38658ac74d5516bb56c20c604b95306dab9fc707c5662501225a8a6c18e3d7b8

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad.html
Size

15KB
MD5

52c368fc009579446f8dc67daf8dca87
SHA1

fc52b078a9a02847efbf85d10f41b961c85fa459
SHA256

9b6cfb0e52c7f7dc99d5f5b7e2a6142fa3ad82d1333f42877eed3d29b0561579
SHA512

c80bcefe98c2eab09d4a831e788cd50563c62333d4c8aa81046df2acc9888c5a87da45546c1ee7d40bc7a9d7148075e3029e09e4b086406f6143a589111d1cb8
SSDEEP

192:xMejgzfCtmdyPfojYA5D5zniVkG4zhxm45IqTbTD5qRSwpcPt6FLYFieRO6shWUh:flqiO5RrD5qBpWt6FAieRahW6X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07e76eb6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16D49B21-3561-11EE-BCF2-E23FD76D3CC4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a22a338580237a41854e14f99e3728a5bb1cb668986c549012460ae754819286000000000e8000000002000020000000f2320d83a0d99bca0b7602258a6805058aa6fe966d6da66f9cffe2f7f7c7a66a9000000062fef6a52f69567bda16e2cfe68d3725972b6e2094908e99502d8660c2e4fa664484bda50ceeba57b653de9961eceb5b25b0c7dd6ff57f994ae2f4e1af464b053725280a6bf17aab40ec0663327acf8085f9a90425e2a47bfa7fbf56eb5b54f9a8395cd6eb613d988570c97255a769900b411206619dd98b0986775cfb3d6b4607d51325920496d1e0b352d0d7fa52a340000000cb57fd3bc82c642e71eed2b44d17ad795332b2db8dcf15fd88431c924676773ce3e2c09a7c578e2d1bbb5287a6aa7c3004e794941293d44e89ac8a210d58f563	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a43a8acc68fa7f403a5a8c7a3e311cdb34dccae05271b93f4b2366ac5e0986fb000000000e8000000002000020000000390325aa939e588b9f7492e811840853fd6cdc304e4d710418d9aec876ecee0e20000000d0cc5cc759a6f482b2aa402ce63a56d072dddfdf1964e941bba1eb1a77e9c8a7400000000efee66c5615e90a0a61e9b5b40060732fa592cd2072bb566b36af04a1503a41307daea58a1c3c5c99ed8fe0ca9a3220f6df694f082f672257c708468bb37547	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602032"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
2648	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2648 wrote to memory of 2416	2648	iexplore.exe	28
PID 2648 wrote to memory of 2416	2648	iexplore.exe	28
PID 2648 wrote to memory of 2416	2648	iexplore.exe	28
PID 2648 wrote to memory of 2416	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac75701631897a5c525af1ee82d18fd

SHA1
cdf2e46936638757cff07a30646d9e1f48360f13

SHA256
3517b418f91264acdbb827b804d3c8da604743c0cdcb47c883cbe959eb330304

SHA512
4c7933ec22d504fdcc9a55d662c4ae24f49fe415e48d28cccce519346b1a9ddadac25b99b269b091f04e0312a46e4998148466b7a8aefc9864002c92cad44ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843b85b2f3ad98dd5e1ec7f293a1d88e

SHA1
5c93fb25fa8d1ebe769cd35dead57df5e6668e2a

SHA256
6629f93978a3e8beab477112a14d805b6d60bff8fff44747901ad1896a429b76

SHA512
815bedd248beae29aae9e88880f1660a53f86f3cf8d2e91a21a86ea4bfafdf4bfd55841c4b79acc2e35e554a8cdae056545ccc2dd19552df66e2128a2cd77273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776b81753578b68f78e9056b1f32d2c0

SHA1
85248fb866f5b9772fa3180cdd8cf2ec5e717dd7

SHA256
1be3f08f0f32f386400911b2683688fa2f7b9c8164badd4a9b357c569a700289

SHA512
2f4b2b4e907dcb5968b6d31ff98a24ccca9b73e87fcbb29d9506f858d0c43d3787afe043b71753d645448067c93171bc013c506ddc4a565d5c831956f6d9c3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a09b4b5a00d70ef82dc3110a5c3400

SHA1
1380f26daec917aa4408311f701a7e5868f16726

SHA256
a301bac1a9593653c3459dd8785764c9350a72605111ec8ba70256bc482c20a3

SHA512
05aa33532f791b01058112fe9ba0cddebc9ee4fc1a9f8144f5e1bce1261772e98604d9551bb296e4b549f593b1abb40c5d1c988c04f8e87f1adf344e0f277fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ab32d52e21c0553ea311a0be39f561

SHA1
a0eba99e13495704398e8ded420f0beedfe65bb5

SHA256
7ddb69c86c96dc1303cbb85b848a2f3f2d8d88d1486d5aacca579a6cc435e19a

SHA512
ab9aabf97556e989d484a16d44c5c8ae020c01c88f9f16e46b8d494b4a5977dabdd4d44c3ff36ae2aab56cb49ce294d05a73cec4f85d2aa038ae78c8c4de297d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54744186607a170d4a2749fabb7accb5

SHA1
43b63fd86c40aeca05deef7a3ad9598e8ef02baa

SHA256
d77d45ba91ab93ed27679c69b11d38356815fb14318ea65ca189d55478a9aff6

SHA512
ee64bf69051a35b46ea93d9cd0a6d24238ff9719a00c93e10a605169df0a6370e5e45d9b2c1eb0fd6da59c013f7726f7c800699238da7a7e8424a0f65b1eb59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b7a9da5bf947751a779248b055f919

SHA1
d6dd52d98b05634b0dc7ed410e39cb21ef30cc5b

SHA256
b3554e729fd8d616a0d46a9848bd8b3e64f114de64934729cf3ad5cf4b820671

SHA512
eb6b4dd734c7357cbaeaca14be5dd1432fb7415f39537f532ad492947c609ee79629cdb4231a99424bb839b1c78acc81f0bf4662de13c33141d4c374f4979bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c9ad9be04869cbe6c405d498e5eed28

SHA1
bb10a427b83b550033f38ec068d08da5881281cf

SHA256
6973650927bc1c1a0f339c7960b96e42ad37dcd68bb4f025c3ea487ea685c57c

SHA512
43975535d8455ea2f5ae5fe7b028138a41507fe00309dddb6f580450d5cc63b412c4f02f5e656bc430f14dc23eaffd47e6f72e8be4f922624154a323b8a8f7a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4881fa687350be5ed4e17b7a47325a73

SHA1
5a5be1580e461d6acfba23178c9dc08cd4172165

SHA256
c4719f75efde95deefe8513380981f08b25037b1347f0e7412dd3282848f2983

SHA512
8fc164bd81161add142c74006adab88f927d132fb3230387a003164e93f88f7455d709e833c9a025dbf49a7af7c6c22556e65eb7f1a451526109b0e018e57ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6bf09fd5b9fc2f6ba44e25cb887a39e

SHA1
ce9586af7f29cc0962dcbd881fe6cee153facb2d

SHA256
d30b829da68e76913e70902433a01c4e66a05f700182c2275853249182f327ee

SHA512
8d93c3d6c4bddfa8fe8de1141c845514e7bc521a3b8fb765f37aa3b5ee98016bba8709188a35cf1d2b6ae63fff411d3b1ec03f0938f7a90b4def4f7d5a70b374

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9032.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9054.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit