a9685a34577747a5605639602510d3156e1669482e47bada45dc231c376f4f0c

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akhrygshdfhdfjgs.c.html
Size

301B
MD5

119574ada6c8ef3730ec31f43eaeaeff
SHA1

1b0f0bb1fe03c04b22136e0f2482d62baf098a89
SHA256

a9685a34577747a5605639602510d3156e1669482e47bada45dc231c376f4f0c
SHA512

ab03ab3712461db581afcebe9765a4c692b7d5c499e3772835e46ed97a502f2f0e6325620199d06c9696396a333c541818937e90aa74712551baf414b8824a6d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396464556"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d000000000200000000001066000000010000200000007f61d5c90dac3db58b36cbf20136aa3fe4e29c07d3875ce2d81423ab6516751c000000000e80000000020000200000009e5c0f4aea4f05378b519323d6da2a4ffc3e3b423560a6b1cc251532c7164ffd20000000848e7ae73bf250556f28885e212df8e0a2350eec749564de802f48c5f4a1410a40000000ae1cae1589b386e9158db40ec2b2632fdd2ddcec9db80bf969e6e4fddcd2a012fb43260388c39f060f9979cf8e258bd0c491b6d2b36c7536cfc7335319de4e58	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d00000000020000000000106600000001000020000000f8d750bf1f9ae78444177cb01524f4ea655af90e5c2b3408e2e5574ebff86a4f000000000e80000000020000200000009d2757e0387486abcf9534a8eea502c011c6f710d5c2960d1d9404522bc088f190000000634ea8e37c802a8e94d3c77dcb019b202cae0a9011d4031d237e9350a749905aecc77001e7df1171f6fb69e345a250d856cf6135a2d9f648a98c630687ba6ce92f3e45decf7f4296c4fddbaef51c1de270fa9273fae58cb86c69613d7cae382ca8b607df8d1d0be972c9c415707b6f1b21eb331182eb8cd7dcc82dad2464ddae3288b336e4eae357205000ae2019abc0400000003974e3a7e79c0033634c4db0ab1750ac6210701ae59d8c1e917aba47ee30df1faa7b0c464a1e6fb3012e80d5744dea92b890b86e1e599ee4e24a9fdbba46f85d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D1BD811-258C-11EE-9675-5E587CD0922C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4074fd5199b9d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2432	2784	iexplore.exe	28
PID 2784 wrote to memory of 2432	2784	iexplore.exe	28
PID 2784 wrote to memory of 2432	2784	iexplore.exe	28
PID 2784 wrote to memory of 2432	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akhrygshdfhdfjgs.c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ec750ad118b6c234e8c86e81c38fae

SHA1
3f19ee8fbd853ff80207e88dc817431f601a11d1

SHA256
e1c457e0b4c24c127b74b220728737640e71c8cc50b461e735b4f753d1ba4a7d

SHA512
a0ef1daf4c93c11f5cf5ce216e4340e274ff1c8bd1b9ded1b3bc3d2ec33212ae46c95d9a208b77558e445ae2360bed89660b99c334f8ab2783b926cf45e5db0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a71a288a7fab95d4e64d57591818d6

SHA1
9e40b87b6147af8a418fe8961eb6547e7d2432a1

SHA256
de25fcf75f6cdc8a02e71ec4af303643a733f441e5fb4b73964789b09661ff1f

SHA512
038b22c37fb287bef4b8f4852d555dcb37ccc7ef910e6be0f78c63adf0cb1dc2619697248502852056379f5a8930112236d1a413e617432739195f93ec3c74ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c47c1a92baac3a2ad8f5605ec1926eeb

SHA1
5c19b87caff438736dc8e40f876f1f7ea2e4d1f1

SHA256
e4e2900c1c5e64540a538ff7d448c87e2cf23fd336a646a87e41c310025bcaae

SHA512
b7e9cabf583e2f7c45631ae2f5666ccfeb6a4d9bf902f62e06c44916ace908ae9cf29a72496c8c64646698fad024186fbf1adb809dbad52b1b40941f24677c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b37add221f380f68fb4129f7046d89

SHA1
31defeebcbd03d7317e4cad080299d3ebd3779c2

SHA256
1c0846c244f47291fa3d3626c58826c8625f97c84d59e5e251220e58a737ff8a

SHA512
2f85892522794581acc0597d66bce9cb23b93361909f713a09045345c9e94c992c3161e2f742e0d52ee629748f8f588a35f5e9ee72970daa12d574a974e35327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df9f7b3c9e7d88fc3898bd02163811f2

SHA1
c469e7b37af613397409be26daaa7f61bc781ed6

SHA256
cece9d1a37b63b30d275c4d769aac0569c8153178ea5e6f4aa72b75a3a76c181

SHA512
a8e3f48f64deedc42e541b8caa57bc76a6c21d2a2177f5beb408eea5a3de1e21c2cd4963b40143e8ce8699259c74d614c29572880cb95bfde1aab5a138fadc53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d8b03aa96f422290970e4e60d3b2ba

SHA1
79442cc325de00c607da2fccb747700757d3f2aa

SHA256
045fdecf20048202b0c9618ed8fa602f9adddb6eb2b5621b768df3fbc88886cf

SHA512
1c9238bfb709d2f6f2200f9ea58aa5c7c70d2433ce6c89e766282419e32b28cb76bf9ae85da9efaa4d08697bfebe2aff59af3170f9db8c0bede01101e9815cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4ff30a2bb783f721d08704e7dd7511a

SHA1
fc056c6ef6889213b67debfe1d77d308dee42c17

SHA256
705ae5c1453de303f602b1ce94789efc9659e1c8dcdadf182a3a38936f0ef0a4

SHA512
e2f098de636d07708bae7aa0b1bfb214c60e573c130731d988ea08dd9cab15f54c878afc1e5785ee3e45a18bd046d2576f62a2ea9cf79ac927872109d6b1343d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64WRFCMO\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B80.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BF1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3DC8ZC5D.txt

Filesize
598B

MD5
a5f0728a72308f7a01a34aa463dfb29b

SHA1
8e270798835dabb5f01b11dea0b0369851bccd13

SHA256
6681c9aa1a552978c3305f7b680801b320ec3bf732f110d4f0170127fad9e35b

SHA512
4ad89692464544c235f0377c4366c50aa041ffa85d4064919080dda93ded5e106b23ac0a6c606366f162187b6f3c4b6eff288e6bcafdd6fde9f6f8118f2b2289

Download Submit