7c8c7cfef84445c99cc80f2b0cffae136ebfc415a7622038489d0b2d564b92d8

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/08/2023, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

search?view=detailV2&ccid=dllEtyF7&id=5A144BD884D25B7AD613A24BA7A0CD00747645BB&thid=OIP.dllEtyF7V1Tv.html
Size

622KB
MD5

497414c6eb882c35e9ad834be5a809e4
SHA1

7f784f0f37978d9ea2688e9288b6f84c5fbbe796
SHA256

7c8c7cfef84445c99cc80f2b0cffae136ebfc415a7622038489d0b2d564b92d8
SHA512

16f3543eed1c1fbfa5d9f6b7c70c8b727ffc257273c38adc1a81eea51ae8893549e04614cfa39d2d4072188bdc7ba7a542d7dbd92bba64a9206a61824bf2eaf1
SSDEEP

6144:JOQhSXd3admXkhyBpbNDFUDrdh53wnmPfNZohwcqW4WqhuG7XJbrGVXq:nSXd3aSv3MNpXGV6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BCF7501-3DF8-11EE-B454-FEA3F30CF971} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80315e0105d2d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000496f66894e18df4330382ad83535cdc28d0e0bdb9a73b39be943633083ec78f4000000000e8000000002000020000000ab7a9a439f1446991fdce56fc0ddf6b2fd51c2c4e29f3200fa1942c83b274f2c9000000083d8a35c23369b3c9f15b7537aeecb5437ca877426ab99cbee3561275c81cb2a896fb30a2e38f374a9ed5fae1a979d6a1eadb7fa45ea85a030679f24f65fbcd4deab107ae98d9e2c61c80c021b9d694cd4c0fd7c372eb91162191c82a5426dff75c10147c03223e5358be5b391ae95b81d5af9aba972751899511594c5a5671645ec0bf76374b8dd7dd7cad47569e1804000000059b7ab4c84532bb6610cfe5ef657e3b8d39c959d3d33a2321165c268433511a3706c5ea49d82bb1dd2cca1cd8d2d0ed92c6df1c3fd4b658c9fcea85e3e6b7de8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000a139a8cf39959c2fecac08c11f838bea62fe7629a74db110b18e41d09a6bf695000000000e8000000002000020000000b709ac010e53c1d1afb816f183b6d6d14ef8d6fe58db768a79d6e6d7b277231d2000000082547623bfc3aa0d6278049b952e2015e62da9d1961493e8ee43a9c9242531c640000000596c492facd7601c40e91eca2a441a58ad8d8e62ad20578a20a4e87c3cdbe1b10c527ac7f0a1dc28578593a4618e2d470b144e15b107124d28e969bc7490ae8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398546532"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1980	2640	iexplore.exe	28
PID 2640 wrote to memory of 1980	2640	iexplore.exe	28
PID 2640 wrote to memory of 1980	2640	iexplore.exe	28
PID 2640 wrote to memory of 1980	2640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\search_view=detailV2&ccid=dllEtyF7&id=5A144BD884D25B7AD613A24BA7A0CD00747645BB&thid=OIP.dllEtyF7V1Tv.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
95c220a131f519cebaea7f0ae5d6753e

SHA1
862b3599b4c44c412346238c445bf020f34eb429

SHA256
0c17acee8f10fa13ee58c5e3aa4ee6feb7800108cab2bf0b7129b27f6215a9f1

SHA512
90f15a933fc8a023305436cbdcbf921d5892b8ef983325d9257393db8d6564055e4bed21a769fd7307a8488ab5aa5556063df018365ebe50d6b4a88132c0c5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7be55d1d96cbd41b6b8bf62a12cc0d60

SHA1
3d3c7f924293bd89b109fe42185a908e8c24e469

SHA256
d3b2bc0076b444fe039ea4a9c52ae4f9d50b4059edfa29da46ebb3defe6f41f6

SHA512
b70f531ca32ac005d89dc40ee5fead3fee31c65f698fbecc2d5ca54841784beed5399b91e74e517c4d0741f15dfe39ead9c8d52b239126915f32afae6c27eda5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d3bbd8f960c6c0e803d2aa82c474a05

SHA1
e11ea9371321d82ddab337c5bd7693df6a5db812

SHA256
f5d7972cb05319e7fd58bfd946a045d030603883c912dbe9afc16e9856557f80

SHA512
cd199192c1408833db0811ee5c65bb875f78ae50fbe2bf41be831ff891fa97f6be09cbc9f8ca5af6493badfdfb5c1b1d8787f5a64c15e00dc666e8745c06e3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b86493c253ddc2d69265c67a076da15

SHA1
bfd34f289a55ab3a6c177838954b4985d705fbd9

SHA256
e0855e1a535285a70b22487358c63a462cae153a55bc7521cf5dda1910e288ec

SHA512
61013b50731391a6048b911c7986872d8553a2ae5a8a0435ad029d12a51cf24d0b4a36f54ca95a70ada9a8134fa73f01cc3ee18a911e88ea9470a4a09b459184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5345fc3cdef15285114ea12cd1c6fc13

SHA1
729b1c7dcaaa7c8adff66b58813c1b82c46582dc

SHA256
e219164b23d0f9a3a9a70f819efd764bc4c185d84ad8c7562a8cce73ac5fde50

SHA512
04efefeca31a7074b919196feb509fccfb7279b59cf6434f37370a1c878f53da1ce4093ae6dd56409c29fcf1ea0d0927f55d6ebb3d5d1816dcbed877ece800da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de27a8d1e33aa30f28a0ba3075c4d31

SHA1
7877275d10145483d05356b8ff668c208cb15093

SHA256
9dafe993ba44e77b5deb1f39b6f6d90b6b1194d161168fcabe86c4554d802703

SHA512
5087d9b886efb39ca985a965cfc49e274140038ba534b731c4b42111029b362c98cbd753f0d5af7ad4e77f523dceb182f79ff4afac6b4943dc2ce0a5570c48b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17732f2f4ec545fc23cb8d97d8668f68

SHA1
18f5d1f390d10e1d044bf2318e9be150059c3599

SHA256
8149eccb3100d73836cbc559cc07e10e1137e65e102a8663ee42818283d0d5a1

SHA512
9a435b577652d32aa4da99335bd761a7aad009738fc8e24db41e6171d6dbf02badad4c0828613cb5c07cbe80ddcd8a1aa97bc6890f9a191fb7da00861875ed55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f15eac0faf166b845fd9c9b09b67451

SHA1
27ac95ae2bb422abc5d004ef12268fd1d554e222

SHA256
f448e8e51131b7ba8d0b99ff99a5f3e28b7106b4f8bc55acc36fcde9decafe63

SHA512
88445810efb567a72e2aea2aadfea150fd1ac0a9493063cdffece8c114ed69cf6c8002c3148c1d8ea7679fde43584d130b14919431adef22a11eb1860e584418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e27ba2022ff462c2704f9df7f3fbca74

SHA1
1cf52566400fcae8369480455c97283c9dad74ca

SHA256
e34b9d2f3fe72843e808c29c96ad851b57de580caab95f4b87530620910ae1c5

SHA512
49d18c2c90c8ac18a276aed269d72a3817178c79199aa614d52710ef12e5cc826a11b73713170f2b965dcebffd5e36711e5b3c9b504d1abeddf3558ba1f96349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8e4a7e1195e817d35d3a5ad9136421

SHA1
5fadffbabd7e3f17ba526972a0b5d8b648a560d5

SHA256
103fba73180b67ec24a1537c5f944420350e02b8b3cb7227813af51424051909

SHA512
07d56228c3cc1f56603b4bc5f2be8154fb845709af18f222be6ed2ce3e6b5b0a50881557c311716ddca77813b8cdb9d4959d13bdf935b90dae8fbd267ed6c1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
235f2c2dd2477edbd7541faabfbfbeca

SHA1
f995ba639c0a73eff6630273142cdf6cc4645786

SHA256
f976a362db26f6c9f4f8cad64f203a9b70075ecb8cd7027304ce500f6e9dde09

SHA512
1f20669226ffdd6b4078dd72333092bc63ab44a636036d385481f8976af888975704b861c27d2865727e5ffde2dbdecde91e725ca373f48a7619820c4a9510d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ef53a96555b4f802c853ab23587e79d0

SHA1
018a8ed71f4900e282d5db68ecb5d70c607e22df

SHA256
68e4696f0bfe38d2bf0d6ee6c0a031408a973d558acbd720b201a9b29efeae88

SHA512
4d38fdb929756324e0955f09255c2d3f5cd44642a25cc675a706579a28817ccdeb822d9e6a3837aa1c2123c23abda89c76eeaedffe83d17582df80bec6f66af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab761C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DC1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit