7b0469e1a88bee39676c1c1668ea0c52403cc5eb452072a5444a620f31d35dcd

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-08-2023 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

thirdparty.html
Size

2KB
MD5

7a3ee506a56d3c734920b92d51f08718
SHA1

0e0f180fc9e80c38ed513afb28a4a5a2c064e9b6
SHA256

f6cdb6ae4e22e47ac1b4fc7ff45ac20ce80241c8c64b0d8d345f6fc8c135a904
SHA512

84a8646bd64aee2008639a76c2bef928ac82248c01dfc74657d4c8aabc0d0921efd8d78af82786e5c0b004dbf654e1718627bc9bd4f36e70a0997218d689877f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53820DB1-4055-11EE-9806-F2F391FB7C16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b0210000000002000000000010660000000100002000000073dec58b37649438cf60f8c62ad63e3756499842989258b401465679e83bd9c9000000000e8000000002000020000000463a5f576879d265814125b1238d03f9359ecd56fdfaedf6a0f1ae5c8114ec12900000003a6a1d80e828db3da4fdb961dccd354aececd2e925d61792f3d3ba2f0b3c1b1d6125b8882487dca2b49de60bfbb8ab515c6397f88533d7decfc6e5aeee100002905fb54d32092417f247a75221a88ca86426a6f1a5223f333087403cfa13ca2048d7dcaa8d1f207cbc1da018ddc39caeb0d00272050648eb58d4fa423d1e153550492d05cfa7323e0061102210955f7c400000002c1f436797d0825fcf675a0fdffa37fbb35c8c2c6b65f6abd4f027a549cf0c44cc2dcb03cfd0ec8b95521ba43535f50eb4fa0ca2c5cc9ae1ec519c2cb6724207	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702d5f2862d4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398806439"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b0210000000002000000000010660000000100002000000041ae69eb79bdd76b40e01edebcd50f8c76a1b933567cf095609c39c6fbfb34f3000000000e80000000020000200000005fa0afd43eac9d345c90c6625b08846b59f849430c76c9e7f57d26bd02a8045220000000ef57060dceecc8f3031991034afb603e44e4bbd06a6644eda41b0c5b76fb45f940000000a5f32ea5f469e2ebb10983068c6d8e018f2fe8642871f6becdf3dc35c62a3856b93649ef71f4c846126aa8fe399a0d8ef0e81a90bda1defa2074b7a5400f8b56	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2176	2164	iexplore.exe	28
PID 2164 wrote to memory of 2176	2164	iexplore.exe	28
PID 2164 wrote to memory of 2176	2164	iexplore.exe	28
PID 2164 wrote to memory of 2176	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\thirdparty.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4daccd0213120b21b5daef91f2fdf947

SHA1
a7524e65513a7a1fa1e5c49b1c3d2c66cbae892b

SHA256
0cf3b9f712e3bfa73d5f3f628a160dca095a92bbd1849d854ca70ff9c6419a46

SHA512
0653ab6144135c9f78a5827784f4ca378c01cabb0c9093999810ea3dc0b120006170ba76d6b8c5f537ea8df6a9b1bd885095042005e1c804d2dc3b736bd0f20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d7ea9e0fbeca3e5fa1c5457aaea3c56

SHA1
aa7e133304791e918464b5dc9ea79f55a9648594

SHA256
5f542a287aa4786171a70432685c55d67c4b8e9dd39d397dda80a212e5e036ce

SHA512
90dd799dd62181faa4a9c47c3233d76df43fe021d44badb717e68b2308384f17b4d54b5e9e555fa08399fb44f8307af976f993bc849e099aae4e83063d48711d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30031ad1b971e78b41e3a53123ed29e4

SHA1
1dec4c1d6c9d72fb99cc0c549a797e19cb391101

SHA256
09e8fed4d8c1de5dee6d2a7fa7153a316449e812e1cb832f58f85d56b39cecde

SHA512
c39f295b871a96b6d94601c824c34549e4f784e4ecba9a1f173cbd5e2ce31a63d530332b2328757e3abd73f5b31a9b7b6f7826d6c676255e519185c41802f93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db532cbae3f81cf9a2288b48b36e974

SHA1
0c7dab1c50fbc1443ccaacfb2a9e1f1cd9298c1a

SHA256
4ec8aa3302eed0b772357042da9f5725624e49970b8c180bf9cabd420f17384b

SHA512
9fbaffa0f83ea0b739e06bd711234dac31151a2ed6e7864e5ae647ddc878a65aedd651be740e6f258a2563278f440c5b3de8b342d3d1fbdf586274562ee1934b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549a724e16e5f245806f5b621d394d72

SHA1
c852f5d5afdf525ce35cfe4664a4352507a7f352

SHA256
bc23aa24175f82929ec7363dbc03bc0debb96a020226fa849468ffa1ea2df164

SHA512
54902ecc7e1e8aa98b86cb3f8d9661a7916d9a378b2de51d6c709ce4f7267ee33a438087eb5a6229623e9c1e5f7fb48f55f5f555bc7b2f20d624ce3203a96064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f73320e66a2f3c1ae5edff9702edd125

SHA1
d79bafb5f5cd39c7d186bab5db7d25b2c7b97485

SHA256
e8536a29f9e62ac9751a60af065f6bfe607974c272e30d3670c9ba3d2f0472b4

SHA512
f570866ac49beda64f8c73505ea575e6330b79aba3ff2a3caca1d804d66b8f4134bcd7c5960d749a3bd3fca395962ef2308d80ab38a6c2398abdea09d052c8cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f69ebff613486c89c8f2eea8a99388

SHA1
b9fb4075b28fd30f9af85526177c9fe9eef74028

SHA256
64baf7ad165893289ccb43c10c16a4754f4e1e85536f01e3d0987770804cf3fb

SHA512
16e97eb055fa9d2c3e468d6d5ea213f84722eb9a2c770300fd95473218c96262fff8829b0252eb87cd183748ea41a24929e9914577d47d7693147f00649a601c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040aadc39e1f601e37187e5f3a97e50d

SHA1
2a0449a9bc61e2ef0dc5354ca53de204aae25063

SHA256
fb699252a236bed977e4853073b291dd0f346feceb78ded6f59fdb25e57b02ea

SHA512
483be96c73b52f9adc42af8c3f7af86b03596b9a750c844cf4e9a656d20a9154955d1f3a651885f6c5481c14881139dbc87c4555c746ac22aa29cb3163011f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90559074b5f19fd08449af75568c7ab7

SHA1
47d7fca9f9937d62bc3fc6bf642d7b63a8cfbd9c

SHA256
da4361c233342d5034b7fdc32fc6c3f76a5732f1a7b8880db66977448b59c3f1

SHA512
f399d60c52b47422b9349b788e71883c21339da89bc00a4e982bbfe54b19ec29cb4255071633bdf7a1bb0aa492470d733a479f3bf4d6b0890aed837e2f07009a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45c01d460ce2fd28ee2987d9378f545b

SHA1
316fa8fac90a2cc79088f40c392333745a0c072b

SHA256
29c23f0a37a95b59f2f5857d4248204054b8e50de59b53d944f2dfd531323c2e

SHA512
a96db1c4d0e37c5fec1bdf4db757adf86b2bc5e073a78c486c6b2f90af4265413970e70811b64b8c08b18887621e07325e54fdc84bd949e8127516c1ec9dedf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af7497b3de00f26798d2d83f2b250504

SHA1
79bc2d31a9656d4a40b0d4b4f5292db3bef05d0d

SHA256
b569e33940d552ded5599f97568bb8055ab055aecc33ba13ba3bfbda896d5373

SHA512
8f795bbea45d91e6f77020c078983c27cab55df75682bdea7dd81eb06b7d31c79f53d7ce409cbf1e3e18a6656d3773a02470c2cd4b0052fff0170eb6878f4129

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA20C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2AB.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit