fdb0d2ab1eca4b0b7e21dabd60f353dbf6eedd4e8c32fb6b47c40550a1c0ac2e

Analysis

max time kernel
14s
max time network
15s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/07/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

230503-k4fdhaeb44.html
Size

59KB
MD5

16437a4302353ba52240f1f77d78f256
SHA1

6e850ccf7f70ee6419604b0028f5331932f8d18c
SHA256

fdb0d2ab1eca4b0b7e21dabd60f353dbf6eedd4e8c32fb6b47c40550a1c0ac2e
SHA512

512372569fc14fe6fc07d50b80fc1598a5ebb5296b9f3def324998af34e0d1f67f64d9028866939ea2e3d861c03403d269a496d1454e31eaaf0c806afb270fee
SSDEEP

1536:Bm3+1/73UWqx3gk/HGgZgX/+3Ndg73W/HGgPYLr:BmyUWqx3gk/HGgZUW3Ndg73W/HGgPqr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E812051-27D9-11EE-82B7-CEA1BEF6F4E2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2936	2816	iexplore.exe	28
PID 2816 wrote to memory of 2936	2816	iexplore.exe	28
PID 2816 wrote to memory of 2936	2816	iexplore.exe	28
PID 2816 wrote to memory of 2936	2816	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\230503-k4fdhaeb44.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08a147a594ee7a85160257535b28b1e

SHA1
90583d6329778774f55ebfe176ab456e20da4eb7

SHA256
67cbc08a6d002ae6db2462905ce8889b5a88e2f608c4c166b60b5acc06c56bd2

SHA512
309eabe6e10130c0e55a8855045701d887452bc94c7346a6833985e9bac46b2c6aedeeafdf40ae9ec038bca461629be2498c64bba899c4cf9ba2861f4e9ef5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d272968753453c39ed57715540c22346

SHA1
056a847d2b64748c782f603a900d5e16b4cc140b

SHA256
7b46d34da1e838ea6b1c4486cb32b3500ff480e71a04dbabd4c7e8fd899136b9

SHA512
b3281e2813732b5b1e07d6003dae9372f6f04a1a540e974276c78da3de554deccf1a4a8c2d8205fb6b436e35188d50fcb6bfbc1f45350c81e70ff499a35c13d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a163e7d2d8c1f4adc361ddd68104cf3e

SHA1
08bdd0531b58597e37589605b368f78bec5b4f15

SHA256
69df21062ea866757afa6dfe341bd93b5548885efc1f5d53902f3f5b5c05d1e7

SHA512
5872349c9f6c408fd4077e46fbb6e81eaea0072875acd71f109295aecbcdc5dcf017c6e3fa17f259152bc80029b34bcbc9ab38528e0ac44d4df97150766621ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c847f44c1153da3cf1e419e39c52c609

SHA1
24e037b0dcb912048c72b353b20104593ecd5fa3

SHA256
7bcdd8bf86a8aa7c9d3dae9f1964c58ab28907f5c47e3c2018ad7d7b709b1311

SHA512
7ce8cf0f5667818d58f8e40e2c7626f50dc662391d3606e0e5720c35052f8bd4f1fde3773101abe6a304e2fc3cbe180dd8ed8077dd260deb65e9caba4b802315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85d55c69cc9934677e1e1de3f04791a9

SHA1
8089ef15cf87c3e79cebc7b0b3628d46ebe73ea8

SHA256
67de07f5b905351b01e976ab06f255ec55ac2c24a04ac04ee6b189d01729eaac

SHA512
d624dee01ec8b308883db697067834a449243884893cde26a4a1f4e927e8f05acdcf7b5e285f2aa1e26f520e64c86c8a3fcfb7f94311e89db4d9096feb25f305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4122c0f8038d94eb1f2efd81b9f74f2

SHA1
b36c9738fa5a567744ebda5cfc898a602c09f89a

SHA256
94ea710497522424e0694bee96591216b4ba2645802448d8ad448bf51e064b13

SHA512
863e177bfe8ae1d24fb3d0f51ec0ae234db2edc6d17dbcfe54e636413bff3e79bd6d5f24537109738e4202b35cc21f0b91be964e5e17bb8fd9ea3fdd5cd4baab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07206470f391a84364956cec46d14d7c

SHA1
b17f0a6945384e28a9495988b565a79c5953ad5e

SHA256
ea9c4d0fb52249ca83956cbb332c8217d38ca8e409203105848324982387f7e7

SHA512
66132d8d91e9e3e89f2c05e5201d7c2a71474cac497c9b0483dfe95f88015b85e665cc9c0621491b6f36b73f31992fbbf3044732a49083122b692b24e8f4f3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd4380b819dc9f8bed98c72e8028db3

SHA1
7fbe97af0a8a67af6f86c2a23ce4351c799b1a7a

SHA256
f9dd0cefa72ea91f123aaaee58c95a54a074f7e8cd6ab345c2db5cb94ce09733

SHA512
9cb82eba06eadfcb4194d7ab52cd79e8bafd828585c35c0c20bc3e6dcc1494a1710f8868b88831cc7d271a4f3026fee22832999dc1ac206afc2a77fdc22c90a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e461d48505144da12dc09d4966bb2bad

SHA1
1aba455137acf3ed9193e434db09cbc35b4a09fc

SHA256
3cabab0ea68011c10e6cd9b92c2190c2dee575c8d2b7dd29585bf8911c2cc3ca

SHA512
1e0dcdfd66a11fd7174ad3bad22e7c4a5d9c125389e2e51d21f0c557b02cd2e45bfc4c11a194a19d8c9f99ba6a07d34868099d51559e6963e6595088816cac76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de6701b503127d5d5e79495d5d624d66

SHA1
c16f151d506b3ea6b02c087726f4ffa895ca5c1c

SHA256
a343daaa18e6cdc9b82e1f0a060cb81603fd4e46b8afc6a350e5df02dc703b82

SHA512
43f71409bbb4159ee6747e0a4b10a5c61698d9538b1dfee8e1f126fb34e01676b7acce3013f035aefac78410758c295172f4928484ef2462b7efb3918da0d6a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F26.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9054.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit