de8542f3fcc654186a5428bb333ba46947b6eb37ba149546382e19609c670fbc

Resubmissions

05/07/2023, 09:09

230705-k4h5dsch8w 7

Analysis

max time kernel
144s
max time network
134s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test1.html
Size

314B
MD5

54061017a555259127101e7ee3d05cee
SHA1

71a337f65f85b7f18d1b45b506ae9d37b30fefd4
SHA256

4aea4fb039368cf36833aa9968146ebc07361c246d230cc45dd6f69107475c60
SHA512

4029191e7fd37377487afb5274f14c3dc11510cf5e5cddb4a4afc6cc819c39f5f95f57c5b82c351993a6f3310224453551f8b99835af70fa667d4e91b47a4497

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9b4fd3e4f8f414fae099af533ea5f40000000000200000000001066000000010000200000006089b736030c8ea0891cc8b2e1bca3d4c7256f4cd8cfda377ab2ae533d284820000000000e800000000200002000000068751b28644499b5acad49f1ec2831a5625e438be809c5477409c50295e3ff7120000000649b1ba04130cf36a3881f03af43a36d902035a96c79c33faaf0ab6e1442ccd840000000b3b541745b237e36591365052e0804642e869739dd1696789dfe9786dc80ce17dce493ef1f5edb739d7ec28dae64cbc9bb0141c8623653823657843e3350e40b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80591a8920afd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9b4fd3e4f8f414fae099af533ea5f40000000000200000000001066000000010000200000003adc4725963aaa5ba65cf7afc72942f662f4a273860a2bec1a99a6b883a9e954000000000e8000000002000020000000c610820efd4528bae1b3488a2f7de7eaa17cba98cad4dff219eaa05b19728d7990000000a9b2660505733f61d55ddd62de8cc0d631a87f387256451781acd8d958bb44bc5101a6a724166d52583143ac67a61e1827da324320d40e3cecbea4e9b73afc4d9aa22756c1506f1c8d0916862babd7a443f85a33c77cf5a16c449fa3764275094d14a6f91a33f3f1c5818826e825f6f313f09868526a9213e459e8483063e5c9553f1903c5e1ce0d1c6324b91a95fff540000000fed767fee4f069745003dc5ad556c484bb6d6db88a9dec84cfba4d510034dfc6ede856a9fd43543279142cbc0d6740f0cef87e42fa0c5bd69ce3ce4e9b5e40d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395313167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B36085C1-1B13-11EE-92E4-72C39AAF56E6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2272	1712	iexplore.exe	28
PID 1712 wrote to memory of 2272	1712	iexplore.exe	28
PID 1712 wrote to memory of 2272	1712	iexplore.exe	28
PID 1712 wrote to memory of 2272	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\test1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe6ece22e1bc95d11ff23fb88878c87

SHA1
d0d7a6e9fa977cc37ea4604350f74b586284b1f8

SHA256
ba1fad71ca31ce7c4ad00ed490a5f9475f48986864fcc23d4bb91bb333c983b4

SHA512
204d9f35c63a4cd8b9243a001c26ea35626f918088ada5c36a759352394a3cf472c9119e8b87dce231d2e9214522e90b82fbf1adf8aabb1578b494949a728fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d695d055a73240506145846d204b4f

SHA1
2f148096b8c17160a62a112c72e5d0a25c15dae1

SHA256
414e1de3ad56fe53a5fb9af596a90182f6b1deb36bbe2f783270789f172b338b

SHA512
9ca1a1902f1c57784b19525fbad3b84b4cd2fa9ccbb9fc9326764efce635cc8e6b21d53f5b2635b4493544ad94abc2f12286b0ddacdfdb43d249607e641537c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeeff14311c5142fc5223410f09a062a

SHA1
6ad13e0b792240fd55758668f9bb3798ab6d19cf

SHA256
18b6b9d1e56d933e51c35f0051d1be5c5ae42d277d8eb7dfe8e391023b469363

SHA512
e73d6e4222d15caa00f3d502184c780347c758d240a671d2a001de5d62301866a004337e87e3bd86a2f47897cb8788eae2eb20e04e77b341736edf59fce055a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faaa6e5da35bef164c2fa21cb31af843

SHA1
9adcd9f5bd81003f68314c7c7b50d33bd3f68fb6

SHA256
a4376d25dcc52157015f023a69cef76c5e623db273fbe845c2f8c29961f4155c

SHA512
ab9c8c3381e35d9bc537a4602abe49766563e38da16a479a0030f4cb379455be01a17a387e973b8f0d69281e4a6167427229d5a54dac35c9b112ec3249e61fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853e97e2e0a8b795a46ab5d79e6fe74a

SHA1
f171cc4608e3c98c6b1234b382d5d9735cc24e67

SHA256
a42314f440c181628eb2d5f102562bb34de9adf8a9dc632798271d27b80e0273

SHA512
22aa1f519fa5e986e7d7ae1a25ad20bbdb8832be04e807de0ab5d48688fd6d60cc0c983ae4a48b1441616a65522fda356a3e3c017d2be70587f94cd5707939fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6710b59201ba6f973c7fd869f99c291e

SHA1
80372863179b6507cea84fb63883d828de791882

SHA256
c2fbc87a4974361d78d4621e2f16fdc285c8896337a1cdb2b2982bfc491a700c

SHA512
e7f6818a3e463010ddb3a0ff892efd7038feb0ecfbbf0394eb57c10b5260f10cb5339dc2e14f951773435ecde06ca532090323603f149bd1910b861ca1e1f22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e992955b6d5a3381d762d1d10800ba

SHA1
28d429515645f3a7a64df308eb4fe988903a38be

SHA256
d8971371a1ac4e94eeb41236f1171a31e5e00506430be5b6d93cec2044dfc0a6

SHA512
a280b41e5f5049e20fe27e0b58d415e1baa8d2d01cfd8ad3b57eb1afde824ef8aad9423c1ff9bca03b608ff0103bb6aac4cc13de3e94565787ef4c20628ead5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40daaed618d4b0b1a1f03510d0afe041

SHA1
bfa249251e25a2bb36bf22e27969f74d94b6abbb

SHA256
fc95018825ac80ec12aa1680beed16bb5e5262fc53b09ef6e57a1989fd79bd6f

SHA512
f07e1e6692541400364c3cfd107c71add9d25d66501216748b37b1cd1700320d51957e380754b95ca246fb8016fdc7bfb0479b4c3c0bdb00ecef3ec2fed60d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a409b7b163d51cc4dacae0b0cf89ab8a

SHA1
5f5977c9b79802efc9e0d974f0b4b0623f85e80a

SHA256
44303a621110dcaa2902f8e66e8bb0be5dfc3fb75e041a70d45e6707d0dddb44

SHA512
aa11a38fff9369884e0ca3b8ab252158e7ef8cf69d164888beeef21ad3246627f7b20967cac6a7d78874451aacda280becf6e6ab6b81203721fbfa6b68e8f9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a1f64fb3b327bd6972f6cd41f411ba

SHA1
b3132eaf49e6d5f9ef13fa3cc45ea746ba6b3291

SHA256
86798f838281642476123f97d5c007ab957ff0020ce34fa651226e3c74ba9d67

SHA512
4aedfd56672c7e1799fdf9752775f8786120fe499787e48c650cef07075351b3e7ae873631688a7dee972020bb561c3f0eec5a7fe076f8c0ddf3ff18cadcfef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CM3TD3CI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60E7.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar616B.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RUWOTRHP.txt

Filesize
603B

MD5
3674ecf7134cb60adf2afe07452b988f

SHA1
4f548cc4806a223fed674e9f5bd46c96c7298818

SHA256
bd6f7b19d6d1f6acb6bc060ca219cc6595b976fb4b8ec067360458ebb4b4fc37

SHA512
13e42b127bf7e3b1f7932d0f9eec81b37c9e73ddd4e29d1bbb50d3712089eb080f01c4376277239064c0ad7cca7ecc758bd8c777cae980db350e4f6f70ebe364

Download Submit