ed9b1892ead2c4dd3c3a967116b76887c2dac258cfc3a7ad

SHA512
6e8ac244b08a355f6840f14a725aaf1f1e38a0af903fe6dfe60f06be9b4978f12869cfcce50e64f874fd627e7b38e767a6d231ac6ae7f0e908b0169bbee139cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae191c2dbc2cd67ce820ceae88728ea3

SHA1
ac2cf96ea8dabdbbaffcca9662a6848e928d61c6

SHA256
58f66828a86503a330c0090ef54ba6c7c13e7b5757548241fa01388bffd17fcb

SHA512
4c35dd3ce1e18d4105b47b2532eb53860a8c2457c89551fceace258d2d7647b2cd3b67412361990d38fb92704849ffdc4ea215620af07a67ec74a4036bb983f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7927a8528f968226bd0341f9df95f3c6

SHA1
7a1720d99d50be10e685a2ee7b9a3113420bc4a1

SHA256
6920bbfa14e48dbdc0b8f2b65b22e48d39f5a26a06e639b25c0d2e766f549103

SHA512
9e79ef4b49e2cab9f2e0395cd69ecfcb8352338e63a5fc68c95a8dca3af461862c6da0199b06b915816a6337015d3eb98f79f19681397741c056946feb64dedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734a7d92a13b8f91fdaf4b2f9a7da77d

SHA1
a6351ef92d8c634b276398266928f356bfc80743

SHA256
846f2dd7adc5d14b262096e12529beaf04c17457270184979e868c3a2530363e

SHA512
988207bc552a73ea465293ba1ddc5e02bbc18daa02ad8e8f63fbe8a64f10b6821da24f81a73623691bd8187c34dd74d1b5f1893690e389a2d448ccc51c54804f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d9b7e0a79cffe100d50614bca4dab8

SHA1
04077ba464670c0eaab0405ae52e6e8a70d4d251

SHA256
4d0114cb9cd9600eeb3ebd880fa4c6177839a06cc5e7e6f6dab6ff28c918742c

SHA512
3f5da4f01ae74382b99ccff9621e1c53a82f9d55268eed2795c81ade14c032f81aff320701dcbd10c9b1ec5556f0ff5cb327e8e1acae64bea46724e29bfb02e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88371947e3586a66a5d3c320c8e976a4

SHA1
5a19072d86a305cccdb203c493f23addeb501178

SHA256
a263fe594379c37eba357dccb61db595a971e99fc8b4e5aaabdbc30b298e28d5

SHA512
36d7290029cbcfdb596ce398fb6fa9e18a23071064479235c38f50ced18796d962f986b81aadf601397ec1589419ca02fa0de9bf8409716d6937f7cd43a78f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b63a0ba18d4987f66da96a138f6cbcf6

SHA1
3fefeb828427395c9077e0f2dfbb74ad2f810f77

SHA256
44f1b65291d98d6258562f8c4328978293daaced17d96dffeff284eb49d287b1

SHA512
86a3837db75d1d88b0137d4bb4907cc799866ab0fb63e89090d65df114b8fc5c47f64baf0ee6ee6de139c1c85faec16ede508304c91644aac0ad3f99801dc6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a19b41ad6269b1b385f1e712a40c4b

SHA1
bf75e62985d1129e46e28a2f112dad4d5283d4e4

SHA256
0f41cdde2e699f82e9c1a787ed91cb66a845fc3caf002d26dbaac91e92f38ab9

SHA512
2acabb09afee6030a91fe42771d5d957f2ed342eb2205bd861107b0a19d8e72b747b86a098cfb258551a2dd7d879428341895856e15e0a5f0ca7fe3803a30248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4202.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab431E.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar442D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\60ART889.txt

Filesize
606B

MD5
9175252730f3a0bc30449585d3a2fa87

SHA1
191af1ce26a964406df023ed80794163197e95d5

SHA256
1b16a601b06440fcef57f790412cb5c55ec90d1b24a4d3422c4ae393777364ab

SHA512
be009352e1b8f74d08ba9c1c91e62efe6e07d0a4c5a301e5f75c2f429388ec4dd9555d6d132cbd9f61f9e0e1953048be615d0262208dadeefa6f762e2782bef8

Download Submit