38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-07-2023 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

612B
MD5

e3eb0a1df437f3f97a64aca5952c8ea0
SHA1

7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256

38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512

43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000000848c712f61b91020304498aeeb135a2f57e37b62d03d04d1c7f52bc5eb0352d000000000e8000000002000020000000994b58488da51b1a50fd0356deee91b7fbba9a291e4bdecd6a25b01ec4214ba090000000be3847b0119d06ac0faa2f7f5b4951410b5046be914b9834e4e29b6b6a5e3f0f68863a7e7536cb22ebbf5e52afa6760498560dbf94a799f1a9188aa6ced1803572d5af95279b89d3ecc4b490540e3c86aa4a43bb230f2b99c50118d5bd11df1c2491388caf3388621fb3b7b1be0c41acdbd4d740d8e16c9ba86970da572a0ded776af3d677a0e4025a664f8c76d9598340000000a33b189a91e7350a0270682d0237b69ae25519cc1929ac41efaed167ddd05ea6e79875945c37bbd26f0b6ae21d0febf7669f1426580a9dc75957988b0395f3e9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397145897"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07701b1cbbfd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC0CA971-2BBE-11EE-A701-FEA3F30CF971} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000277443448bcd53649e9813ab7b3c58084e26c3010d758cd4c1f25c0dfc43595e000000000e8000000002000020000000f997327e72865740df9dc10537ac40fc3a723b86ae313ec99345f886416bdb0420000000c20ba53f4bbf3812f5581175101c198c0f1e7c812d568e46cbfa62aa46ae968840000000fa4e20c21cca3b76467fab273ab9fe0684d4bac066144db7095ed0f173770be11d18e4cba3392520d72d4732cca6a00d0e4bfb7aad570db5bc351d1e88dd01c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
2504	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2504 wrote to memory of 2912	2504	iexplore.exe	28
PID 2504 wrote to memory of 2912	2504	iexplore.exe	28
PID 2504 wrote to memory of 2912	2504	iexplore.exe	28
PID 2504 wrote to memory of 2912	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7788deceb17031789a878762c109a1

SHA1
0635b41e6a9666a4f97a3c1ea7d15d979826eadc

SHA256
97e3e63d167b3b50993e937fda14bb571f95559a049d0096510c8531d791830b

SHA512
bbe48628e75ae162b8d4571cd89cdb76ac46fe7f688791f735d3d45aedd6573097679ff8f1876ccae6f9fb649b3ac0e6612e593b7ce66bc05c2e1ddadb20669d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa4515c15c1190f973a11eee7dfcb76

SHA1
d33adb78e5198c99bae0bfa2b2e496777b146e8f

SHA256
3f0d99122908d1e423bd379ce95ccad046e08ab66e053159fd61c5479fb76988

SHA512
71a049f51e47deb65f8073edcdf50584f0b0dfd8c5da1cf4d3458182c3a4847fd413127ea106d792108397679851a29cfd19b45626e508024591777de445bd0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24ecefea3984174302fcf6b4f6244671

SHA1
18b7b2f93b4779c42db885c637411e12b7fd67e4

SHA256
dca9aa2f4a4fca8eb65035e21bc38e09a064cbded18ab67720fadb27ef66fcc0

SHA512
d0be59fce6a797a9627ecaa64b58c86ff3eed38cf5d4f583a525a2ccf678ca07bc91436eee1436c51078d5f2d7915df07299a22430dea44b2fde52a6371eb76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c7b60282c8ac8a079d48ff6380501be

SHA1
aa7a6c84056e64497f4cf7bd42fb3fceac03f6f3

SHA256
b7f3355591d6d5fc77ff2dd690af7c8aefba50b285e1d3ef7f5ef4db7cfb687d

SHA512
92c88ff28c86033e7ad8dee5d898c32fd0420a2e6304cc958f0ea3a1a8d3c811af2d56127450622a6625132156fbd69027778e5b2933e8f03f54d8219689e38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d02ccc296cc959b9d9b0caaa55adaa56

SHA1
2e2acebc226b6b4c50acf733b346ba2bf9f658cf

SHA256
39d12e39e0e085e8c3cbad4a650e0eca88f80db089042891ef10aa2ca664c689

SHA512
80691f3be371c1d3ca31ddc306a54fd62dc847fc0f128c1357dff55ceb88859e435c19d1518407c0e403acf73b08234fe3c41b5880c0d3f490880ef9cf0f319e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5395fe80411ecb670bb2ad205f628c04

SHA1
5ac960f85ca03fa51b32913dd2cc96f80afdbb35

SHA256
8ca10844f472eeab718b7cec3b37bba4e86518687305e0f823718854d5eb8afe

SHA512
3b5e962a51230c7d631a507a553f7271e86aa56118d237e86f86d83710a3131ee4a095256357ad185c231500faa54e9b16a915ad79c3582404dfa57434721172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aee53112cb7a37de4febad0513ed825c

SHA1
b92af63e27a7190acf05617cd02e56dd0ede8b04

SHA256
1f1219974efaf788795aed04ec69e92cc1d1315e146c90b84277c168c7066cfc

SHA512
a96c4c3cfd5b178b45e2e1c06bc9202efb0e2f6d36019b7d95a60665c3af704a7b1e3ce151c9c1ec74622ee0023e7e63a3cffe57c86a8761cfae829e8c969faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18c74c7d257084253a90a12f61bcbab7

SHA1
507ad2ecaa9301377d47313eff86c3375f6ef769

SHA256
bebfff759bad4d1b584108651c83ffd0e941d74441fa0ba28cd7bc8959b92d4c

SHA512
5e7ed339a470597e11e5d7a34af1d48cbd6e5431b9c10c286d12b08c77656c2258b0c0ad678be2703c8938e45bb800622e1f12eed062dbe7e0849e5f951509fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b70d1da93a4631e4e547e5c3ca1de2f8

SHA1
f9a0bb035db231bfa0f88d4a63b7755bb9174a54

SHA256
adf0410c1058763b4f2fcdb18ada8ed9c3a0152ed2f3d9d8bf155168ecbe31ce

SHA512
3b25c72ffc5fe1c14859c63a86101251ba327bb1a3348bc29e18f3d4e4e024060487f86a0cf7671f51fe6087bf6b41012ca799df9cccdb0521a68c651cd5a544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9741c6efb2b389e17cb2a74536ba87e3

SHA1
ab180a361948f434c0d3e26f04562dfa6f9edf58

SHA256
3be59e0d1b48b3968e6003345e2bdb16f6ed099fee4cfa496bbb3cb111bcd225

SHA512
13052438441540ca441897977debce0730e5ae291934b1abc1f826350836035c186681a908cece8376562a5fb4a59b32e749f34075b70b04db664a278d08f1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a40d37fcfb2d9d850494cdaf3c46b4

SHA1
439158d8e2fb2b558bbcb109350ed888d97c9165

SHA256
a73be0f1c6018e44c86c3d6c24b01ea8bb22dd03c73d70e085437fd7725e0598

SHA512
a63e31be112583f622f38d8fb3c1b1d848fab39368d40be07dbfca970e9bc568d116b045274bee7d39a030ee29cceb28bd1cd021e7b8b9f2925b83186ded2c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U6AGJ71Z\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab97AF.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar989D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ATD24DOS.txt

Filesize
608B

MD5
0741b53aa9c0d7484f608df1c7d6805e

SHA1
7b6b6bb4cf70bfe887635bf1b67a001c2bf8db0d

SHA256
b1e909ee50e67e1ed000f0714c93ed592579cc304a82e96ef14a163ab0af25ef

SHA512
1adca6ca06d5a666082d46f59a8b08c4d669499298cbf9073e427b14248f2757fa9fc5ff7d4db190640ee588cd7c76d21a629299864e5ba6221ffc34eb6ea9bf

Download Submit