ddf40dcb0cd1970b8ecd461755f219f1ec95ea1367be2b83b5b5417ceb088284

Analysis

max time kernel
100s
max time network
137s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

popup.html
Size

1KB
MD5

dd9db4d97b778020c371a9560b4e67dd
SHA1

a2fb2626e21717201561d7c58d2e033b46d6afb9
SHA256

57e5d383eba3085e71d2ec73583244f6971620069a1ab7b22413c4eca484fa7d
SHA512

11b93e6fc600d0d1659d03f3ce5f2cd51f367c050ccbf19860594658bbb2b14dfa3eea2c4b16074d8a81b347c70d99a9cb54649f9859b225eba705e62779b65a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a4800000000020000000000106600000001000020000000df45a3a33ae21d69f7ea9442e56f576bf3417ce61096f56b327cc54964680e22000000000e8000000002000020000000fbc165f13e35df553a0d834764193928348d6484f2fd72c68d4679076e826de1900000007f70dccca3409523566a930e6dc9062ad4ec664f215bcb397ba80e2492dd863700ae78b219b2373125b828705dedd182a895daed6954aaded38d1a8bae30dcca3b3ba948c26774a3bd6175955bfba78a070543246d6aeff1363ade74b09ae15048518d5176cccf3b38bcbb3f8e3f41a6606b40669cddb4ee2ed5a78a3d979b675cf8f511699674a267d2d499e08ff0f84000000099567c55d6e1ccfa3c726ea1f3f0761bf7bc80c103ea41be1f6f679cb5786a71de68c556bc7b89cc15ed2534b0eac21e03ab4c40b390f91d61947aa8022eb5ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e036c84e14abd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{740FB361-1707-11EE-9B20-EEB670E095ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a48000000000200000000001066000000010000200000005aa1f5be457aba8992f8ee3282e044fc9deded41d9d27f315e6d5821e3d42eab000000000e80000000020000200000004fd8ee0c405836f4e6fec36719ae55d4580ab93927909798a64532206883b796200000004869bf2381491143891ad9ea7e44601353b6edb580e1f7a6c499fa0811add6bb400000006f83f4ba0ea42b946651f158cbc4501698ee6b527a30fadbb1cc0a5505c5d0b3b928882ebf0884f7919a40d7953d944731fe85442cad218a9fb92e8cdbda0b0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394868103"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1340	832	iexplore.exe	28
PID 832 wrote to memory of 1340	832	iexplore.exe	28
PID 832 wrote to memory of 1340	832	iexplore.exe	28
PID 832 wrote to memory of 1340	832	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\popup.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04df466f8bf09a7febf33dde7de31f58

SHA1
742eb320f153695916a45889d7fa4a2e3c6ce7f1

SHA256
24af1b6cec8288a51f2b8dfd2dcaedc409e2a9e0c204afdf366cefe0b1e246e0

SHA512
da7a3bd04ee945e2dbf7faae402185fa1202c3d513f98ac45fcc5c516ed76a42dc3df24b736168b933a7c4a43c9642e3d848245925ff2da827e3b095917d1f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e5afcff16cdb1d8725594fdd7b4d20

SHA1
f38b68b05148621a44068d82d88bc6e2868ae0f8

SHA256
f6a8782ebb1b21a167f025eb303bb6dcd551824c616b6c3da1ccbe1f84d66e2b

SHA512
e0e005db4f726a527bec35c0fae74ce6552d2c7408aaa23db1ea57e3ba03c5b7f2d97c9d5bb62350b282e0f29733b0efda959e3eaf6eca1547c1aa169f832d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63aa782b295e06843628cc10f7fcc211

SHA1
c58a61ea89e1eff95723b275e27e3712f9b5220b

SHA256
f1f5e0c5e2243d73f16887c286b9a2dd3a945738ca776f9ab6ec0a27e91887bd

SHA512
4817b331baab54073da552db915596d77602db808d262efa3347f90a94ecea7104fb43178c2c253cf563854395591db2cfaa0aa1dd6bf5a6e08a3313e5b34a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e482a17ceba9a9d76826fb7b6af7d5

SHA1
a33b77d0ba58fa82a19a96b9b948ceb79e0775ce

SHA256
3f5e7089064c0d640414923f942e49520a8b32628d56f653d8c688676f527805

SHA512
e899b27de1c1d7c3e5493ab61aec093ce53f40ecccb83f351a5c522ecc7c631768cb78a1050b3dec7169a248f56cf7360f950c378d61a7a56cf6ab876d464e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9161ff3f49c5b090e07110d832ad57

SHA1
587c8bdce6a0a98256cf623d466c33f182741084

SHA256
71d63d6f974173a2a2ae3e848163a268692675a4b5a6d2d63c1a289cb101b395

SHA512
bf7799aff6bcc7a90e7250a11582d6a6e5894e15fb3a30fd4ff00e9bf97b17c37f6bd9ad059b2e95845a4c577640a1e5587525e13c0fbc7bcb3a9db76a71b079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
426bf2ffaa3e952c64f6c1bb6b825b0d

SHA1
ba6933c2822dda6242c1d21fd554a2fcdbc62ac2

SHA256
b621d132726696748c3a16ce4dbf6dbad7207c1d640f2e397045f74d1f3fbffa

SHA512
2a1d43fa51c167fd834a3931175d036355ba98ef618d7e074e797695309d86254487ce84c4249b5825f7138de03604f385fea11b20f24b0ffca54e394e21611e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
295ff4fbfd51e581eb7bc434b8714265

SHA1
05d93c4502783a48bb60f7e50cea2c6fac452fa5

SHA256
00ed762b6fbd46bd7a0b8f52e514bc2b7798242a44eaa4654df7667bafbbe870

SHA512
e1ca47b8ae92a6953b097976862c3a2395e23a1b9e12ac2c02802023072ead7896784f7a7afa0cbe76fe0f9fc75e376d65d83d76877ecab3c87e1d4024607d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83a1968fabd3a6db4b648ca116053d8

SHA1
d23bedd60dbaf579d02e231c6ac3003245cc6eb2

SHA256
1e01ece84985c310c6647a369926275643439973b01fcd390d323783392a668c

SHA512
bf6f7bedb3c57229f42b81bc3ee066f304650973189fb7a9bc483a22e446f67794bc4fe021f2c5697ea579f11211b0053a30a742f0addf82161bcabc723eda89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f503c41ae6850647a93cc9a231124b37

SHA1
27566e6ddd76b81fee204ff4080feb24850c3c48

SHA256
cee0d79eedf35ca52907809d78b124899f1129010d4158b6da91c8bf137396f7

SHA512
9fbc6fd90a09160975de63ea1e0507254d3a39dc722b9bb0cb222d878972510a0c84cdad727afc5306ab56de3e50596b7464cd660515bd4ca94d291908c8188a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3bd7ef97aac46b6c8b024a39226643c

SHA1
0db33cb902f80cf0c36c85ba6aefef3b52722bf4

SHA256
9142f680617c058cb1780d2db1e65e996014f33fd7bc87d2b6e95645afed6bae

SHA512
d3d1bd57744675fd2f836580454df58adfdf4ac2e941dd6944345d5f253a102f8286fbee86ab8f933cceca2f196350ddd1ad72c98d54969f10db69b3d8f7ad31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63F4.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63F5.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NH69O8QU.txt

Filesize
608B

MD5
0e3c50db023105b888840c96f74f6da5

SHA1
649879cb33a80f336474dd6650d77f2bf47ad5ad

SHA256
a3d005f5f95bb589e2c671a7b47a9717ea0c6900ded8d2bc50179626b6066873

SHA512
6ab9a217194eabdf5d6c2f95c6f6a19d9e89816edda1473e5ec8f5102a449c90fde83954afcaeca7163791ec8829ea68062449ae58bd5fc6b6ad1f01cf8bc083

Download Submit