c84e0fab3a373b9609c6df20efd3b35c21dd7e6bb5eba81695f753ac43935d25

Analysis

max time kernel
97s
max time network
142s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

external.html
Size

257B
MD5

4cf691d23d5476231c020b610b20127d
SHA1

8cb3f37e61864e17ec2c1fde132eb88e65dd2048
SHA256

c84e0fab3a373b9609c6df20efd3b35c21dd7e6bb5eba81695f753ac43935d25
SHA512

e5d22c5391185c8d3dda2a248b9450554eccc240aff0f6f6cd9f34ac768e6fe45e05caf70c36d06357342b83a10cbc756ffeb87bdf310937788efc5dce5ba633

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAF9F8B1-15F1-11EE-983F-62B3ED22FDEE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007d43243bbdc854aae23aa742990f40b00000000020000000000106600000001000020000000b3994fd431f1792edd5ca87ef73e4f0b0d2662f41f978a4c7c6aae5a0f3db4bf000000000e800000000200002000000069533ce821ae7d038f92788f333d5be3f8df27d38bad426d9351343d478ed1122000000057a30c08fc626870c19f8bc1651c142ad3fa632ae0f74cced15000884aef1929400000006b6e6625569c199e838db00638253b36c79fcae9603d5df50b4de6e4c16e78234d331959feea8b6866a77685d216fca10f2c67526bc0da23d2a66d3c2b187b03	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902ef293fea9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007d43243bbdc854aae23aa742990f40b00000000020000000000106600000001000020000000098e39f72a1359b58da752383cb0953f9cd29768e647ec33d3b5464eabd195d9000000000e8000000002000020000000172e6cc73c56dd1feca53471438ee259dc2584121da120637455b1e91e082a7c9000000065f236b1aba1c42ba88cb6c147681e715e124c15489c1d21cbb2cb1fc99592f6054cf6ee1ea4ede42c3eced3413399c73b56b4ae46aa81dfec07d7fa374b7e6eb41c041f29a872a939879ab9676f5addfb1080df6cf029b19ecc69e785db8a95051783bf8ed8c2b1e268f8ac84f58e0a2f40e522db22a3060ad39667f67010a8a5ca38a457a1dbd94064e16fd9addc0740000000dbb7211f1aeb57b7dd2b428426b1ed017143b9d96b15630725abf8ea3a7b96b6bda269bc0cc1aebd513c44d973d53bfd4e8e57bf3c51dd8e1cb77942c5343bfd	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394748821"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 856	1716	iexplore.exe	28
PID 1716 wrote to memory of 856	1716	iexplore.exe	28
PID 1716 wrote to memory of 856	1716	iexplore.exe	28
PID 1716 wrote to memory of 856	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\external.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173240c8241c2301d9662ddfae9e54ab

SHA1
3426510b7d98660b75508f6af8427690be2fb13f

SHA256
8d21fc66a0893e7916c2121539b4e5352292b7dce19cb66e7a8f918c0db6bd0e

SHA512
42c97cb62989b3b1b11138f0c225f3818fe9c07825c4aed6eb4be71e5f72cce2acf8de32a6b7d518eca7056754df84f4fdffe8ac882cfa5d22a7eddc462f8664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e0ae3026b6593f50d13ff0bf58bb02

SHA1
9bc99e3fdbad1b47bbc75346fa7e84751a18f4d5

SHA256
932f1f3826a9c3267aff0cc72c37645617ce0055e5f4ea4682d31cadb7452a74

SHA512
0f28b55209a94f35c38af5f45f14984cd7965b1cafe66ac61648088bd66ed8854d71917575d96f427440fc82a0ac2ebeb3e77952419f02504537e67e8ffec636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50b117fe863c858d2495f78709cfc6fe

SHA1
ae1a3e81b973e2f62c90c497af8c0b8a866236bd

SHA256
a99263e656c45b924dfe562a98477f0e0bec7f7f92720bc57b4a48b47fd1e2af

SHA512
28454c55f7d2373a35478a5e63313d6c55a4177cf032f2d7f3ba1e45f6ec53517c1c86cdac169043e8d424b009f97d6f49f1ec300b4db78eace2ecfaefff8c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0175b57bde86a1dcbfdabde2cf964e32

SHA1
c93e967b2b8ee20512b00acc1d0561bef2bc3377

SHA256
a4e39031770be60ccd8f648d0a96c73835d1c70dc0d47eaaf54b700c02d80f63

SHA512
6b9c5e1cd8603be59a434b6269b86ef8904783b6595c45fd2ce5a083ffc6716663d2aadea4c51dcb77c07b45ff65789b4201d89fceef38ebfc7fd5838f26b153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f28d2a1161c45d2b2f9a33f2ef9d4d1

SHA1
1301d14783cac882916fefeaec414a1afe9fdc7f

SHA256
bbd2ae1170d8a8b0c1d448726b330567688e34393de56eca5e82a3dbdd591ca3

SHA512
5564b9ad06729b9405fe6b5d1186c477aa4bfa598f8f63c5f33bddd3a0d61d13dd29c2134b4e860c5d76590145cd190e072075123f875cade455036cd15d08fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dffe9975aa77e574a117ce30384c6588

SHA1
2e933d008da898bab21211c7e63cfa86c2513e5d

SHA256
d7e39d7d613cbc0f687045a78ab00d850dae873093edc5cc44e1d9d4cf64ed8d

SHA512
7dde2d7ba14bc20ef0367d8e9882f9c816a48233006873f9480e5cdabced351ce3023eac605dbc955716c68ced82e4f822267f29291f5784ef065bbee23bd63c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ecf0ece1d55761d47d5c4968d87430b

SHA1
2c85050cec77a07dd6caa9aa495793edd01e403e

SHA256
c28c7c98214a2747521cb4cb89b4217bffe9c09e10404137fcd7aa737a3b81e9

SHA512
4aedce63686027d65299da57825a55c4a28ee71b5509f85d3aa1be73cdad43fa3aaf10c685a8d81fa9a3fb2ba13b50a654a68d5be0bd9ace386da926cf117614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a635d183a670c1a41d2327a13ee752

SHA1
7c14409d0803ee62c9e0b83b4081f3d8b958ca9b

SHA256
a832b5569faea473ebf1e40d72d53ac8245b5b17d0de063303fea94b067e52ca

SHA512
5b74c3204b82550985e5fbcd2477842b6ea8ddccbc3952372ffb3ea03f8af4cd2799072434e28ed755e04e18a04ebb7746deac495edbb69599c8ee65581c7f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c686e18312d7bbdf2a8eb11a9c159528

SHA1
2b1c22b7e624c258fdb42c9c09b4906bae4d802c

SHA256
158632b7bc60f51f64f34bb5000522e15be3c09b05b1908be31000d4477b63ae

SHA512
98b3dd6d32f6bb4d3a3f6c65a669dc98a9fa34cb36b4b10e4ed67ef93a444830cd1136e5b2fe1d1cf65157d2240e0df265a64c1c065fa02fa46b2ef978b77b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7DZDVCQ4\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab568C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57B8.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ECJ2W6Z6.txt

Filesize
607B

MD5
19d78ae3a2ad39870685b58e89e92b23

SHA1
98ae6cae6852e4e04e2a1d76d9c6708e5c49e3f6

SHA256
5043b14f2328d5cb6ce5bcf0681f9b198822f27edb83e7edf79c1daaab2396c0

SHA512
eed93936f77f81d03aa4cd32c030a803ac971c376106c99e078a062c2e834a19032b09c1a1844e5c00a1d86ef209ff8b9f3c081b118b33edbc199f55e7d9b147

Download Submit