b653631708cdf4b2ec872b4dca10f3c23380c7a2b2029e20f23b590602d1bcfe

max time kernel
100s
max time network
147s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YOWA.html
Size

648B
MD5

00afda385226fc12c0ff63f0fc065278
SHA1

b40143e306c45e09b99f3431ffdb02c0d70932c5
SHA256

e36c965275a591eb12b4eb64bf9d69e59b73526d86fb6bb1ffc2ddec12523d33
SHA512

2ec7d3fa444986a48a7f8ab3707b7e45518bf6408709189a2c2a1fa420e8919612b1136deb2d1dacd7bedf1cf6e3746fff985935aeb92de50808566bb8f6c91b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395433119"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c5000000000020000000000106600000001000020000000b35669fd55cc7ec44d813d38f659ae8ad11fdf9832ae00b6445b2932c0286b8d000000000e80000000020000200000000032b1ad174eabed304bc3f8a667e6a42d8ae3cd12c69851444d50dd4cfa6ae92000000094e835663880b3ef96a74bd94fa8e0d4d3fe3868587eb7e1814c55f5b333ae0240000000646d17c22d601e4e96ae74abbf616ba2d639fae7ca855cb80326d54f074e0860c08356f950aba0560f510997a2cc3230026f6804bb2e5598108c665bb1495915	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05164d237b0d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCA1A441-1C2A-11EE-AFBF-7AF23948B835} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c5000000000020000000000106600000001000020000000a3321a24cba301a7d2776896d52c6597c7b438f616fec35fa56a710eb7af1ab9000000000e80000000020000200000009822faa00a96c55638b4e4a89dfd1fd5fa29c21859fa488bb4a801b936934257900000007a446a369877ad35bf275779466eab25fdbebebaa12b5f1fa7f26961f24f342214c9cd78e34072237e5c386d2e235e2069ccf383de0f955d8774a2b8c600b8f0a0c2f7388d6ba7dabf9f3ba010e92bad65d28306e778fd21a236ffde54706f87d787b58bd94cde0e56962269df899dd6413552a081adbb3c82a3e01b7c5603512a4eb524cae9453381c940a11302f3bd40000000800fa9a0f3f98ead9cd90a1f90dcd5082015cf582cb031bd4add80d76a66787b0812dacb0b027da22d41db03012b78d2c2594c4540daa8986f4fc7bc480d9c93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1528	iexplore.exe
1528	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2324	1528	iexplore.exe	28
PID 1528 wrote to memory of 2324	1528	iexplore.exe	28
PID 1528 wrote to memory of 2324	1528	iexplore.exe	28
PID 1528 wrote to memory of 2324	1528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\YOWA.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f82ef9b85863ed011cafa0756df3ea

SHA1
fc0164bc5e6b396fda66de1580cbf0cbddf4c4f2

SHA256
41e747f62442f095a8ee84aa6d472837aca45ee6a0379e61f8bed38e731cd275

SHA512
d60853cc6b28f9ac134cae800bc5d678564e0b91b9252940023a757aab53709b5cc10debf978c1ada1fd23a96786dea4861bfaa83c026cb3a3ff6d68a1d341f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2573e93f20233d1237bf6a65149f90

SHA1
3dcaca93867e59a47d5966419afcf87226120dd6

SHA256
a27f498b0936f32d941c8f53a6b1982349c8cb5f72e57a95fe0303b0e38cbd1f

SHA512
adfe9b535f56969c5e433a05bbb23a152a7e8ad1e92401874afe199939782590ff64675450aae9a572b1ad115832fa205d0a3674b2ad51168808822d7e8c892c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84515b780e5402eedc95b195bb385be4

SHA1
dc83970086e64f216c3a9ae87ffc8b279857ee03

SHA256
ed467b57cfaacbd2e3a1ea9f3ae9896a3d6e050955329f2cec02a8334e5dca1d

SHA512
0a4888700c8ffdeabfc525f81fc4cdbdfcea553dd904f880dde89e46424d8e20f5f1e1302d60829e2cfb0ef02d9bac4e4e0f6b7c33b31c5e116fb98c370def67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa1ed0792af1d464c8e8fe2bbbf8113

SHA1
82ba2f30ab40723ae4fefd92b6905c699779213b

SHA256
2bc7946f73935803d328546a74a870d93604bfb6c7e5a5f95f042119484c755a

SHA512
955b6f59786f2f8e23492cc8c13283da1c7b502db899a742244519908ca2bd407b91dca19f258d6c3e366c759a600e80db618bb9e33aa95657b94f3dc41c18d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a7ff6f2575181b858c67136eff248e3

SHA1
325d5a387fb5a82d15ae8ee590ec45d84b164e99

SHA256
e75ed775d6cd7692eca4f87d813abd090b246cdbea6f392e99c8738cd04f98d7

SHA512
f8a5162e570959a975525eb8ab74dae9e4e55b56c5b65dd9abe88a67c459d18b3763a17f896949fc3873badd50f255ae1dcab70b4da3c985ea77eb87f935e317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b182752cde86aa3b790c462df708a98b

SHA1
fa589bb2852231e55562cfa553216a354ad7d348

SHA256
0b824e3667cfbcc13dae032c9fad12fc5771ff45acda0777ececcd395a72510b

SHA512
7ec94ad27f566a9fec026ff951c23f6daf74f91df057142ae8d16dedce9cdd6e6f75425b1a149da6c39449fbebd2d8ced37a76ab26d5572934f646e6207028db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40e6b7beb4e8f5584b1b27f131befa42

SHA1
31821dd369ece55039f0495eda32b13f14d5f427

SHA256
34b2860d580b5cd78d07f38cc6b55ba42bb2bd7dec1d77b60a112aa7e7376f9e

SHA512
75a08ca884594a1c3ef8a7b8005b65d7a0a0019f84701134ce4e6eef23868931df5ae3ec4a385c6c75d1af58c9a187a498c17e2b786a3c1f288adc006981a74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64dc5239b8eb6840bfc6094b1ad51d6

SHA1
911e543196f93b98863aaa4ddde840d748c3c173

SHA256
2d777a3e9e7b9ac197bf329a75488f8067c533b736d637e4d48e24b0957c5465

SHA512
69fa8a017380decaa39718900f22d2b7531ce557bd522dfcab7586717555a3cbd989350da0cbd1619ba78db0e801a843771cb65e1947dbb406dd2d1186bd656d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd476bcd78dd5d69ded74da60efa1a0

SHA1
c89333effe6d6e5761c59733bf4aedee4c43f346

SHA256
0fca00cbfa6b2d73b04655ed651082bdfe6ff69488a84a384e9abd8c3dec1b6d

SHA512
df0d5d63334e3c9bf3e0952384d4d949c119353d9828c349060170ac9a7c90271d98da72d96e84105e98b0390e199d899f215338b83cdebfd242710008cb0601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9742.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9802.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S7SJD72P.txt

Filesize
606B

MD5
e0e90e68d29d95f4ff89b338ff253544

SHA1
8f25e78456378d2e562fbd5fb020979e33b42b0a

SHA256
f94b1c7cb897b03aa1a33d98ac52251ab0a1864e4eba4c147ecfdf946d8447be

SHA512
e7806ce5c450b5f450925469175d0ce3a40996f77fa0d5ec357500b53d51a1b1542689b49e7beb976b4999d94c96027a14834a526592a083043031416ea722d3

Download Submit

Resubmissions

Analysis