dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/THA/regs.htm
Size

118KB
MD5

d8de076829cc1648e2dfe7e448231fe8
SHA1

902a415c9588a0a36523a8122378bc34d9059a58
SHA256

9f8ee2b884463525d9b0e4034e94ebf09129edd0714471e68945d2fd6a9013b3
SHA512

34429c9fd5fb117dedf12ccc90fce4f33eacd0feef55f1c6a34626af0e6378bbebf7ccd5acadce7301680d892f8650a701596bfc44a8c42488771384ee253439
SSDEEP

3072:kWRCGNM11IAqI7AAImAAIP1AFJItFJIYFJIpFJIrFJI4FJIzFJIwFJIRFJIZFJIt:kWUGNM1OAqI7AAImAAIP1AFJItFJIYFx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395904966"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e0000000002000000000010660000000100002000000018ce6e3b7c35396e40ca2c35226fd2e71b4be1e0269d85d9b1278a6bb5b4a587000000000e80000000020000200000003052c4d6ba4e75128968be0c5e4b6dc37403ad9459640abc09e67f2ab2aa609590000000b5479bf1cd4d00f04b4ec49b0d7e965f80bd232fe5f8d1ad2cbcd254c027b429755f8244a72c6f79f9d83dcaa97cf4c3d1df7a6773285e6bccef4236bc8106adbc075a9e35b07cf427893ababc836a60ce041f16ea677672fe9a29f609de3936028bf16ab8992dae48f43c28ec10080540aa9f5f5b9b6bdff08d0a5e69a6d79894539dd766aef963073c949f37874b2240000000e3be28af2f7c766d444eeeb212612e489fed04799531afe061b67e794e9120803847bc0d1853bae02963bfe57d8ebf429b2c887b53e0e83ed9342cac9eb69d46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9721C7E1-2075-11EE-9E69-66DBF85D7F8A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4e20c56306bc849bbbf82eb036fcf6e0000000002000000000010660000000100002000000095d367f605d0616601b0f8a261074ffec86d1d81f7ed825ed09b2c1a8da8fcc4000000000e800000000200002000000036bd66eb233ba1d16a16055c5da7e60cce349ed379eb319855ba7ed08d645b8f2000000046eda1c5fa90de491b1a820a1e316cea307b8a07fa10f8dae251cf453865876940000000a51caa0535b191e19a4089f02504c682fb5ccd0f6fe15ad7804c4f2139c3604ff322b73bc8aa4de138f0467b4f75dd20f6d9f7a4b3bf73d66c8aa2673dc81bb9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900e696d82b4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
740	iexplore.exe
740	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1224	740	iexplore.exe	29
PID 740 wrote to memory of 1224	740	iexplore.exe	29
PID 740 wrote to memory of 1224	740	iexplore.exe	29
PID 740 wrote to memory of 1224	740	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Docs\THA\regs.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1922f24f57100e63307d2270911285

SHA1
ef9fde1c86008d2bf1e6b9f1c5f04e802b129815

SHA256
02f5b9aabda3f65eae0d3e8a65d472df3d4f1ddbe93f78cdca9daaebd6b09ec8

SHA512
26853006220e941927e0e347f2dc25c03ba1b0074a1ef9674fea0a0f0e6e3b00e11091e27b9a551a575778aa935f63b3920e693c00d749a5b3e2a99a30b59615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
504a520728579ac9fad654b497cbceb0

SHA1
704c5edb950e339d55e1ae26af2c4dfa3b13c099

SHA256
9a6156033da4ca2a011aee33557c1cc0307ee5d12efeb46bf118e5521bee790e

SHA512
f77a92404cdbe732e563dcefce6c3fea72be415bb9a54d82f627989a46661aa09a1a93c7366faa4d2063e49224551a04ef37570408d8a74d9b1685dc1131d8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16d68d013bea08125a632f974fab43e3

SHA1
ff652085fd2df67bfd215598983241e0eb1191af

SHA256
562a178da4772bd2f15ca0e72a2ce0226ffd52568211977ae10f8c12adda2a54

SHA512
ad86817f4cf0c7db66a72628c7d696b69d9798377f76d95cc42370fee30b5bea992c16ac50fac5cdbc4fe67122724da8db4f9fd1942e3cddfc8ead3c261fcc07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50f4f1c705540f4721f8df8e96a9e98

SHA1
6da5a2459134c6ecb41a61bca7366d5ad93cf18a

SHA256
df4d704bb3c0db302879f70a6ec87e7d3701eed400a997168d088e596df50c07

SHA512
2c84442fbfe505ac4732313758c80339099c57069c9c5060a3fd6c257981bd8087eb411e27227b348c8607f1463562222b09028e1124a0ff33874f1e62cd058f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397b12537d925101551dfd5628b4dc6c

SHA1
993ab2d634b224ae56df41b3815ee2db04aa1f2e

SHA256
bbf3783d3b31e4fefa5de85057b548c54572d99d520e7584fedb8b52f12aa0bf

SHA512
caf5a43ad6060114379fd619498d26c99246b45b2fe3d03a2f77b7781d5474277be8e1ca220b1b5824e7b687b7ebfdc66d1c1ce7c94c8fa54e988b1e1c381d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094d6dba05399ed58d3acbc8535745ed

SHA1
f28eab56c6bfe138e33142019992bbb82b2ef95c

SHA256
40b6c0c015c47d955a750cfc1d29c421fb2274e84054db4c8260274f2a4a1a0b

SHA512
7d4bde4dca94071587ff0c974336f9dc40d55f48c0f69f96a46bf7ff154f70a1747b448bde2eed8f1165e4c1f13ba2ea4eeb7fb16e2b65772d978e2e9b576390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e824bb39a844176887a6927c4bfe33c3

SHA1
4d9c9fa0a3dc86b054e04612491a75469a823370

SHA256
eaa5ef20a7bb6b1ab4d2e58753d372c0965248dc59e9f29d111e3ebfa12e8d77

SHA512
ebc332b640e7eca1adb13ad92f68fe86d4afad10767dfbf6899c00364eb19b05b4f3cc74b6c0b5c53f7b352fc95d6e71452ffcfdacc8d250f27a36993af40be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c2d4ca01b7a6c44956882da30e2085

SHA1
70118bd8a2c881359788418f62dadd79cac71855

SHA256
0ea84c2df2dbb164dd7eb6b6a757eceebfc73c9a6b27528683d5bba78b77039d

SHA512
a2915c1bb2ed6d1011c20683e7f3be07620a42e4d041fd90b19d7c4bf90c66e0c7e7f0b66b381768aa6d7e98453ecb992d1995332d884dd79259722cd2b9f541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29386757ddb2a9a1ca0fd0d528d6a3df

SHA1
5a17276af67a69cfe36fcf15a057979671e44fcc

SHA256
43fbf24e99fccdb219308bc253973810bf39ebbea38a0e0f014e2dadff8d0877

SHA512
5dd0b8b825f05ae25d814e2164e058301cf6af202a6080c2040137b47ffa18dea219efc8cccbea5a6a12cdd5a4e5ac26aacbc9c490e58dbfe879f7c397cdd1d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d85b2b4b9b4cad26e1df1e11d87acaf

SHA1
d675528ffe5281f1dc02d2b23f4fe53991f4411b

SHA256
01614d349f05b9e357c6b22b1cc6351df30cc2ae051f5c3e09d2a95f3dcdbd5e

SHA512
4695725a79663634655961520271eaecdc07a50867a67a442199db43e31edc5787115410e1a310d22047c38b0506419833528224cee347bb6c99a3c017b9cd88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba9c324520736cd2fb1eb6626d58abf

SHA1
078744742402f4d5985bc8aa423663cb7bb41a9c

SHA256
bf9b24581117a05996ff5cf0da6e8b610993efb49ef8c2857b3a022fccc1fd84

SHA512
0af124118e06c8e082a428f4af2586516872cd4da2741126293bbbdfd01a7b674b60ddb80aea4e936aa42b5fc5878f8eb4d79838071e312493570c3f9eb37dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a6786c1f67e5a2e0fc26a9234a7aa65

SHA1
1fffae0e84d622c9a42bf9edfa5dd479991ef238

SHA256
895da764b464fccd5ecb7404d2b063238bd2b4b45f76ee9b137790f522876228

SHA512
190c80cb7621bc43d670cf19f07fa2393d3e25e8dca7be5bd6e49c6836ae8295bfb69ee4ddb8d8d48761891464c353daab119779f7910463d8476e1beb9a86c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IXTVO3I9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A90.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BAE.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0VCLMLWH.txt

Filesize
601B

MD5
12521077f08dfadb8da370a9b63b3ec3

SHA1
6f1fff44ae7744f44e25b1795e3db737056b62d7

SHA256
6596376234f1773f272b10917a92d45b8a00fe535cc5953218ed5fa2184014cc

SHA512
7dc55a36223b595ce21118e8f4586a632006573117fbd5c8cdbf143a8cd0879791838be2feab04ac8826cca2834b3873f90b95bccc8a52a775b2886b0c72def3

Download Submit