dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
102s
max time network
143s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/THA/index.htm
Size

5KB
MD5

3d253b559dafdb276f5bd487283598c2
SHA1

44558b7bd565950f2b8775bc7ce3778fa3cc8515
SHA256

9e839b5c7b2ca72185f84f8b2b982e0bfa3c5c3e774a326de402c5c7b2ff509d
SHA512

f3fd64695b442953bf6fc377bb7cd29d5d7c5ec349e6db85f755fda08e29a21588cd83a6d27e31c2ec3304a5f43d6a0aa0700542acaa087781058a6975e77099
SSDEEP

96:lrlPe+TwRGImgMPARZmFQ8Q4Kdyj5ZK2TTZXP9CtG/CwXOTlyff7iUoE3zX:l9e+5DfKdyjHK2ZXG2Cw+TlSDidY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50886a7382b4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb4bce00ffaaaf46b42b39f311b0211a0000000002000000000010660000000100002000000033be0d4b724645f0139c624429899daa3cc9737772cbacf98833d88d500c4ae5000000000e800000000200002000000045f02c99583182a99d71f0f5136f87910eb4f6fd6813d551b7109a971c24366c20000000169eb14ab69cc2c9411a71af948e53c1e1e273661aa59400e92561ff7155c66f400000009cccbb34fc3e874298a8cc9bf48b20013960f529169f3e0cb1e4d5e3b157b77b8acc44472731f17efc355211673806b87241d5dc1446e2cd469529038a1fd0aa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904970"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{996C92A1-2075-11EE-8CDB-D61BBAC30518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb4bce00ffaaaf46b42b39f311b0211a00000000020000000000106600000001000020000000367d083a6c69aea38ff2baef3145686932b0061d3984fd1eab3079eccb1c25f3000000000e8000000002000020000000622631e55818b095cce426a39204f766fe173e5eadd908f1556ba47fe911d0ff90000000b4447aefd5752d8771a2dcef69fb9829752b4807bc5573e956520cfc6ae1e387ec3bd825fcfae0a85ce7ca8ce6032551252cfaeaa63750a3b770e900e4c220a27a4d52371babc427904543e6ff6e6c339217814ff0c765ae71d5ae747f8547815f448a6b4f4760549e0a1a5ff6a0758b407ee14308b94fae7939939655fba8ed1f5be733cb61f45bcb13b0dc52182a4f4000000042f7c3883cb469d5e2a009a198ef6b58b6f77bb3b6c60226f63ea71140cc23e1e7feb944f6a68c46671bfa6962c197860679fb3f33e276a44b15e43b7a2a1d29	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
816	iexplore.exe
816	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2296	816	iexplore.exe	28
PID 816 wrote to memory of 2296	816	iexplore.exe	28
PID 816 wrote to memory of 2296	816	iexplore.exe	28
PID 816 wrote to memory of 2296	816	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\THA\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9d5e1c28287bf37dd63fdfcee2152a

SHA1
3befb0fd05944e5b640125277869f81293be500e

SHA256
c7b745cf29b8fa471db7d2f18453359652ff127eb83f157e9f5a2c0a8dff11ed

SHA512
35d9d9dabb9655e7b6fff95ca15d0b9b0cb5c55d4227559b3849630283156f316697fb3ead5b28959958b19713aad63e7a497fb185a3fa42071607e241917921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e659352f6425703aa165e2e1020c1794

SHA1
e7c3cceb2092dde6ff89718bd361d0e34b4d4cb0

SHA256
7cc338a96c8a4da1a5a7f5bb076a8cfb2ec75216ec4b57fbef9093cff526892d

SHA512
0c2c3ffdc3e8aab1848306dfb8fa3dba9fe4adadf43ac648664bbedb322f3888eef541e3c3910a6431c10c95317849f8b3a91388c4d4234f9a4f1ae61cb3ec40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01872698870ff8bbb1046f05af67768c

SHA1
e7c0d88f5fef154c4c21cecbb369be43d261edc3

SHA256
a7e453e45d038b49cac72bc8df6f1628e57e7dc822d0511466dd5f0a7d0f1a72

SHA512
2112a6294f132bed94bf981e4beacabc715073c10ed10fccd6ce05d4365a38ff9ce96491ccde5841a99037d9aad3f8fa1b08da521421bb3b1b0ba56fcb0bd5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6034658560fcd29655695df55079e7

SHA1
b36267f988b0cd100e8d330b8ebafbafaaadd893

SHA256
414c780b2ae5d67dcb583db86422c5465ce8aa4da57716f2bfdbe499d357f1ea

SHA512
9d20963bc03d31cce641791c06150cd3afb315bb943ad709b0c242bcaeef0dbfe967097472232de3cccba2e9b845b8c81c6c1aadbb3f20f289917af7322894e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d5fbef372d12dd97f07e7360a48ef9

SHA1
5b8ed8dcaf9a8570dfbd828e474319beda75c9cd

SHA256
dda428839980fbf01a37b63e98b492a77e25469cf625eee5ef0e99eb99e4f0e6

SHA512
00daa2144853496391ecea7792c940e2ca04e4fa4af40bcdf1cfe47487b70566a3e1ef5fd66362b09563cdae5fe633ae5db4f90fbd1108648b7c68a9555cf67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc38c30d0b95b52f2783b639eb73afc

SHA1
d5d94bd4c5f8ad36f140432d8d3835e647842bbc

SHA256
77ff4073603fe0e80949c4edac3c7209a4e68ebd5daca8e1c8550ac837a7b417

SHA512
670d4d34a0b2230dd23e8eb736d024aed84791c1ccf5ee8ce0475beed3d173d200114488ed70a3cec0442929937edef1f5a19c36e8f4a577884622b80aa4842f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3dcb1f71ed62db2f11577bedd513281

SHA1
afba85516253637d9e30ff4dea021e24f07122ca

SHA256
a99b938ca718a74fc9b0957cc3ce5268a11e493d238122b384c5156c9918fa11

SHA512
608bdac194da107f55e419330de128e5930b0d48d5e3b91bbbfcddea1c9eb08b865f17e331cfadadf09c636ef6a1ab8830de598b56f73d6b0fa6c7bd5771b72f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc70b9a85eb509caa11e3bad33f4d4f

SHA1
1222acd6fc8ed6d1e36102d533a1d1363582e0f8

SHA256
1ccc23734572d6f49c16c5c33a5135d44c5330bd160653a1776386c81ec9a578

SHA512
4528d14b18210aa40b451533a4eb08c5b5f359b5de7bddfc7947e849e066e52d5556fd1adc036385cfada7249b724bf80fd4ce0d8cda82b20035e414e9f1cbfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25890c5e14225a0a2ed3011bc9f28b14

SHA1
6ef7cef6f316af602b95c62c8dbda6627f166f3b

SHA256
ed85a42b192af1252dac3409a41723d7e2024653c9427e745ea38d34eb8eb55d

SHA512
588e5b1fa45313feb2e885f9936037914eff09099feccfe217f8a19663807c3252941eb7d5cea933402217a263a551ef62cecff64f63d0387e1df9595636a968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f33e6109972fae47fd4630fa0adaf8

SHA1
d6d7842f7ddcd8c951a30c83e383fbe612cfa9f8

SHA256
31b31df7d4e100529362407181bc2ea8a3ab11481ee7a4a7ab8973e8fd5aab5c

SHA512
7f39a7d011932dc64e50248e837c82622b15162c473fcc164fbf371f921fc399f1615e5dd1971eb30d1e48e27b936bd2dad36972022b13695c42885777b0bbea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ANFZKI5S\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC728.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC95E.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LJU7JHTB.txt

Filesize
601B

MD5
72ed8e1df15cd17c406c2ab3a9af0134

SHA1
ca241017c8c08dc0d5178881dc73504f34c708ac

SHA256
b1fce03637947c278428db35ce6332fe889a994b2e5e6baabb61593587e1cf7b

SHA512
316ca03912ba08bddfc9c48f78625f0dd8a9bf52705f9e9606b3d16d427fc2118a57f4c64bdbf9cab07d0d21e41f214a74e3ac149a7baf4a98f009a887ab9843

Download Submit