b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

insert_related_news_7_24.html
Size

1KB
MD5

0c1a62a2b5d7c686bfeebcca26872936
SHA1

4a72cf894efe43bb952e84d47c584c1651872a39
SHA256

0f87fb7dc83cf5dad0e8a68a548a98e26c9ced4698c5c4b18e4a8d3e963f30d4
SHA512

c8fffc77a0ceb510cf2b31e3d2712375170712283ce1f519139f622e2da3221676c3e61b8f29bdaeebd41a5aff75c1d63265433fdc27bfda7c4e6f0e187ae882

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000002caef28e2b8607c17f16c41e7af6a3315bff5cabc42ca75cc965a8a6c61bfaeb000000000e80000000020000200000003cf4f096e86b1d24a99bf9c0e6e75a11e8e29dc4444606cc8fc86085072079a590000000f05813e8dd24a963d8e7eae25231065a413b3577a8614d77ae42ade7fe093193341dfb0289370f1e38ecd16eaa07bc0924cc6553539d65355ac1a871da2f28be9a32a1e663332e198d9207187834985d6860dafd03c5b60a6c7e5b4a2199437da3ba5ca065bb4f0945d749837986b4e26758fa60c3f7cf750f30e4545c16e82701dec2fe82c25632e0bd40a48303163840000000a1952adb4904b55b35e9c2d2784f4842274eb167271bafe7fd26f4729ccbc9e7972e6d7412e03105130fb5e253bf7bc2611caa9fe6d2c1ea7b5d8e08c5d983ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398298713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000009c4a3934a47e3ae2dac7df10ed3dde4f42aba14acd648410680526497f2902f9000000000e80000000020000200000007141c4bda2eae920a469a0d8ec77d76c10c890248518f613e1a0253ac0e9fbc5200000003ae86d4b2ae4040db12e633d5dd8d787192592687c138757fe6d833e3f3f5b6940000000b6f10b1f7ba9f723c98536bd5a1f038f0d17c2e115cd8a34e8cb3e6a2b211c3af575ca33d1fb57589c604c12734ac8909b7b0dfd4094edfa2e80fb17742d6147	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DC10B01-3BB7-11EE-962D-EE35A7B3029D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cd7f02c4cfd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2208	2228	iexplore.exe	28
PID 2228 wrote to memory of 2208	2228	iexplore.exe	28
PID 2228 wrote to memory of 2208	2228	iexplore.exe	28
PID 2228 wrote to memory of 2208	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\insert_related_news_7_24.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d30e4f9b59715ede604c9c2c1e0ea9

SHA1
f4f7e8f5ce85d2e685613eb18800bcec68d7aee1

SHA256
7293443587631c926cb4a6e6038c4dbcfbd8bb53cf6220684df234c693a6dab4

SHA512
e87b7f539ccc4eeaad4848437b00a88c94fa68bd42780124225f419c4466d160d457e59288857ab2bcd85bebe0a95f6e77c495f46a211a626810bb837cd3f2ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3529fdc4da9cf086ba1d193f1f40b6b

SHA1
57fc4c3a1ba7630ee9bf6f62f2b272923a1f7d69

SHA256
2624c46a07fe88a9ee2d95ec9148db4b64747124e3319dd43c3ff7396eb456a7

SHA512
e243221e76b5ec0545f1a9c207a95fb0dcb31f6883540d7046e1c4f56ba17d2194cd11ce06d31b2def505158832914bfeac8d2a348a5b29e0b5ea6af68e1251b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e7487fb6b59c3e94a9ebd53aec6bce

SHA1
26a6f26bedc103ec080cdf787fb924ba6a2a2996

SHA256
4fac6dee5a7cdf19df77b4297dbedc24bbbadd49d61588f8438f1f5d9af2bc13

SHA512
a72b201885ff9ea10c7ffbd310fdb1e6fbda1d5126926162da892806825db538750bd7b3c34ca18ccdf4fbd69e42c857751e3094b6b41f863594b3ddc64d59c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c204539a33ebcd1e09531bec13bc28ee

SHA1
106439b7c93cb06353f109c663bd60873cc8a34f

SHA256
31efd13311e569a727ab8a144e75e66df79243a7604a0683006c2e6bca7c4117

SHA512
9357f300d37ab762681faffd7b510492c6bb0eabaabc6d9a69e83753b78203803b0466a71d33d40e38002fe03caec1e048143a216552495fc15a01382c93748d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec1cb2cda4c1723246922b1178ded1bd

SHA1
184b4ac5d143de34840d08862fa5e6841fb19a9c

SHA256
4d0883121301a683bea58d0fcf728221df4e8ee3f101f62890559eb0594bc9c4

SHA512
e946d5c805f0008258e76e0a4d236d233990ea34c623f9c362c48a433b30990307c57379048ba56c396b3dcce36201b10f1dab9ed3b7f0d73307be31edd40e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d72f251795616c48049b1b7ed09182ee

SHA1
6eeb3f6cf461367976374bf274f268d40c81694d

SHA256
23fee59c21b57a6ad4afb84b0bad40e4218a334c7c217eef29ec869772855a70

SHA512
dbed67f062be7094f9d8667b44ad4d92a7a161e6e30875c58147415065205b67806cf710137935e93ec91aa81f9114b2f9cbc4011b32071af06d47e9e89efa12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892b7008f214529638055f31e0a1f88c

SHA1
f21e7a85aaed0d4648cf028d48f336236fe2f534

SHA256
3ebcfa87880448fff02239257c6ef9537fbffd4ae41707fad185c8ca25e49649

SHA512
0597937b370ae37b3d64cd23ca45fbaa0ff7225d9a5a28fe6ee8a977268d88da867346f964d0e0ef81edaf8d06a694561f9f7f1f670d632d10032a163987946c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de9b70ab0059fe821f3b73385aa7c6d

SHA1
67273ac6b5cdf03ef307ef133491f4b4cf921752

SHA256
d1ce2d37df56090afd98de5efe3d459347cbd00a31988859a77eb933ed3d6cb1

SHA512
36998a50f9ebd02d4801bda3c8457a272695dbcdfc9373ace48c076afa04ce756894477a4001446444f6711e6a68288061bb4e0a6ff129b91322817e97014c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55afbd451c1d97ee9b7100188919dceb

SHA1
a0993af9251d59433154dbb1f65a7008ca12f014

SHA256
703836f9859e63157a180e9d62b9801c8f4fd4d5c7f0b0a43bb8bcdfd41c37f9

SHA512
52d8a8927ed3ff21bd706a344e31f896fe2911a67268ac5a86be2acef296204fdd903cd47f2ec6fd6f6dd5843a6320ce49a5cecc7928d653e7227b862951bf90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ecdaa097254ba5b1a3d71fdc079d47f

SHA1
1ad8f56ca33da22b70e28809b39fed7f01b44a4a

SHA256
9b0bf047c05f4e8f53c7d36e725d16f7196d3832126651423f66cf964041aeed

SHA512
bcb19801889eba88d923e28a89f2723ebd455ada95fce98e6d15567e2584e307a5f60d120ba336d47afca6df16ca5f7fac90553527f5ffd83290dc3ffca15154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
098f3565d0091eec0daa55562d04491c

SHA1
e57532932c724cdbc698c504017e4268e9fd5f17

SHA256
dc8efb8a1d7167c1a6706f4c13f4ace5a20b27f6eace60ae3f628c6fd682cb76

SHA512
dc6bbc9d779af2ffab37cead5db28b0509a604a9f21366e83961a4feeecd3334aca932a104e6b601b2bc9207c3c04d7a86c3a9392c738a51db9233203c74eea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ec6f004fa304f5ac180fd82c877348

SHA1
a64d1abdc263a46c3249c6a2deecd19638ce6216

SHA256
231ef158c6bb5e75c8a494840305621bc19a031ad6161df5be4795203c9cdfab

SHA512
ca59304cad76dc220dfddecd8a8e76673a3784f8c083e19e210e04c7b09b3613173931f5c8719bef9ff19a618512c2626529e5d0ab1617fb5d71deaeac8e6704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00c372266a4348682f427c4d2b661dd3

SHA1
c86143b19281d6e13005d12c6afeef5dd750ba2b

SHA256
49673fd922efebfbfa345da51cf22f90d060edb9050d0c2564d1b76c624a61cf

SHA512
5aa437c8bd2fdc6d8ea69559285c976deeca3d16263ef300966e554d2fad89b367ee9141b2d248d92cee466655b8b5804ea740ced13bc78034d9babaab8524fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB76.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC05.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit