b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

calendar_detail_meeting.html
Size

2KB
MD5

0b874df43f5a88b4d427dfafd3048803
SHA1

68ebaedca89485f8f21e2a235f243844715492ee
SHA256

3c5c9ebed27cd3a436dae457f42ef4d581e9443362d6dfb4780bc8b2bd39a251
SHA512

9973727e4973eeeceab1bf37eef9283aadd0e3d409deff9fbcdcbd4071d30face61c9954c1d2cfbdde54972a7e0ad8875f4b3e16e1e94cfb7c60a687b49a36a4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb00000000020000000000106600000001000020000000497e5e92a8cec21d7f40ba5669ac5a9ab4869f65e1146e4a2331870257c6322d000000000e8000000002000020000000fd3b4a7f198862aedff30aa0815d9805511a06cae5eac6a50c002e95e7c0fd60200000004d2beec5bb65eb7adb73aae2af3bf5c57408881db377ba69652ac80cb8cbea3440000000160258339bc44708175aa94149a82bbb549deac8613c150191dd64590c2279f2510197a48727301a820277845dfeca4ebf8a32af0b9872fa4c81f732289fbbd7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000006dac3fd06e049692c118fdf0c7500ee365da9e2d6e7db89aaeca5fada2bc2e01000000000e8000000002000020000000fca85224342a84398f4a9e1b117f1994b6f352ebd1e1359628a86b19c08c3d58900000005ffe7fef2f53395ab9bfbf14b4fb6077261a129e1b03d2e03d6f4f751b063bd72d58b47ecc5340560f877b5fdc8effac050717c44707e9582091aba0e9e8ff3602d11938c940f0f04dd9b2dc16aa0501ad771af2e429fb97c8e5bfcbadf3a79ad9461ce35533030a9b62da551c51618900f8dc859ecfe8ff6685e4a2a98c6c0b50e7506480e2b092d8489e1ccbc518a1400000009680c193696cbd665e4dfd65eea3120e25a3591ef40eb38a3807e3efab992ef8b69d9574d735df9b02d53f4d08c43f04f6d48dc34959dcf161c35fc1d2f2539c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bc1702c4cfd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398298708"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C5CF6C1-3BB7-11EE-979C-F2F391FB7C16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1132	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1132	iexplore.exe
1132	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2660	1132	iexplore.exe	28
PID 1132 wrote to memory of 2660	1132	iexplore.exe	28
PID 1132 wrote to memory of 2660	1132	iexplore.exe	28
PID 1132 wrote to memory of 2660	1132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\calendar_detail_meeting.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0716c28435fb26d4af1ff3dd84c4866

SHA1
e66eec67083f59524347bd345a2068ba790a9ccb

SHA256
205a1d70b2a75ab08907c8bb9d10ecbe58c15bcf42f20397fc99d427ae39082d

SHA512
2d4d21cff67634eacdb62f4aa2d52bed9589cd556d2afd918c2fdebcb49a29273851b8d32fba7a5ff0461bc4d3c65bc5e9d745e6d2b60b98664316650ba87e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
536b6a84c5d2bdb4788d63b20a159249

SHA1
b06ca02a04a95edc5925f8383d61b2e95e6aefbd

SHA256
7548fa60b9492f37bf0a38bb6ec23e71d0b9d6e197b0838de5e91f71697da1ae

SHA512
d7c9950a84271cb0fc5f1064fa78a88d9266c543f886f1855e31f409d828eb65015e0ef8c349d17c7357a6875e40b4f481eb4a207bec271dddcc76db3340e267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b91062b77610ba92e10df979249ad75

SHA1
5af7fb57e2d24e20bdaa729b4685493c2e353610

SHA256
0948eab43bbecf0a139b0c84883e6edf5e60bc20c30bb86d4d45bce4e3ebadb4

SHA512
b1111884e7374cbb613b1ef0d47019918254098ec8bfae49594788a0f8aa884201280d50658be2467785d2cf10247de75f1c9cf5b3d9d1032615570e80157b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58cdd37efcec76093c0ecd66c090c43f

SHA1
445e1048745472c83dd34b815b28a62ddd17c383

SHA256
da01e4c21ab883cfabd5bc2bf28bcd5a4e1d0d9aa17804f27675ea019a590ad2

SHA512
61e1a932e27fc5e77e0041e057f1a09a7037baff2548d4db77eff90ab5d5b7b828017469d74bf33efc2147437b1c28f82c5edfb0ab4cb341a80a30e5829b3f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b926d5b47326a844dd7ba3c4cb9a2458

SHA1
d0d9df8872f18da4cf04ac19ae390aebb2b987db

SHA256
b12a65899914bad23ac37f73dfba0a1d11a28e7b0b4a3e0d25d80ce933852569

SHA512
b56b44da39ae1df185144d2a0a0369ff9ac3a536bc73b4489e98ee21b4c19ec7c6c0e3075bdf653e4f2aea1ced086f7ded4f2110f17babdaf37059d761ca1cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0784c7fd08010f72e65b13329bc21d

SHA1
52d976a4782ca7e9ea87ac9415aba06970e20b66

SHA256
430aafc971e55fbd4b9cae71bd1c8dc071b952a66ae3f89a0193f4c6a22bf054

SHA512
33009a6cf249908bd96ca7346ae82d0275f54e8973fe620ef8e3725afce9d8cae6dbf232baec9fb5424e98005c1308c9fe45eca4b77439cbfd4ef9e30277b736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34f7396e137abc7fc4a9446500b16045

SHA1
83690d6bc6f04580d78982fb2ca698f1534ef790

SHA256
5b05256f1e84760a0db8bda5b10bdc8b9ea68b2350c2098cabf1afce3e8f02ac

SHA512
16a3b5ea63f0ef6207cf11fe5129bfe306df29dc6a82c86c4ffcf921501e769fc413280c3540de5745f1db9678daf74e0b58907fad4f8ee4bb0ee355cecf35c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81b32c569beed2a0b39ef41807849a3f

SHA1
b2e797cc4cf7bd80cf6907fc7d1ebb8e94c7be9b

SHA256
2b0a8eda289cfcbd39ad2ad3c6d55f41ca26bf4913247f3b54e196f14a7caba2

SHA512
6ffc304b5c91a4b510a9cf9c6bd6594ca118bb635dd85d7f000c5464ae1e1257a8e18d9cb279b7b5554816c5a5227ff19fdc4ef02d123e3b6c3bfae4ab107707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38ebed5cb8807d2a8acef46159ad646

SHA1
0623ab2dbedd692ac5cecaee49c3f4d6b36bca2f

SHA256
057de363de675e6886deb591ec16563e82c2a946887c312a99138e927f7b5903

SHA512
28ce5f62e976774113b69b4ef6a086aa86916d79e400fa76ed4a4245d303aadd2854498c610d28b9460e1e906c17996f0eb4a3250e89369900257ec3f95d3791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9775246509e5e4ad79b4ef4bb779ec8

SHA1
b86632c236d883976ef4d209ab9afd6963c7bf6b

SHA256
6efa1ad3e1a1c51ea74f8b1d4e5239514d7ec919eedd3caefbea77c86cb822c0

SHA512
109d93b295b9bfefb64bc8094a217c7fcc6e396ca91684a75b8fe713a8d39c051001007721a2ace60b39c71040871f99b31845fec6a9b9ee315806a077e694d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD31.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD92.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit