b5294093e7de64128942fbc66bd5d180f67f453d6302076ce627f5beade25bfc

Analysis

max time kernel
96s
max time network
137s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

959.html
Size

4KB
MD5

7260dc739e6a48a69d65a428e416bee2
SHA1

02a20c33bd1fac414cf41572fedaa56dddcee792
SHA256

b5294093e7de64128942fbc66bd5d180f67f453d6302076ce627f5beade25bfc
SHA512

f0364144557c97d933dede6f12041298beb5a11b9f502c41018bef368b6729626312f9ee56aeff8bb5f605ab991724fad5766a6917c1dab9cde2ec30f8d9a6b4
SSDEEP

96:1j9jwIjYj5jDK/D5DMF+C8NpZqXKHvpIkdNMErRB9PaQxJbGD:1j9jhjYj9K/Vo+nN6aHvFdNbrv9ieJGD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395827433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07f62e7cdb3d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d400000000020000000000106600000001000020000000ca6c5b321e74392ea96a5d8791c3ff93240e23bd35ba851ec16b2fb9d53c7b96000000000e80000000020000200000001d63a28dbe2fcc6f5b73ccb9eadef588b253bcef5f8dc6c7cfd4b3ec74cefb7f200000006354ef6dc25b7786a900dddf15af5782618e37dccace7d791f853dfb3e3c830b4000000057a14e7d3580d5661a64e6d46ac2aba7da019540b6ff0fd07b95532306fe546b91ea01eb62520d37178a34bc89da4ba66e0a41bc224b3209ed0b28ffdeaeaa22	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c29dc726ce5b94c89351546d5dd24d400000000020000000000106600000001000020000000d9128a0fbc4340f4cf79cdc8e3575b7c0fba6e9eea4b24d3f4af8d1172f02b89000000000e8000000002000020000000e315ddd53a1ec3279ac8223dc93e47ab4432df2c7c7878df6b4062ada329bf1290000000fafbbe9ede31c29e2ca567597a7fffa9bd0222998198789a6e8424266ab31d4acb3a59bbcc239de9b5a642d41e4037778c3f1accdc8ae198650eeec855405e32af956cb70d85ca23792ae9545c60656647cb99de7781168b3a2c5f6ed12ac3511bce550635a1e3d2307e7022a64d9a6d52e52bf3f32027c0e47d41f73062a5d06be03d9607b44b2a199ca936d75cf3f4400000006fb4ba7acf2ff02161fe2cef5bf99c9f8ad736d8a4a87cf4fa67d934d3e280cd408a837338cca5b9155d83b14c8ee0de0f3002150bde6fb12984ca9384a43e0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12614DA1-1FC1-11EE-A5D5-725E84185631} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 572	2388	iexplore.exe	29
PID 2388 wrote to memory of 572	2388	iexplore.exe	29
PID 2388 wrote to memory of 572	2388	iexplore.exe	29
PID 2388 wrote to memory of 572	2388	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\959.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8062936779ec5faf5d8f60fde767924d

SHA1
b4d65f7132f3bc8deaaffad4661cac4223f20c09

SHA256
02c93004e7d67873ae46acc34036143ab86e7b39f6296dfbaca66ca140e8f8a8

SHA512
a55db68c971720bdc7a1273ddcd29e768e44906c5005bb8f30a92aef07558ccac7fe6486614a44ccaec7cb57518fb556d7b6db9bad1e939dd6eef17416916f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ffe22251feb511148be3fa5f60a0682

SHA1
27c787d5289e624f5fdf2ba5f3bf7baa4fcbeddc

SHA256
eb2f42fa46b856f3ced5d0fb4c011fcf1f8a577528c6a53683d6147957e4b572

SHA512
cf87708b0ea25a118d6712effe8f1fa7545a79a75d912acf925f1a15296e1140b1e523962f3fcd2d8b3f4dd8ecc23ed31b8eda43c1b7d2824b052e3cdcad68b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74b6ca68366a101fcd128578d4a2753

SHA1
ba258be7230be7f38460bd7258064cbd0ce9b788

SHA256
5420de4a7347ee695181f0c8eeeac3436790b1f4f71411b83cbba901c2758d2f

SHA512
448d7ae3bbcbf4f13330b2e226ced82bd5ed2230f81bd70cf883f916c42759a1032d5eb113362ede843edf64799f8a89557c7ba8748ecc72a61d98a667c19a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ca8435fd94514939ce966d108027b0

SHA1
94603bbddb63ade1f06a3fc3715c5b4742fe54dd

SHA256
37b75b3d379eb1615aac30514023b0b647603fc07c479e21d3e34e22a4ab9bb4

SHA512
146b402de9a8616133e0be4e77cbbe6ddd553ba42f52ff1ba1785022dca5a8296a7b01200bd72d52c3bf4ced8dd5a225d00ccb64ab72b5e9ac01360bf060168b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31bd433484220b5337f40bfb3542c424

SHA1
e389ddf36193539f5f428518726b881d6015f4cf

SHA256
522bedc3ae2c6dfb61736278952e5db4e81a349636e10a9152612e0cce4dc357

SHA512
b7330892cfc55cd861a83131e1d6e882da91533c3e1eb607009f7b1e3408a4e286f2aec780417bc6d252a3ffa5adf95559ba932a91ad8ca884696c9065070ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5158322922ffc0322f0cdbf61571698a

SHA1
b42c86e055e79a3c301a1e14accefc02a9db83d3

SHA256
164d6d208bfa8f616274e2b7ae5666b873e4dc2f5a8f32d356a4012435f2ebff

SHA512
ff7b3860c7d78c696407c7bc50aa81eb43c4473272318f93fd2b3e795f0fb4098b023b6be48316a0ae70368230ac79a208541a99c349bd441797ab975fee3edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30faa1564d08e65cbaa3ab4bcee5c659

SHA1
332b1e755f977fd21b90aa4075515706301a699d

SHA256
613824feef3bb352044df463ca72db9bdf02a8033a8c61cbbc7e3c5d6d8b2edb

SHA512
7f568b4f76500f83b2f6af066e856abdb6f22a4b0be18d959ea26aeb58c0278ba9491da75d30ce8e69e37692b75dcbc1709ea596c948d6b8c34fb08349e8978a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e8688fd429407468104f8f23ee4954

SHA1
64a7e4ba124034e74b15e05d46b23675ee77a2d8

SHA256
f3aecfbc3b64dd6affdd4b9e454f9b741693b75d633ff7f58af3ce5c5b99e61d

SHA512
3e6b2fd700061912044b9037d09b209c781e21df3180143bf31777161cc8163563ca97a0b84f569eeea70df867dd58373f0028be19cceeb2d4a86db9695b3890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e813b03592b4988f66a01cad019edd62

SHA1
d865d3342049826d647f649c3638a9c3c9999f53

SHA256
c24f6573032853017f75aa2cb95ac23598e9be9a527a6eb54672353705eb9b50

SHA512
44d458c2f2af76cc461cef34fc6255a8c150d65c80dc01026ad6cfa66582a1b6d6b268e99ffdd8f6f7e2ed4afd02f77f7887b897b0a05840c8fbccdb7ab088a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f980de2f4b5da8043bb288d147b4b31d

SHA1
c974d80763130634e1cb9e05e920202aad57d64b

SHA256
c684c2eaa991f7802aaa6d1425bc8c5bde6c1c4dbe27a9abe007523eb401cbe7

SHA512
7e84a21d01be6431106ccd0ebc764a28d8e7cc4af46e9c5024655c748c9609f1f2d2ad4888fdd503e5d5472241b7c04f7b4a69963b35b3412c507eb9742487a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ea95c5b7b845a1d19e6e0ffd9acb7d4

SHA1
c74145f5f33b95e8249ec85c9140e7483ee32d80

SHA256
7298c008d49bf5a5a207acb9c87d87d8428391591c4e0363419afe2023756d24

SHA512
6b5374f86a059145719a7f89a95eca535a47a514ea8696c6999d52e9475b2d50ade98afa88ef219254a28fd1857674599c5168db3afb0c1a26bbe974c1fd718e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc41168c37148f37aa9a24c37d73f831

SHA1
bc7917582f7589b2680ded93010280e578963885

SHA256
46dd1de3129e2a003f92f97982f1a4c0c2e22b8c2073685b420d210854c1717a

SHA512
1b75b5c02c438394d8a71c88b91d3577948e0e364b942671916e1134274a282d13609ea41db9e459d0bacbd7a2cb42d1805dac4b36332f3e201550787a0da937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1857729e5fc599a014ae9fe043e0674d

SHA1
eaa2970a3ee1254b193d4026f0591d53453cf45e

SHA256
2b4d477d4d692394ebb4bf136116949c22f89e27f682b85a13dec6afe08297f1

SHA512
4cfea88413246cd9b30b6fe3e3f7cadbfcc16afe113e8943f13e198075f3f6c401073c2904538e7065d40f45bf65e7d5cd221fbc9b6b5ecfea36af5214e8536c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc79ed94a1199f60d16614b4b889545

SHA1
bea7a863310a782beecf8e9d6c7fbf14658f32db

SHA256
a59902482297ca59cb7aba355dd01a804e9ef406697e3daa9b80dd345f9edaeb

SHA512
a9353fe485c7edeeef9ed71ef554ad819507a9d0924adf9392defc5934b9d2f5050ad686b806a10b0d4a6b023924fedf0163e13df3d88c9206efc45010a09ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODRCOPYD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49EE.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A60.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\URPQZR2P.txt

Filesize
606B

MD5
d502767466ce246f99b4f9cece7765e2

SHA1
495a6d54b6dcbf46662bec3059b17b890f3813ae

SHA256
71c230ae205326b200b9120aae4cb126f6bcc495d88afc50746fe8901a2c005e

SHA512
c1f4ec365d0f0513dceab6e471e223b94679262649d45e000d98e5431c1d39cdc85d4610bca992dcf7ac8b7a67a72a084e73e38fb3af4bb7a57cd46521a296dd

Download Submit