665e143a8079d817533291476e9df1d89849e745fba3f8d27c3f78cd8ece1dcf

Analysis

max time kernel
100s
max time network
138s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Project_Proposal 662023_662023_ref11 .html
Size

141KB
MD5

8c1643ffc0091b8f3d846c8400b7f626
SHA1

dd9ecf78083c91a94fc9b003f3609a937f54c663
SHA256

8f55f77148c5dfb41f4d832b17a247dcba261c2a26fe5180cf8ec56d041a53b9
SHA512

4db30c2ff2f6a4eeb39c2ae2c8b94b934f2a0263787f09b2b1e6b20df07562e75f6b596387c7d37c0611f931a8f68d940e40f792974de26ce2a4e97f804d43d7
SSDEEP

1536:BUiUN4nJum32DQopS3rUoXway/y0WpaQKGCghqVeU0Tqp3iiRDjA7rtn1Fecgd:+i0iVpaNg+e9Gp3iacrtn10cgd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA150E1-161E-11EE-93EB-52F8AF95ADE5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2967218a20af4e980a9f47ecd196a400000000020000000000106600000001000020000000d5e94d41801cde5cba297d6418679a9cd6a0757212bf20b058e3cba85f8f6b34000000000e80000000020000200000002b89fb0123fb1bfcfe5c6b0287386376946f0d0cd3e311158732b856b274415320000000863577798069323ad5eee7207c326160d4923c9bbb729ee335d8153976d1bdfb40000000903b62dcfe1a799a6417f3e52225d073e6cdd94f2fd8bd150cff05d97c53cc7d2bb851e8c42fda2584248b6d2b3945b387fa76ace9864c19673c16a31698b29c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01148202baad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2967218a20af4e980a9f47ecd196a400000000020000000000106600000001000020000000a40146ab29f23807dd56b5a14cd3406dc3820e4c4572bd8b183c8ce94efd619e000000000e8000000002000020000000d69d9e92da02c4c1d6ea6c45ef0d68df7eecb346257ecde17655a2b1b8eb7dfd900000004fd78c7503b195128eb4d5be7b16223d49b77a3b3890202d76bf97157d055dcc442e50918f33d499f5fe17be1c014d8a86f243d84b3f2e6e174f5294859b3980760fc6ce2d2bf31fda9711024def74326f64606b89a3b33e0a1df2d5fd0919c86c74be8277c6aca9b784bd225ecd1df120f47ad0b8f7af9a5166ec36573807392600763470e93d14645c59cc35817209400000007d2810e9d8235dbbb9e563f785ce3060eb3eb4cfed0307a74c763c4aff5a161bae46f7363072b0bdf86a2e8f52d6c717e4603c470bbd57b573c6738617d14684	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394767960"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1292	2012	iexplore.exe	29
PID 2012 wrote to memory of 1292	2012	iexplore.exe	29
PID 2012 wrote to memory of 1292	2012	iexplore.exe	29
PID 2012 wrote to memory of 1292	2012	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Project_Proposal 662023_662023_ref11 .html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10cc9b211aa9284a280edaa6599851df

SHA1
51ec5e3f903b59be2e3e7a5c784c393933ec5932

SHA256
bd95a3afc99b2b9d0ed8a1bfce6668f43698e4ce68b61b70bde5b4d286201568

SHA512
ab24407c6afadb2da0435773c2a3fb1cd3a1f953c186f28bb7a57e12ec5946458229798ba06a58e1876f8ffd6ad7f17d1ab89f26b27a85f65631b4042ab31852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9fcdeae75846fc9128752340408ba6

SHA1
45d2d4a05f066e32ba8ff3eabb02aaa905dc406c

SHA256
5547f7bc1c8e6e9f3b75fdc52383503ab1ea383c87d3b412a2c365057babdef8

SHA512
bada771d0c9ad93103c80cdea0f84e0d6a8aa41cfac6a5e9cf19a0c0fbf9461701d04f06e0aa3d9352a5da4ed9534f7d084de9111cc7d9b3170560f732a3152f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4572c957b9a9e1c8da03df5b66f565cd

SHA1
d556db27383c98253a4a5560f47effdb3bea732a

SHA256
b9eea1325fd5260900f172a19555b59bb29def65104981a29a760f216c97427f

SHA512
145a3e191b603d11d4a1511016dc236393ed4148267be57affcbf5c45f9217469c0b15042e01375fda7b535a9fc02fde4ce057e154ae8abf13be8a2a275a9880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf11770f9d2d04d81204d54b5b0ff70

SHA1
b54020ab77b98bcd3257d2fc1f6d99da05d66767

SHA256
b4191e10f6ba35433970df7f71133a3628b1a01566169591d83214d6a1487f98

SHA512
c9a203dbd22f603829a038c5eb24ea92aad9978fb9226b8135f28d2b096712f3a144326d847c74b90ced98b7a309412a50d800e519a1dbd8b5c29c2733d72bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc1f9108e548e24a6ae9bf5be66a4e4

SHA1
1ed77fc99fc7e7751b8642ce980a89ea1c0d001c

SHA256
b966572eb89f59a4e727776061fed140eb90af4c42c1a82e4ef79fe05f0853e7

SHA512
bd31baf0339303f55c6078b41b7f629777c1c394d3198dd388aa6ab3234c99de6f31b46c4f6b841d2d54b1f9ba5c927b34ed576f43489124637e318f4aff1566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82f16630e1456d1ee4152f70dee71381

SHA1
5ec00cee8ad27bd65cae0bde9a3087589552f78b

SHA256
8eb92a95e2939c2d5b5b1888bef42f8f9848107f0ffdbd613f19cdbb6700cc7c

SHA512
00062dbf8d3195b83b27d0888dacc771edbcdac1de5176da05e88e542816fb8120b1caa7e81519b8496352e180210d73382e9208525353d2904e218fe98b91c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e94a5ce09a7a6a210f6e242007dab884

SHA1
f879ebf04c15ba263fea27289e157f078758c910

SHA256
58057639470cbf51e42ac6aa7a136d91997b22b8d4e9a6742204c9891ce7c5a5

SHA512
bd23a25f0a675a0cb16db638f555239dcc008bab32795a24417d04312aa82a63220ca21c2abff5bb115f4f86b195de0506142580b77d7e8b8568d7b293d5a08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be2cc3baaf915722ebc934cd9ad697e4

SHA1
8264a47d36bb1a65e4a6f8aab017202e735d0b08

SHA256
c725d0395f52d41d2eae8fc7963937a339b125aa3e33e5d713061b819da81393

SHA512
88fb832868a0c726290aab5d6efc376ab7bcbbf1da6a2e011a1094891a0f1e2d6fcdcca541811c9069a0e5e3611db82513800c0c296655e83ca42cec006fe6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5282969fdfcc928e6b6af9bb60c1709

SHA1
60ddda66bcf0471276d4bc6939b5ec4b372ac627

SHA256
96a60c324dd9714a3258cafff1cafa366cd1ef68572aff6b24ffa9dd87924acf

SHA512
2d599901d44917306cc3ad9633eadcac01aa1736d98ae4ecb026c1b4ad5ca70569f4383d806a0e397fd816dbdd0bf8f6cc89430c3f95699c70f5fa15e2bc6c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORT469H\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4482.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46F6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\H0KQVIA6.txt

Filesize
601B

MD5
bc32d450fc7f69e369653c5c4ff1d753

SHA1
a62265fe6dc7f479bacba448f290588f85c4b244

SHA256
33e70bde779b5a753e76506eb898da2abbdde36ccbb045bdaebd5ea63b17a738

SHA512
ae19dc093dbc4a3ee7de509ba30c52af02bec178b8faac39db081fee5aed228eb3d49ea5a54f281eec29764edc0d95cb5bf85e719ef20c6ddd2ee1cd8e943bdb

Download Submit