0067bf7f8b5857c2d73939b1e2944cd7bc987dde658870628def95262fabf643

Analysis

max time kernel
144s
max time network
136s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

download/js/script.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A0991F1-1A21-11EE-BAEF-EA6CBFEFBD22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c290000000000200000000001066000000010000200000008edeb142d05e06d1a4292986f31c07d2621166f0fbfdea68b4b5908e40154c18000000000e8000000002000020000000e7578969e1c99339747e8e6083cda6b52ec64b2928677d783b5f4f7c692ea51690000000ad60e65906504aad9d47b58d5d6454b0aabe61709108176ce0d99f0dc986842d1a14e746502a70b4242bd50ce287943dfd710d2d0cca864dd3fe0ad6fbf8c2b54f9852df292201adf8e2ef80e3500a7af8b2e6e4ad83292a747b0c57d1cc2ee0e834098d4d3d65ae6aac3853d91398a1f4aedc2cb3d12d1082a82a20961b54fbd02293ab5320935e27f12756dc6a73714000000068c2e1ffa3b906512d6052fd995ef090b3290d4a0b7a4ff5e472dcd27568de8a24e09f86e5df093dadfef7673f53388a761d87636f2e04c654e4a940ccb6eda0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70566d5f2eaed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c29000000000020000000000106600000001000020000000ec943cb61991d3ecee8d9071f596f442ad91d5476ad55714091b530c1a63c125000000000e800000000200002000000077efd02db272d4a8d70ac8878ddd86c14cfb5a058b1761519f1171961e00c71d20000000537bd4b4da742596311bec9974ba365fdeafd0ffae97ab1a84fdd8d503500b7a40000000c03fcb6317c675a4b98c0723de86aa01b3bcebd4fb14dcf54a11c6433bc5879b58b4ee7aa081cd7e54ffed3ae73615f27173465a688b6489c7212852152fc9f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395209159"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2380	2336	iexplore.exe	29
PID 2336 wrote to memory of 2380	2336	iexplore.exe	29
PID 2336 wrote to memory of 2380	2336	iexplore.exe	29
PID 2336 wrote to memory of 2380	2336	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download\js\script.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0428f892465297dc82f3f4d1e18baa

SHA1
a4238d4812407795d35485328f7472a0f3c49745

SHA256
2daa3519173e3773f802496d5dc007aaf51844de65897e4207d7568ebbf28e0a

SHA512
68a29c834b83594eb881375cddf6b38fcbc4c7ddbe1c8116313c968bc94e7e6ea313449bb503e518b1f631419f0031a9cbc612928c54d696f4a16083bfdfdc2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc5ad77b12c25fefa1691ea8f60f9a54

SHA1
d6e6c6ad6e77998c1fad6579036197cec2398bb9

SHA256
aa31de84c13ebc9fe98440647788f56848e43fc86ac1da3b10792cd35f1ea92f

SHA512
89f80061891c993c7ff93648cbf32a809a4c07a420e2cf9ce67deb6f20d928bd5b6db9273055a15afcb5ce42071df1f84a0256ba614451e4c73de061bf9b4120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f642bc2dedacea1f028f2f5857a279ef

SHA1
2d684a7985c296a63e986f3bd98e3489d265e0a3

SHA256
a2ae8668e3c16ab9670b16f54d12bbc2427464313f355b64bc82309bebfe05b0

SHA512
9244c5209a091f5679cecf3f55b1d462228642e215291bf84cb7fb3fcb0290cdc8933364a6d4f68123cd5ff164ab894f3306ea6c99c0b6f7d608cbb87200447b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2506e6bed52e398c245f3c7ae00ab069

SHA1
c16c40a1a409a98ad369731ee4bfef2a7061e9bf

SHA256
cc4bac2a8e1ab7259dc2e782be95b125fa5cfb00a69878374987f1e70ca2b2b7

SHA512
c95888bff548bbaf63dad66bcb0d5c35632bdefb61951a6955df140acfbb1dd1e45acaa803aa82572c2b5197af72787bbf80648156ed55e97d499aaf6d177ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3fac4f9795af5459d79b75a5c3d4ec

SHA1
aa51ea93e5324a9bb300521faa5d0183ee9e43ff

SHA256
f84cc3646af4b9093547e07534462466aae0a0ccff930e6ead47277a5e034a09

SHA512
51689fcc85c57dbb892687826e5b8d6229f497e17ea15eab89951d212186e9da0b76a11bad7bf7802eccc9d2538f1e7f874813911915031dcb2c6591ddc0f28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7764d744c1100fcb71d39931c893b008

SHA1
69a6ea954e2fa2c605f62f91bc0d21b21711ae51

SHA256
2124e4bd456ea32cc3f93596c8a769cffecc0d410b10049cade4b8a56d4eb183

SHA512
05a2746022816ac97a18948fc4feaad55ec060b4e5ba09f5b1fc18cbd75281499bdb0fd9bcac617c9701e5690784fe2a9835a44e72d785b9611644befb4ef7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
624032f46935973aed1494ccf9fccd53

SHA1
03054f07349baa27a085fbe2d7d395b688e119f1

SHA256
141217bdaab9fff658e7b1848512d5f5badcc8b1b0dca96f8a72d76ed027288c

SHA512
9c4015175bc9b303474fe670e827a40b9bceaefcf145de9d605f98a1a9b8562ad8aaa3803c981179f23a3c8bb7be6afe2e8b484feaa5251011ff49a4cdf5d87a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbed39b65c9872529802944a5851bc58

SHA1
d2de646d43fddb47b29867cd33d044d31d21d11b

SHA256
9f12801931b0a7079b1346d39135c24bd39f598ab7672c4bf28ca12a58ad85b2

SHA512
16c5cc6238574778d50c5b5074d234f1f6547b3b9d90883f2b6fa0d26ef093bf51515b572e495091eb22ae8ef865ee5813780f2e9e6728bf7dce0bba4f06d5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b55a2aa27a95e9e8171ffe5acdb73c

SHA1
b54f5618f758a574fe2e0800c8d94208dbdaaa5e

SHA256
178605c0ebfff8676135e397e3b1c4c16eb90489db9c6f0e2e44a5f92d50d17b

SHA512
b3c7da4c82b4cfd80f471eb6eceaec8e2ce2d4a731cc036e8769ce70f48e2b81a73e0d31ec876880f09fe00712e7d363daabda206ec606aff2c31ee94ab9c6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S593MPCP\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3352.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3451.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TAUYJONT.txt

Filesize
603B

MD5
b9047a13d453570cf468a1c627d13344

SHA1
4a166f5771b243c8b78f57f5ec7eca796677c0ee

SHA256
26fbc904d9a46dda23efe60e952b31a887e250656b7a38bad3576289ec958046

SHA512
8bcba718ed786e9ca611c6256353d4c19974392b1a2798aa0af158447c367ece9a0ecaa9ab8d6cbe04e45a1bae95acdfa759a0c28d87bb5ec4777899f7ffe70a

Download Submit