e17d9994ef0198bb034d1e88ae2d8690c7386e7b408e5149c0bcbd7b2d79e773

Analysis

max time kernel
100s
max time network
136s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ZQ2d3dEWvlA1pXG.html
Size

19KB
MD5

0a4c680ecc57f7e81800e11b1dadf019
SHA1

9bf006c6c8279e608fdc68da04ec99a8e441423c
SHA256

e17d9994ef0198bb034d1e88ae2d8690c7386e7b408e5149c0bcbd7b2d79e773
SHA512

bc12e2b8947b0ccf739ae63f47c8b7a0683f6ba4884bf9f7c41c08eb4692099774a625293d842b670fc155f0fe1422fc63772384442ae5ce8c8c63c4db0c63e3
SSDEEP

384:OmKYhYkmr2W6E45wse5QjuFwgzxdaqlx+:nYkch6tOseQZgraqM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ddbc2eb40027547a7b75ae262b677ea00000000020000000000106600000001000020000000c0e512a757f3e347cf06f8519eedfc28cf7fd952928f9c966c872daa1996cabc000000000e8000000002000020000000760a2be763bd6beb8f26d47dc486b3b7ee6f0ac8cce6acdffcb9af819dfd092f900000004f4a1fd5c72ee664b1dbef9897a9c3a51a96a28b38f3b8ec5c4ed3ec9fccf9873313a8e5caa39bea67a7e82f83b273dd1003bdc45af337eb3934e5d07c54c0d0f1ef79fb541c675f97a556b46e19697dbab1bd985273f207553364189a932736347cc7e7d27a95011f168ed5b3542b3c200c6bd8b200e6412fcb172b8fac376897b48380404f17705dc6b372ae8e687040000000866f2713cd37a362225315c985cbda340ef1fd681267ec74b0a41319e2038cf3f2b851328d0aa22ab1ca3290bad0108d22af61355ac85bc467a7ae9a5b42f4dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5034a33855abd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394895990"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ddbc2eb40027547a7b75ae262b677ea000000000200000000001066000000010000200000005438f2ac7969cca9b7e272130dc3d10df7e1aaa5c5be197602bde456497d2868000000000e80000000020000200000004c68fd491bb6e2e85953fd846d02a5b07301037288cc1979affce9399d96861920000000bcc197669a15ceba99ec8f61b9a5517510811993ce4bebf5250ee36f1f47291340000000c42c25947947445898997c1ef89e3c210263d26875cf05ca333e55ccd5e6c16f7076ac1a60b9ab969b5185eebd810fe332cf43500941b8ef0881842ff7e5527f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61F563A1-1748-11EE-B997-F6780A61CDA7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1004	1680	iexplore.exe	29
PID 1680 wrote to memory of 1004	1680	iexplore.exe	29
PID 1680 wrote to memory of 1004	1680	iexplore.exe	29
PID 1680 wrote to memory of 1004	1680	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ZQ2d3dEWvlA1pXG.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3d8ac89db190a8e0bb511da4e6973d

SHA1
e521485f5d4dfa04903036bdaaab9222d7f737cc

SHA256
f0c959af272f80d009b36ca59a944687707521ecf65aff995fe30b364c9e27b1

SHA512
e5e8f00491e1ad3777db7228cbf65815137d7d7139af73c5875fcbce0b7a29bedf46fc4bed1f31f67bd5c5204be007aebf088627639bf1446206fbc8b9d04ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0b40e86f242bcce4464bd6a7241096

SHA1
f26519ccc76b0412c5ad398abbe73c6118f12a30

SHA256
c19ee975dc257f089cc3eaedeb51ce813f7b00694982d62e9bcb3e8777d6cfb1

SHA512
f97365b976938e82922f2d1d66f01b5c2f2904806314007626bb6bd579975063c3f93f4f050fb33d561bd82dbe90f2d2081cc77b708417352886f5a7f808d55b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a693d58449eb141dd96947c577b98de

SHA1
9d747ccbbf8e0f67c474003d0f3bf5b868872531

SHA256
72f434e069d0ea1fb31d46650b5ed6a6698d169661ff745d8a3b4b1443a5fe8b

SHA512
1068c52f9b17083b06268dec79d9e625b7327dd1e4b901be5f9178fac38a6b0e1d52d616740184e117716c76ac39286853dc05119790f0c3b910d0cc244694b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846e22269a2a44bcc25855172f9dc57f

SHA1
2196edbf986b4cc5f60d952cb1ddf648b7cfacd6

SHA256
e24e597d888db4c2695ec381d61da1e99d39be04bdc918cba96be1e36e2ce278

SHA512
6868fd9220e4513a54d1b20368db4d8c67605c76c4bd78506e7691b965d9e3b6773b84c7918b2772b0bdc5499e20911563b1809a63eedd3fe165a8c27ae7a7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd86bb9bbf2a02a79e201ceb180ba4cc

SHA1
58795683d6b8dd3ec782b9974a824953237bb68a

SHA256
8b2a8eaa610c36469f85978d6db40d057af0fc4146deafe14a3a4fe3a6cb1e01

SHA512
6232dbb3f6c752e05c88158b69037af0100d8d46df90d93ff309e140c790b195c9f0f2bb9349dbc84fb08bcb309e6707a63ccedfa8cce9a233eead28fcb09011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b98ea47d1b6f1b90de0d69abd66b2881

SHA1
632258c886eb5d2a29ce7f8a17b6587df98b2eb1

SHA256
132ff747ac63fce7252799528932b75ea1b1da3dbebd01acd364853830ed11be

SHA512
513d046fe5a91a463a70bd0e16e01075fbd6f713019380e9316fa0ab1b9d3bad450155b69701a2ee8b9e6cb64cf7e9ef72a5f9b33dbda306468bbaa5287ffb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b969fac6d3c86e53f3965aa1ddb1253

SHA1
ff2c199fb764a0dbcbf40e5944648b8db7d76f79

SHA256
6d817e4f5b3c421ba18a2bff08d7db75aebcdfaed46b5fd4d02c500f3df946f5

SHA512
8b9a114855db8384502a3e619fe5f0065edccb7c371f38141c18fa20ed48f699ab10fdd422b6ec2cc9e9ad5483a9fd722b023c3e4032bcbba964a7cd56acceb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5dd3962dbd2f7e19cf25faa9e4f1b0b

SHA1
fa5e61735ebb8e58bf10aa3a24d94a1076a22107

SHA256
707e30df70766650fb1635d36b29466910d9f84331174b685a5d7b3921fccd41

SHA512
2decfa646fdbbe441ee29a6b375ad829bdb283bda2d9f6d6f6c903ec6c9ae3c8efb0a7a5cece767003aab39b4db71de1412763f76cf5c10f7aedd389009b606f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a34aca1586f0c75d8309dc10537a0f65

SHA1
3422c639756b76d842ef49d386b0e5747d629243

SHA256
36dd547f77dab248cf48510694fdad7042fb5015b1a32c97fece59420c4093ec

SHA512
259352fb103b0d9a2b8b25505bcabd08049da41142f2328b7775b93399ae50b43e26f30afaea39e1ba91e5663bbff1d87b77a3ad23370d9c7ca516bde9d9755c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a71fae7d7a081db335ce6a1df0c912

SHA1
7082142cc314b5e363ffe329c54f54e562a133de

SHA256
3c9993a0b2de2b90a200b6bd6bcd8b9e437d697266c886d834889e28f8f5f4ab

SHA512
d41a7521568d17c57d44c1628292ec8e04990db49b8cf6ff039b57353f980835fc86b67d4d42ed566a0bbf39675f7e414786b1d9a39ff716c35060279f6f0ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fde1048922c9ae9b43ccbb423622f33

SHA1
27e05e61c2bb36c3bbcd77bbf98d611e21428d3b

SHA256
361ae48bcb9c966e46b4545bf46dddc380c5fb5db03fd2f4f57b99df4815c5fd

SHA512
dcaede011bbf269ba4c20c8405ba17199d3fbd13d0a07c572139446b8f8b3098f7a82e9b61f10181247723f2428fae8ad7220b1f0a8935a158b47b8238001854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a3ef6124495eace6c80be71a77318b0

SHA1
2da16c4d6ab13f0f0f885e5a589ee885a95b6663

SHA256
998e993f20096077245bd1c9175b2d875834119f58a98acd61abeb999f82b0a6

SHA512
a659f1f4e29407a08d85b18f049b383ee436ce3c2617ac4db742f5e38217364cff7ef3d788f4d89bf8fe25058cc26d2845f459f61aec61c96caae279ade5c450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IESQQ4SH\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58AE.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69C2.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DZAVS2C6.txt

Filesize
606B

MD5
abe742ef2715ba3be086749727731f17

SHA1
5c257c718c70e9ec39ca12087b018d0707cf7345

SHA256
ff40a1d2f33729235fa5cf86d0a43d880a55825d6b13b2e52aa1c40740bfa02e

SHA512
886ba28e934ddfe33be61a14bc9c220aac80eaeb4b802116c1f4c277c231c0724b108f168ddf401048b2ebee4fe0d064d25c117c689426518a5ee147affd87c2

Download Submit