b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

common_tts.html
Size

1KB
MD5

7e98d7921e811ee53ec1179874105aca
SHA1

6c4cabf5b23b93383de4813591773f9c8c00cda0
SHA256

50b8b9cabb77459f015aedb99bbea5b314e809f3c9d8539ffc46a6d1c2d989f4
SHA512

bd10d1341715e5e32808489ed65b2ffba3ca24d770a335a6c9f58c74e9d0fcbfd673b46b4b8d90666091f585eb248ef8a4b79c87f7a2da40bb38355d574ac00b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398298720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000154f5efb2e43405fa581a45aad8519712809322bde5744b07bed135a439e5103000000000e800000000200002000000051ddfcc869a7f8c3a0e37080c4238fce37070f3f0dd8b43fbd3a859a190684a22000000020efeb0c47e6dbdbca5ea801ae22c99ed44d4ae3bede88b513c8c007a830dbd840000000a836a0653390a502ff01546b0532f68e038390db8a5c1273312c2ede0053c9ceeaf4837e6c8c4efd90236f7df84bd1a6b788640595023c7252598999791a4acf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32DF3171-3BB7-11EE-9B93-E23FD76D3CC4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000003adfd1fdbd6cc631e5da07310532cfde9740c366871967120fb0d44809cdb7d6000000000e800000000200002000000065bea3db45c84b0904de5051520d2b9dabbcbc0dd4d760e7359921e911d7a7bc90000000a3369023e6da3e0516d1bce6650d9d506c9e92075a857648635633a0137dd6e947e472f91e6f56dc014700540c11bd933a80fb90b98786969150be96b47bf15568cd94b940a050633a770795838a6add17d167cbe15768524224c83d0050770c854b61223cc63b032639c050ec4639482e7ba05048f4c0ea72a9010c0f20933e30a2584ad5eceb8718676153432feb57400000007f6de87ae1ce41e2b01cbc5096482ed5d757046070ee5c01317f35089dcc1635db4b6268f8e205bb36eedf4f6a2120a424c162e1fa37dcb24607da520aa7edd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30359707c4cfd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2256	1980	iexplore.exe	28
PID 1980 wrote to memory of 2256	1980	iexplore.exe	28
PID 1980 wrote to memory of 2256	1980	iexplore.exe	28
PID 1980 wrote to memory of 2256	1980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\common_tts.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cbc9f9039a8a75d6b3eef860ad62f28

SHA1
c4934f098ef28704272ef1f33ab520ed26af31e9

SHA256
b86aa775d6bfc7d7f06c5398da4936f22cd21724bd8c18a7ea15a2baa2c541d2

SHA512
8fc06686dacf755e55987089591f725d536e80234b18a88e6ac7a3039cc151e0b686f8d8f87b5bf6a43d62f6dada4be228f009ef3f5cef956c5f6e80751c5bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55b6c2f5d8db0319093681a14403b3d

SHA1
cd68bac4b0c46d22be4c6d14e5f64157ae87f85b

SHA256
30d7c971f7d4ce9ca2e43f870cf37a01bc4c762661f9465191756b1ee52a1cc4

SHA512
cfba88dd795e70bd62face0d2306b7b6bd322807d245e386c8218d5222be251edc95b8503e069cf8ad649b75a6fab83525bb253a00eb63a4bb3ad4af7ce60d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39beff66799784a18dfc32e3741d911

SHA1
a90513e18ea53f1b8a24d7b7798a65f02717131c

SHA256
8444213c03ef79d2182f0e417ccc03fa4446c92b03b8c2f365dd2864f11a78b6

SHA512
7738a776b2a86e12f5d00129a34e8c0310f243ff4db0d79a19e3a36eaacb83a1c063104da0cde2a53ed62ede7d0cdd24a0dd92736d6f547bb8858ce2c6c676fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e950a2419ee08e257bda3d9be491fbe

SHA1
fd8c04dcd1585fe74dca4c62ee068a8c3bacbda7

SHA256
6e76e00686dbb5c2c825d826a297e46c754679055223860318ebaf1ef4303d9e

SHA512
af26823d36a4ae7b4b4704d23b060158227069dfa4ae6b2e46d7af58d8cea68ce840e8ebe48b0720fedce3c61486540585ca265c27cf89e694f2edabae81cbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f35752148deb4a5407fc1847657c37

SHA1
a1e8de097b0e0c2d9ae0a1465ed0ae59568a837d

SHA256
53cfe0a2be4acbb3900975f69b3166eeb118ea3f6572eaf6aa87a25abec5a8d6

SHA512
f9e9faf1097764ec673cfbe5e2913c30797b19c5bf5c9845647855de4142e15c7ce2266a398eb8e273bdd541a5c41afdf464834e8dc44db87003b90aa5ee1168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7672b03f6c8bea26c5edf8354b8d9f1

SHA1
ecaa8f1ac2d54de9b1a1c292bf46b9209c1c95fc

SHA256
13c6b1713844f8c852c8ce6727d72595fc4e76c3703d57fe1484b52a6e7a2d1f

SHA512
b85d39e9cf79e5bac1f62bf539083756b1d7499d9fee72133701cb4e3e59b6826617e54d120a722e503a6d462bf45be193b7de31169f8aa1e41b87deb6e05254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c165278e99d0c5053c70ca3b732d29c3

SHA1
6edcefe29c98024cf9ddc2ae76cff4e8c23d77af

SHA256
2f1030e5f09778a2cf33c7b3c82e26b9b635109c3214712e7615187a030f0e6b

SHA512
fa567d9855dbb2f65d4f0fa0a0f0220be99f2a404bbcef983db636198c7cc61edb3fe32c5e6549302d96cea9041e86ce686f8e25d9f0a2f40a5506eaaa482690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
529d26ed921b5c1e9a00055c2eafff82

SHA1
6b2c60b2071a8a0cea06fe52dab663467433c0b4

SHA256
8a005ee1eb3a118e931a045cffc6022d765c45345a3753f4ebfe6b5da2791632

SHA512
8a07a76f9c32bff5c03003e9b14611ceca4e6df0e3fcc22dc1eb06606349c62c09bee9b49e395bbfe5bd50b794fae7a3053f4aba0c1d95a929b7aefde7665fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f8a576d2242fdde70b62aeaf465806

SHA1
6133ea800ce10d3bbe2ab6ad5f0fecca6efd2a74

SHA256
c92cecf9566d2dd962786ba0908ccc899a931bc4505bb775cae2dd69ff4a737f

SHA512
0af90bade7077dabaac55d13792a6ad736754bf9fd372a14894c36b6497968808d2107f814989cd6173cbd41443f048ae04db04fd38a2412bd1ea8f8fd4de878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe60e0720a780d6ed6e72640303819c5

SHA1
dc0aa32c0d2469dca0e0115a4d721cb0e90ba81a

SHA256
a701ac1687e256773faf1fced1188bddae0b635f86297ac0ce62005b30b487b7

SHA512
0c9c466564046533095e45ff1ef21413f0b094210d405d0aa508a8ce042ac3f26548b714a78d900236bcfe660e05f7253f3894665831df37a5e86809cef7ab64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da38051cb6ec0934e3dc79ccbb4bd1e

SHA1
3538ef8cec6830ea7e2a416bfb98aaee7d30112d

SHA256
08eb834e2ba21132d82511f23fe094f9e2455a40358318d5fdc3e3bf266605bf

SHA512
f6e1c33745dc5f2964935ef7ee5ac8f1c185104880e49a750ed3be2715f3bae8f2b3f855ea976fb616af86c230a4048df39f19df221fe145ae9e913741bf9eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cea218bceb189ffb481432cd17268bc

SHA1
86afe56f20b5b925b1801773a96feb8b09d34ca5

SHA256
fac42062290a5aedac857b3458ca8a80d2911396c2313219a0777d8991d960b0

SHA512
92d7a47dfb75633c73ce16133d692911910644490450163c1498ccb88d5db38eaf3c46b3c479785a0a81af3eea9cb5ca25e842cbc903aa5a34af2e27f3a9bc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9E9.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA3A.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit