0067bf7f8b5857c2d73939b1e2944cd7bc987dde658870628def95262fabf643

Analysis

max time kernel
143s
max time network
132s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

download/fonts/eot/IRANSansWeb(FaNum.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d4000000000200000000001066000000010000200000002565b0cde7a0dcf4471c70989da99559254c22fbef103af53ebc3a46893fb23b000000000e8000000002000020000000bda6caebe77688b2297f2b354ca1ac844a194ba4d1506b23ceb6f349d54c7e96900000001aec2ad60225eb752c8a9fc0b37ad612754c1c10bfc1ef061d8589f461f9edc76fecac3b5b36cdcaf9f7fd57925164e789b3b035f335425373fe947e3bedcbf3985eb766b14bda1f7cb6190ce715b95155117a41cff69c7f53fc05d3c69dfb7b9bc6b88d8a4ff3682f89fb69f10b307e859af8e162740d99f1e596eebc2f79e6d0e2a98645ccb0b754bf5e17d0d0eb5740000000cb59ae56a8b7d9d01ef8b6dccfdb8c8f784541d3b155f241edc0ca58befa0780cdf6fba55fcfe9c05fff2b6b5c9965f9088b0dcd72e705ac84f384936c86c9cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395209159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d400000000020000000000106600000001000020000000a2707fad3ac12b7792bb7dbf4a9b156332950c161648a6e0c6ae30813ed3ce4c000000000e8000000002000020000000a4a23a22ac72356bdd7c1c3e781836313de4450efe2be6025c7dc1e49794d09020000000eec1fa57be8f85887ceed28e17d772d5f707662c69ae8d96ee054266555bb91540000000ccc56dd454571d714468940a3210b26a3d5e77df6a50d89c2e14d3292c86e58f4188a7da9be86d1a862a313aa8ad0129126ce27986830fbb803e67ba6de34e34	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89CE84C1-1A21-11EE-908C-6EF46A3BE504} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bbcd5e2eaed901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1444	2084	iexplore.exe	28
PID 2084 wrote to memory of 1444	2084	iexplore.exe	28
PID 2084 wrote to memory of 1444	2084	iexplore.exe	28
PID 2084 wrote to memory of 1444	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download\fonts\eot\IRANSansWeb(FaNum.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f159d732fcf847498ac07cd7e996bc72

SHA1
86f1bed0b6ec8a3b3b9bc58d0c9a8ab09140f66b

SHA256
a7288df53a3eab2a36a25ab3738ad68b5cf2c289b70d4292e5509bf6f0b34475

SHA512
632507093018bd940a209e58957755fb9a60082a4bc036e51496863c09af2a9cc1925ccf7b631d1c208ee817c9a8bcdef2ac7c728c73649d793bf612dd3f7184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba1e9f9b57833adb22e61d174a25bd19

SHA1
c6bce107d016151008a4e7a2251110239d303c7d

SHA256
f01c0cbfb0ef48bd0173d2ede337fb4cbf9e92dd15cc8b09181aaecfb0cd760a

SHA512
8eefd3821344d218cdfaccc8b3f970e08e712451975298eb42e0c720bc92523f0c132d69b676aedd3535552d44db22fb2087137251bd3ceec65511b0c0e8cfa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fdd0e678fdeb59a5295dcd305a07112

SHA1
67e7619999c27b577349ae1f0e099de66b733733

SHA256
fb9bf72241b9399128895b14b7ad5c60d96c3e77acb5d94f269675bd26a55c2e

SHA512
c39bd2c355084adfeef6d237611f46830ceae7204e9fea1d5f93a9b786cd41acf1c3c6eecf9e50313dfd5a4ec4818160645e5f5dc9209694bd56fab93e107acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf60ccc193f47bd83a3c45f1a0c8d9c3

SHA1
f4606d696d9d213e15c66954bc5adf76069daa87

SHA256
7315c8d93fbf3ff0cf26acbc0fabfe27b7d60aad0a3c652763321483f3f06b88

SHA512
5d874804633d8cef82233d53b50b00d6c780eb33843ec731ebf18847d95fa364f5e4541d3cace6c80e598c1f9fbd8208cf99723759ddc9c31361c62b19ecb415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbbb82caebb4459a11e4620f44bf535

SHA1
bd0ebf1b11b6daf0f34c4107ea8cd392924fbc7a

SHA256
85ca5822d62ed82291f214ec7af0c733442dd31b1c35bd355d9cdab600d88053

SHA512
75151570f5b421a9bba178fd96ba615e0a7f715376fd16e6816121f67ddd39b1bb48385c8ee9e62feabec4ae13d1b8ed9654ba5208f669cde3c36432c624c3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea90d564caa053ba97bbd76eb882d527

SHA1
50d17e849fa06cb4925d5699f42d6fc8ae024dbe

SHA256
c1796d47173b9280fe10622d47ece31481643a8f466b314ca8cf5e14a1a0ff9d

SHA512
3e518b2fbccde09ccd932676b0a3949b61707c419128b2083a2693df6b25aaffa508a82d96f1f73bf91140c57871c8387f5a0416a4b1960198e9ac9eddbb6ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ec68a66289329ba085cee18b35c4aca

SHA1
b09f78aa3671270da4645dcff5a01d2e5406bed8

SHA256
9d15f86035b58745a57ffc862c7fe342f648990a89f63c7c08df5e3c76ddd405

SHA512
4fcb4cb3118e49691494190c242ac8ce7f330f55eb3efcaf393372ac2dd34ab53f6cad3cd7c3d5f0ef1352501253882391480fcc72b6fd95bca198b7d8abb238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f15d97d88dc2ed29edbe35622bf45848

SHA1
2b7308c4980333e8c29a1e49dd13194a4a876d02

SHA256
b033aa32ee71b3b0380f14fd456db6114e0972e74c1924f04284494622686679

SHA512
8f1ae9bc6df6cc38a344a0f44a12eca80b66d51aed3621799851c41a852ae6569bbf2f1905283883d3f372d95a283597beca8bc7f1fb24130efd4ee56d2b4c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93ee96399178ac5a40795d1b61ed3181

SHA1
e0cfec454c9025e2df2b9eadf9f558ca7dde20de

SHA256
ae489aee908bdd1d471c717eca3b84f946a8f55a4d16d32eca1cd264eee683e1

SHA512
d69c6eb16a37dcc163fe3fc53791067dfa9931e0df7aff3dbeaa8ea922e779d1f071bac43ab8d45a23b0419813c9512a4b709925e6bf08d9739996f1a148baee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A3E.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ADD.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UN0RPA1B.txt

Filesize
601B

MD5
eeaa78265d0a92db7f75e176d11dc55d

SHA1
c163dcec813a862c36d84433379f4eae12154228

SHA256
8f403dec156e91ee5f1d1fa3c448e7dede61c12e613be4efdd2c7e72a48793be

SHA512
34abf408fd22affaa19c0bbbf203f556a47b3373f68764ffbeb23c63d00e4267d51d14410e62e950f15ed6dc7930b959b204f0c6fdd0baca7675ba0cf8add832

Download Submit