dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/TRK/support.htm
Size

1KB
MD5

b387b228b5583afd4b68abc57b7deb73
SHA1

85956a3e527fdcf0638d9d5e46b06c06cc828518
SHA256

8ba8f78b44fd615d154f618d3109c1b0f9fc1ca0731f856eb9dd3c90b75adef6
SHA512

15c309daccc9800a0b5699c1e1aa8a4d742f87e479c35149f161dfd60fcb6a9871486f71f646bc35bfaa8b1cc1379255cbeb0d75de63543da2d50cdca15bee2a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bcfa6c82b4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e00000000020000000000106600000001000020000000d0d83d8b5250afe2c241d7f310d9d9bc04e9455987bb6652b2cdb5679bb87c3f000000000e8000000002000020000000ac27762f827d24cb6b2051c18065b42bffd22d33a32147c071ad0fa82af5add320000000777a7658cfb7f7842f505db13e2e2fab5417e435874a382769896c9d056f73dd400000001fb340e2291e2e39c23d8237cb904f07dd08089dd3d526d1444733b67caa64ed65bbb52b22f91ee9afabfbec06bf0745db89032ad27a04ea88d4c49e180144aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e00000000020000000000106600000001000020000000b8c7c50c549703f6c0562f0de9dab10bf81d3587c289e5d5e8d9b3ac168f1ee1000000000e8000000002000020000000e54dd93bc2bbff92cf4baa48c8ddd0fe2336a389e127e51f05b6415fa5064b959000000062e25d420dfeb847ec7848dfb4236347376c20a3ddf12fd426c204a269e7a17fda6060921e835c52b8c28e1b22aae1b468112492d5bad726c9b4d918610f9a2c483ae71a5ca4c83b6a081dd298597c2f65171c0113dbe54179f98b966ddfd718016f7009c5c0494dc580b8941a7ef8e7ff5bb36c94a60a677daa607fcbe695554305df141aa8c4457071ca1720a19e0b40000000908ea53e45bf951990e35eb358f4b22859400101d796edbe7dcb4d1b35cc8b976fb48610390c36fff2bc4b40f73ac36adc9ae63f21753d5c7cb287a2d2b3cb72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97191551-2075-11EE-875A-7AA314CC78BD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
916	iexplore.exe
916	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2308	916	iexplore.exe	29
PID 916 wrote to memory of 2308	916	iexplore.exe	29
PID 916 wrote to memory of 2308	916	iexplore.exe	29
PID 916 wrote to memory of 2308	916	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\TRK\support.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55d5bb35e8637e49bdef8c9cd8950913

SHA1
4e5c8df69e847065b82a2af6efb19cf70bbb3555

SHA256
8b4be130c69c6b1509e58c8d3089bf2ca5c18f4cbba9108ab14cb8fa54324ed7

SHA512
a01919190714237e6d6897159d98f159db5756e8cdd6ba915f58733e171a17caaabaa0519a86027c4778110fd0b17193304f9eeb3a1ddcdff2eb36e1cc6d95d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
507a11edc16baf5ce43392ede8c19406

SHA1
730c3b1bf88ca6c1555b72df78fec5de498a450e

SHA256
08ecfbcd1cffe8f57d153534fd8c6a54c06233b8da4688d84f999f949484fc04

SHA512
8af7cac6a51e09d78c10c4ea7c8baeaa9ad2d2e6583842eb839e830c80ba39567d88ff2b039b8185d2884faeb1c57f5bab45fd0bc5379688820f233dd0534184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e8064c7da0a8aac4a2384ad8c37750

SHA1
a18ae145d86fd49abd801ce0b75bba3bc0c4a169

SHA256
10d3b0c8e79b03bad82eb7d7edc5d96a351a1355ab522bf808709ce1f4fc2730

SHA512
314d892d7b4999ecc298770559ce41f103ba7a26c5fd9d48472faa6efbcad9c3802966e81eb6c6b7c92afc4759bf57d30e4274f6c9e69b0e53e0feca30e2999d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c9a41ee8154ad24cac0c5dba71b2d82

SHA1
e4502b887cd58aa15435443737b02fd2ca8a8d20

SHA256
3374b655b2e53b51e90d716696faacfa3de3adae1166e19f96eb2c168e1f1fa3

SHA512
ccf4c17869bb6a25e4d67d76cc795ce2d2df4d794b1e9cbb84f0d6c90c76671f1343482cc6ba479d3752137b00e75fcaf651b642721ade881375a96a2ee4ee06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac325b8a803c75a88dd0cbaffeab1842

SHA1
7f6c4c928d787dbafb22f2d5cc68e67cb3cde711

SHA256
f44829296c488b9bda2c76d189049e8e94baaa72a4c33b887032a4b8c7b100e7

SHA512
b4461ae09002495f0cab679fce0b97398d95ac302d67a16cef0fb1d9a0b1ad4571da455209bce289b55299ea21ca8d47d7693f972e6dde21b1ab951e10bee469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4127066e3870f42a9d63be8ae1631304

SHA1
61cae19d95e728c990f67bc5835217807663d30f

SHA256
90a0020bbc2d3b8695077480da21824d9aa58b01f9d1df54cf7105c68568d791

SHA512
7e0dccfb39b75e2cff0d1f204ead291a046152351e54b0f54cfc62c6175958bca2c0946cec19e369fe536ff1d6c106df279413e4dd522aa9f6e03eddb7ad3ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46e5c37c62abf033d1428617d8ebbc48

SHA1
838462746e92f0e7fb7df9e087dc35244e63e5b7

SHA256
db02819a90ba44384aa681675e69693c165841ce0e0442049040423242066752

SHA512
19d53d4424b0184703e406fe2592810155b49971579e6f57b11b2f940d3289c1ef8a74bf99606d905b9c90d7dcc9a6eba2f5ca462c85fa680bd5d5111872a3c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f270c9bf7788071e2d9ae7692f915eee

SHA1
eb06331fbb1d91f0336d42b8e75922bd507cd731

SHA256
4fe29a0c2b0d8a538fc57c10339100d3780ef65a751981e0d4f64b5576683f8f

SHA512
36fd0f8a854479054b3f6236145495eb261cc67b53306b5b4cab53f41e2e72d3543a19998765e6677912b820cf7c3b1d29c31273cd16abae5355226997a5ecfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IXTVO3I9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E0C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F18.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CS0T63J2.txt

Filesize
601B

MD5
cb1ad27754bf240f51deaf1ee38adbde

SHA1
7637ee58e190ebe40574d6e292565d9bb3100428

SHA256
1026c653a8b542ddc78d1632993139ad22f9b7228cbfdc229de012a008ee2920

SHA512
dd757b4d72e429e587391bf4bb46e32ad9b7b4a76757b026b086de5b3a62b51f541e779feb395aa460c3d542c806f872ebde1e2fbf8479f45580dc96b9318954

Download Submit