5dd8a02a0d54e2390aa3a703e8776c94e23eba9128edac3b8a4c41a454abebab

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad.html
Size

15KB
MD5

52c368fc009579446f8dc67daf8dca87
SHA1

fc52b078a9a02847efbf85d10f41b961c85fa459
SHA256

9b6cfb0e52c7f7dc99d5f5b7e2a6142fa3ad82d1333f42877eed3d29b0561579
SHA512

c80bcefe98c2eab09d4a831e788cd50563c62333d4c8aa81046df2acc9888c5a87da45546c1ee7d40bc7a9d7148075e3029e09e4b086406f6143a589111d1cb8
SSDEEP

192:xMejgzfCtmdyPfojYA5D5zniVkG4zhxm45IqTbTD5qRSwpcPt6FLYFieRO6shWUh:flqiO5RrD5qBpWt6FAieRahW6X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000883fa903767aca42c6ea2009bf97c94969f2770d43bd1f49f993654ba092190f000000000e8000000002000020000000e52daf67f68159110496415279ec0cbc351e9439b17534048560a3991eded00e900000000aae4f38fc4b47b1c6d96ee525df21de0d947ce054feeb919b94a0440c752c8e6862afc25924e8d3db9547d0d15d5b7886fcb217d8828ff32065127ff69cf1a42e8ef384aad7e827908f2a33ebc59175bc4c1b9fe1c8a1ebe0bcdbe070da1194396228313221294df4d4420a50cb7df527c40bc82c6d2d310228c38d461869008b2d136c695781f0e1c1a33a7068ec57400000007d287b66d8b50b601bf47ec154c82daf48a614c5ad3789ac9917d7836df851f8e30f11c1ac2fd8e48058e8c5272feeab53e1cc6924afb2bf9b4de74a616f96b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601957"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000007d92905020a1f8659a739ca60402e92f8b0c3957dfe9d800f2ce5a87e631a1b1000000000e8000000002000020000000553c8220a4f1f32020e4f998ae9270ceff3a68d33d00fc29de630e64b98058c2200000002236011beab5098a2d4247c1dcda5f714e5b262a71d5e5b671bf328bde04e38c40000000ba9e22633c35fea5a036385cc77bb6b83b21613c5dc2a5b6c5e987fb4f8616725c5138681c53d2cfd9579320a54e4796ecd5522e881f4efdb8f65d3687141c9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909c5fc06dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBC419B1-3560-11EE-9D56-6E9AB37CAD16} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2800 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2800 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2800 iexplore.exe
2800 iexplore.exe
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE

pid	process
2800	iexplore.exe

pid	process
2800	iexplore.exe

pid	process
2800	iexplore.exe
2800	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2800 wrote to memory of 2484	2800	iexplore.exe	IEXPLORE.EXE
PID 2800 wrote to memory of 2484	2800	iexplore.exe	IEXPLORE.EXE
PID 2800 wrote to memory of 2484	2800	iexplore.exe	IEXPLORE.EXE
PID 2800 wrote to memory of 2484	2800	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9df4ef2c4f2271409c95451e6ecdcb

SHA1
db2493b1ca8f77e267a4cd2fbf5163d36f35754f

SHA256
1570a19705e1dc19a1489224c08d0fa51748c898c3b2b647880e6e14475cdde3

SHA512
9aa516c12f258ee8abd2359c9ac2c7c603b3f40096574cae4552aaa97bdb472830e09bc534819705f184aed933f72c5159a781f24e5c0b3a521447ad1d08814f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6922eb950a52fc667d58eed03fa58864

SHA1
23f2a0d13edf4608f24356ff468ce012c04e10a0

SHA256
e17aa3518a279de0516c5d96645e818b3a21e255cd9455b66b74fbe49ee0265a

SHA512
86548ffb9891d80b63c149b8c2d7cc6eb189de28c531fbbf9347ce6096dc251901f42a88483f3c94fa2b72a3602edb1cad867388ad4bf9f0ffacaa60568275d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1c1b98c55eb5f3741647d1544f1f20

SHA1
77b8f8e5e8e7d7a03f53e7a154e661de59b5a8aa

SHA256
9a1dd6fde2cdcf942e7435f0b6369f9f160639139d679a2051f7907ffea78ffb

SHA512
c60d69a212eec36e665a66dd08a1d273e9c7deab296311e32a201edca9471ad03d12e54b11a948ffc7c6453c68498853fe4654b70116e88e85a576a2e43724e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab9b05e33c63bfcea8fcf1b6ebf3629

SHA1
15cbabd80b7a4e6a3de88c8d87c853fc28ebd98e

SHA256
ec50ec6d36ceda6a0f1b640a66d777a598fe46fd99076261623ea70a1575445d

SHA512
2fc59da3c1eac647a257567d2a6d450df60e33b954e0dff413587ecc003c8a6c267b804ca95d5018e2d136c6a39ad08446f4d60ec5edee335065c3cf6cb587d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2671c1a39e8b1812cc21aac499fe725

SHA1
abd2ba5bbb8d846be5f10088d53b2ac85fd81b4a

SHA256
2476add6092272c90a295780d38b800c83fb5908380caacc9f4627e040a7013c

SHA512
c5365f76857821890191ca9cfd55493091337f0426d8430aa38160faf4d9aa4b1d023fdebf083ff8f149c2cf0e1185276db6cdab43a2f3255907781324e20f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d85ec4c43dcc451e04d8737d427d77fa

SHA1
75e3aa60005935a9673c7f8e33a704a6198fea6e

SHA256
b17b09ff30d25be7c3a07698a8136f273f32ff016a481567c29c02eac6743557

SHA512
44529c5d67a267244eb47e7225eb57b19fa5f997bd1a74c4497aceac2015fd1987229a8f279acafcd7403dfdeb2a0beee9ca618a8dc9f669bfafe28544096488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18a8c29722b008def852555105ccf6a

SHA1
be87ed5db60c59b784a3408ca15d17831752e0a7

SHA256
dba492acec308de9c53d97abf12ab55a2e8b106f8e7ca205477166828edf2d34

SHA512
4e34434a064ec8beb10c0ee9e38708d7de7c13700fea61516b25038f7366ed87b4cd27e16750a875f6e077465384bf3dc4b70dbe2df2b918a810b6853db94c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345e50d20ae03658134bd192692681ca

SHA1
e381f54429342de2cdd9d0f688694087fb234188

SHA256
93b9bfd349fe0489a94d2a1815343f64f64d74bba8aa0ee49875a2b2984dba08

SHA512
df9a5447d591067a8be5542860756a31e54a9d10f61b9a53232cf35bff67dbe859aca10b335b46f6867f7f98a4a351b3aef7a63cc9b7da7a848c8772b77697b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ecdc9bf2ccb35694f3b50a002845e0

SHA1
e2ec90ad6fd48ddbf701a17fce7194bd6918d767

SHA256
6c34e20111966c80c50b9ba8c72020ceb07c8e21d464d1750d2246eaf71b7be8

SHA512
72aa700caad3414b6c947e7243e8fccbc9e4a2214c524b30d2c37be54ef2c51469b746e6769ff77391a975cb5cbb18f461bace227d0b457f8ecb9a7e2ec4c314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6800e2cf31abf63ccc18c02a5f107b88

SHA1
627f123a0083a0733c20bcf76767f5915f76c920

SHA256
d6f7a37ab47f3df74b1e5f97822f86fff7bb829f54079a5f04bdd5259793b46a

SHA512
32eef8df49ab6d3cdee6aa2e3a3c344f72fbade65e9f1f1d5729fe8a566c75da72aa3af08d7713a80aab2ad7330f1207f912f30e76e00bdef91c683427a8b8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96b2d0ebefc992bd29a70ef76410f75

SHA1
851f59734ff77c54b4f06e76cca3afdacb7f17a2

SHA256
2f5b3d10253356c579b8a656fd7a288d8dac2da1869abd555d64b47b3ba65673

SHA512
da27028622d84e1cd759cd4f7fea854f76317290ae5ec6c22751c229dbaa51755d89cea5b36d7c15241cbc36791be05db86a8919e8fe0f58eae2a48ddf410a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e35bbd1123f0253ed36ecfab56b927f

SHA1
eeb4c4108b8e09fc13e4558de28fdd075eb267a7

SHA256
61fb047222aecb32f7ea82c6d120f109f58eeb6e7b2f1347ecfc8bcd2b91ccdd

SHA512
97176172ed2f7b189d9eeb3a2a2f87c7bac1bb1ba189854e27187b704b8216efebec9fffa35d4160016f4cebb8bf50e363c3a79a17bbc9a0581ab38255afcb6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90DB.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar914D.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit