07176693f0658bb82e3408ef1e85a545b039acf315749ce888dfce55252696cc

Analysis

max time kernel
143s
max time network
137s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Jsreceipt0193617PDFHTMLHT.html
Size

103B
MD5

c349aed7796c6cf3784b423f7a348429
SHA1

1f9f048f524a83ad569e0df65b709bc1de4f344f
SHA256

07176693f0658bb82e3408ef1e85a545b039acf315749ce888dfce55252696cc
SHA512

f505e8dfd29079f11b817204334e65a6c307e6bed8d5a04a7a95fef32bf4031040ef7830b7f039f596c904a489de2887d0903016204e1e78b9715126ccb1e455

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB0E20D1-174D-11EE-886C-EEADDA397F5C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000376c0b4d0fc806448c2c8b4fb3cdeabc00000000020000000000106600000001000020000000750d9255ec6bd1d1c0c465a99928b2a67852ad2906bff1873e774af2a2fab02c000000000e800000000200002000000037d362a95ec50d84d44038c85dbfe13d6e84d67567d5d1f35a2d939c3d0285c42000000078288c18a2a567a539ff0f3e1ff8acfe71a33799003a9a319ccae418d8868fbf40000000ab4d13a55062e774d9045dd3a406b2bbc4904a2a021a47735c1259cbf2b78caab80bfaebece826e8388c95f7a0418abddbf7127d329c4b32e998409e714c4612	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602203945aabd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000376c0b4d0fc806448c2c8b4fb3cdeabc000000000200000000001066000000010000200000003450510115665ab2d07ccd63a8ca13db3341c5c47692de8d35598c4a5d5dfd38000000000e80000000020000200000009a7777a4d78e6a7c5982604d3eebbfbfd3d5d13d5876aa55bf1fa11b59f4bf0f90000000acd882323d01b2ef6b838f1890893784d27d93980e8daae6c03d2b43453fc3e16873b0029793ae723a6fdba23d3b1b30c9c6d200602c03ce4fbbd6f7781c1cd00ebb3f1127495e5f94a9672ed6ff42bf67b404698f548a9132238cdd0846f161e3be85be3da22f615ef5906f0b01d8252e287bd806b12c3b452dfeab2686f05c17ee826e2e4430d083a16f0ff925907f40000000c55a030a24a6458ee7968f2b177d0c3ec88779969f507889f77b2fb0865f605984d9504fd09a1fd67b3b285ec798031aec79d1f8384bba94c33f87562ac0495c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394898287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4102714285-680558483-2379744688-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1624	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1624	iexplore.exe
1624	iexplore.exe
520	IEXPLORE.EXE
520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 520	1624	iexplore.exe	29
PID 1624 wrote to memory of 520	1624	iexplore.exe	29
PID 1624 wrote to memory of 520	1624	iexplore.exe	29
PID 1624 wrote to memory of 520	1624	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Jsreceipt0193617PDFHTMLHT.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b6660346936a364bb49850b15e8442

SHA1
4ce999cb785c2bb43ba4f1d82d79c574b3450836

SHA256
d2cf371c6037dd42f3b3eb61a57a79c44dd2d4590ece4f848304622dd8564efe

SHA512
dd9b462ccbfcdce5623977fc1c0a0da7ea92ab12077f8a1abde5a6a8aa1c2b838689858d75431a12eaee6696d2819bb06adb7bbec30e14cd230df6f867c2fe38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1e7e20f9f83307758e8f4a47ac9173e

SHA1
c1594bae9f90268d7177a1e90acde9e271e57223

SHA256
8102fea30bfdf1de592568a9281df0cf6b7b185e374bf057456c4a01e6b38b63

SHA512
c4c05ba1e94a454b246e7b4385441f62da00d4a5db6eb814ec2356b29ed555ee148328f63c5ed68a2b9b3031cec80b44f3c60708406fbb06f44184bc13281210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c07acc9fa39ca3beba9d9f5b35617b

SHA1
e279bd5727dab6c44fe1772bf64ae923da769b2b

SHA256
61e160f3b3c701ca4ab0338c0fcc1f924e0a4858e7f8fbc832966558f29bb42e

SHA512
4541860eda00285831794da78a488eab12eb9fba2fd6c0701389d089d215b2e9373ff05672179e3b80dea9e5dac2567b6b95ca35dfc5455e066c86e27072fb4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0adf5ed942a81e89241cb04e44c21c89

SHA1
c51773f9c233e809fa75f5d0c49377e9a15e9c85

SHA256
fca3ce196e23b408a0895000676f62087bc724df76a13218aa73eb38c4bd11fe

SHA512
90eb06332e3bfcf149664be680a2085d7a1144aca2f88b70f1c6f7fd63d647904c956c6b6a805a27d582c7f7623745160229dd28c98c5a953e467a2661dbaf2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6b7e346b5030e3ea671d1cadcf0a05

SHA1
5d7920a65ed74d6199ace8f10830164dffdf7f9c

SHA256
2cde10174dc35034f0ddaa35235ccf03513d6c4258242765c9d85e8f6fa3e42f

SHA512
92791dadc95402129e80a7d8de012c3a3e842684e8dd72c55df45f16a8cb6afed5036fcfd60e596f3a8edb093d95a8769850fca7f9711512d55474c271d724e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2a8143c2b9517c4974ad165fcf344af

SHA1
dfd181c24b0a1d670f03d351f16bc587c57b9daa

SHA256
cecfcb51e4f5cb4ada822665010085201b81a5cb801c26e8c15adb5abec5696c

SHA512
679187c225a1d4ba38dc51ad79ddb6477431a4b488000892983103919054ac738429a9697d21e96867f1dcce6ee5f70d38140cd0ae80ce5dcd471aedef492c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
713cdbbccef4ad8b9e2d75ce87be9e7e

SHA1
02bf0b34ca51eda73b837da4e707a0ca785b5881

SHA256
32f607eb632d5384e52bba5e32769adcffaf3f51ceec1a97f4265e229b856fba

SHA512
1b7634c06434b8eb049be86192d1ef2ef02540141657404e83ce257eec89298d973fe27fcb397412da8913ecf67eb47c66a9232e5b2500dc6bcfa92bf7778fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11fdcd26c4b9efda832721066bac25cc

SHA1
595630cae53a326ceb5ee55177740babb16ec7de

SHA256
392c9fcdaa802807421c4f6337fc9ddbe1ed3fe263d8436440f45fc1a8d83bd1

SHA512
9742188ce3114ed2d28b098ea83ccbade6e6e592f17b7b83f0a06f6f7275cb1d94967e7104d66ebecba5dc21be29ab38e7da0a2976267bf7b43a0fa4005d3afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2bd09f10e2e60fd393f150b1054b98

SHA1
7f3faa3444e99d83fd7773694f1cfdaafb9e035c

SHA256
2d71467957cd8f93d20880aa49f7eba0e8fe7666b679317be0d57794cc803e8b

SHA512
a9db7a14dc95a6573d1699c2a1b011181a1dc8950b25a50ddd075a53263e5b18493b71fa9dff61f5d05003cca2e1e0f4253f3a3162ff496839b2016f99bd5139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a7375c22626840b8ce03cd21ec75f9

SHA1
0bb5bc31fe3c8a67ec78c024f91620eec9a4a1aa

SHA256
da5fbe2e2903a9a055686b8f26046d1f76ca8c9475f0b0eafd9188eeb9e384f9

SHA512
890b47f71810661009022c40d9284b01508870cdd88ed512adb3fb6a4603c09a6d78f241aed7352a24587900b322decb830e3f14cb70faa133d0566c6512acab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e0bac50add028b13568b37b29322fb4

SHA1
b3e19839a4c621019fd4f680606cb4704446f1d2

SHA256
c8f60ac177a7dd964c8d843b7419df5a9f61871fea55307fa7359dc87c3eb2dc

SHA512
7ad572336765a9997a736b6c30b58afdbdf0805d6e6244788f960818a41999c959b457f7c3c5ffe9c1cf82cc6719b65e9c1151e3e7cf80fb4e675d5514e4120f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0324a3a85df81ebcba21b09645d53940

SHA1
e995eb525d357fc4c29c33b1bcfa1dd09f9164b0

SHA256
6576d26856670746782b3a22e89ea212785668b70d492a228ecf48a4b098c8cd

SHA512
13746cdce3857bd37a6b29f5737d3e1b775fa60cfdf5236f66bcb507cf1d34c1811698070accb68f9e1fb4bd39bfea290f7a1e4c7d91185abdf13d1013de3394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C7A8D1KQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38B0.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar398D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B94RIMRV.txt

Filesize
605B

MD5
6d3c1862a9bdb39decc94e65a13d212b

SHA1
52cf8c9770f8dab1e91e19eec556befbf8f20a0a

SHA256
ca24fec209a36a2f377bbf62ff880d2892e3bbe54f4e051ecb233ea2d3828188

SHA512
5f5b9991c2ec4e8de82e1d8a2efe7693986eee154e9a2799e70931b93f683603c372906156176cfebc0e754f1ae1809ceeb54b88cdb156a032fd900083f76f8c

Download Submit