d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/07/2023, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newfile.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC72AC31-2CA4-11EE-84CF-5A7D25F6EB92} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302d45a1b1c0d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000000bfcf4d9e349d33a626b241b2471dcd2b23b01598caa00ce9143e9b95f3f5590000000000e80000000020000200000007c1c2d8ae99255c564718b144dfa0a1b6f5d1145f2d5a7b203801ae41523a04e90000000226d2afb627d4e9db839f8a773a418403a551209a54a7672a83ba8dc21bb5dc4c55429250938fdd59e2e1a0da386507e64e7f66a519d5d34c8e8b67e9e778feb881c902490798ee51bcf381944e3e93cad1de6667591313c011507c3bf5e8084387d16cb381c7e70cf5556135391e9fe3dc5ea84e932eddba0406bda5d96fa42dc269c313e7f15771fc6b37b42cd81ec400000008b1686f69d602a9d6b90672a8c463c2581a804d8add5bc55b5909a74e0cd9400f57331cd1c67ce71334a688be96d8c657e6b340970006bcc534c7fd104502344	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000000160147a36299b1ef1b197e585121d1b2513433fbf1696eba02ad49612696c73000000000e8000000002000020000000b5cc7e5b7e5cd9fafb37dfe021895c8bf42443d980845e49967f7f70017d7f0f200000003648a9d8673bcbc9d2dcbe0df79f801079be79b646f9d5bf7371be1ef2965a9f400000000f9b44caf0e5b8dcc29059d40cb90550079ee83b16042b0209ed1d6405fb48f2014d0e6060f782d534849ef7537a591ff2060f8097265ca8c0c3e3ff17554241	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397244655"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2852	2200	iexplore.exe	28
PID 2200 wrote to memory of 2852	2200	iexplore.exe	28
PID 2200 wrote to memory of 2852	2200	iexplore.exe	28
PID 2200 wrote to memory of 2852	2200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\newfile.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728a0993d731ab2f3f15547b16a0cd8b

SHA1
cbdaa01755c2218f6797769c98de66f4d05c4055

SHA256
95cfcda62a6a7cca25728aeba1443069680877286de3116a838828a63dbf44e1

SHA512
e3752fa7c5bea5412edaa5eded749cbd03f6eb812a64db191eb162d87eada1f49d460f21d299864f16e47051dec723ab02c5d0671e49f8fc0eee83bb3d9c0b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366e57f7c7787ead25f92fa6f9b1e1e1

SHA1
23865c1ebd788bf690188195d8c3b0d235170274

SHA256
72aa544db4b53b984ada2330512e4984e9e37a49cf629381b0b74624f79eae4c

SHA512
f85be78f45ae9641828ad9dfef5dc6c3a34682cd5668bf6ab7269dd0d8392882ab4838d0d2a6e914ca5ccd5d24986238488eee731f694f8f95deaefcf3a86f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cb6b2ae8abf6fad1fde571db26ac153

SHA1
30247e5424c6edcca19cf569ca6556fb5027eb8c

SHA256
b625bba931a3938adeb29c331d00bbfdb6e7b31504746eb2daa44ee657fcb33b

SHA512
aefd8b52d8bb6c6b9baf7bc88f1d7c87f86db10bcfdb9ef4857ea561654ca423049c61c9c611bd37b707ccbae82b09ab26379327738f627868b191c6a86071cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e6e7abfa82b33ebe8bc203f01f1a6f2

SHA1
0f29a2a1875f5e04d67661571f7eaf09feaad872

SHA256
68863aa8411c55ee61aa8dde6c89376322221fa199d1dfbc2339dc77c76c4274

SHA512
2e3c62882e221e9139de95bc62e345bccc627d5ad29b7c6e411b08a8689211fdbe9c94c19e5263f0edcd5f7b1dcf5fd3fd63ae4aa491ea2b5addd977cf2b7c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efb9786bf1d51b245a47d0844e620e3d

SHA1
ccd9bcc44a06fba79e90f22f4c42eee6de95b3fb

SHA256
e9b5b52f08da46eed57f3f69a619d1f3c103b44fb587d33e560d2e5368f9b9a0

SHA512
8f2d0b0d7382ffca000fafab62319143c3b48a280fcf4ee7fd3b7665cc493abeaa94ac96fcc00b9f4d3a21601e8686b59dbb31026667ec5cb9ed42042a6af756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86de5f5a7640239acbd30b3b8418f8db

SHA1
cc3abc7842b055f1397bb62fd10eaf901a86feda

SHA256
099bcbb4e94ac0c553dda5e8da85f511512df4965995b38cc21626259fbe8932

SHA512
ffa606d30045bd5bb7898b2b4bdfc739c329d3c744c377a5b82e147adab7927c8506ab7472f32346a90d9cf47ac6baceab4b2fbb0a255b7119fff2cf12abc2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d92a0438baa5aa6f77da5afeb2820296

SHA1
cc44f9806d083a7543d8c83515d16a8afd199092

SHA256
3f90cc001ce408d913c2bd632e2aeb0749fc2fb88a52a9e050bca787051699a6

SHA512
91d8f0f542340f0a9aeef65e185e3c2a19ed3583e736cfe5386b8492d6596014e1c14e0864f0743e268ddf8d8aa24190cc7a7dc222a91fd8078bf8a118139f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481eb491acf5e6174bf8812d06a83a02

SHA1
b73b013e9d044a8f3bc701103346ffd50875fe3f

SHA256
4760b50ae4ab7fc8c827793011b2246634b7f214fe788665456f2377ba22bc44

SHA512
239114801208eff3d4e12fb04fff0a1321a77fb6bb1c86f9d3282e8c430a2416a4f9f44a6901ee9be9158508ecd105cfe855db7f2a3230a7451f5b87575dda42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5dff448346ffe4488e6a3421a86767

SHA1
62ea017a4342601c79abdd623b3b6dc3dd90b84e

SHA256
4b80eca9a5458a546d419dfae12bb8d57bbef9a483f7c18d5b954dc518300749

SHA512
a9052b4aad8a5c3b85ce84ffc951f4fcccf30aeed01b601283981ed835a5dc3060d5b17ec470b0984197aaaae48f626a1ab3eb9c1a2691a893808eba673049e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d02fe870abc3f2a74abe3721f8b586

SHA1
e8b1615bf100df6c68bfe8ec235b5db6c3d14ab5

SHA256
7f520544567a392eefebb5e9ca7754a0c44976d558832cda1e3a1c9c3d8931a0

SHA512
40dc8222116aef58b2aea66114339eca0bd2582ce4e379f3a0848e046ff6208fcda93f76161a9a5bf8824eebbe037b797b7df054b9b1ef34006fbd7314489e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U6AGJ71Z\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9713.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97A4.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TTKZPCQ6.txt

Filesize
608B

MD5
b04b77724ba582b775a0b1368a3e4cc7

SHA1
367dc3540ed3a13566f295c5adda2daea4fe75e6

SHA256
db14aa4cccae274db159fd0bd3383dc5b4eacba9fe4393fc03c6a75187224e19

SHA512
27f99572f9564174ef5a8f08344e834e7c08c47ae6b3c8e20a0a5c0c484fcbf731b4ba478fea3c2ecc2699ac749686b76bd40401afd3e23076461859aa791d17

Download Submit