9d74cab8eac079886257d80035386edcfaa312327ea210b8e4f1d00885720320

Analysis

max time kernel
135s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z3hrs0sqN95O.html
Size

70KB
MD5

a0441d40079c5bce056794a7b39ac1d9
SHA1

1fe44345bc81d9cc8c361be5b1151d65f702df37
SHA256

9d74cab8eac079886257d80035386edcfaa312327ea210b8e4f1d00885720320
SHA512

927bdd72a69e479160b152936c005e4825c21af852f5423f517ce0e6a6827109846cd304d277be36e71598755dc1da3fe42aa02672a2d0769670e659fd555e3b
SSDEEP

1536:+C8ipu3X221f6I7PyHL0N9fuffWle5cU5XqVckUQJQDt464Q7UhV:jI3X7fGHI9fuffWlU5XqVckUQJQDt46G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7B786C1-41CC-11EE-837A-C20AF10CBE7D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000005079f0b40245c5f155b9842622591dddb5bd54bb35ae5d40eb76d29347824264000000000e8000000002000020000000feab955e1586b8c8f0067e869c4e3138884aebe95195dbb7919e870effcd08c2200000000c3d79449d6244c3756d97b6907f91bfdddea240193ab0dbcfd2325f429ccea04000000096c3b37e1662fc533b6251655515a088212eaf9a29690e3965cc436f3cd661a0288fe4e5fbc1824d40186d4b49590b22de9bc730328b9152c04655d1c4656168	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30691cbfd9d5d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a7430e17d95b74247f9cb6da1c1625b933ddb45c1461af47f2426eeb029fa46e000000000e8000000002000020000000717610e68c3edc705df6baf30204b067ca667c67af89317027cfb06dbf5053bc9000000087be0e4afbb63a79caa8cc1dce4ea3775f85ca1e8b9e9023046147efee2aefba3c49c3d26736263b90b4074231b844c08f6eeb121e786f9d4f1fdf437d466a040011a41e1f029ab1b149779386d35536be0ff29cd9b2c100ac52a83e81a49c51e7f613376566216af852b626dc34673a5825085b43ca5750473b31ba75ea01ab14003ff52cae9c3756242789b2b4b486400000000013ab735f2e15a4b78aa47678507a59d102e52ec6ac58f759a7ea6b88feb73bfe2d0c1b5c13b8747bf10e2308ae8bc84afc9c0e9a3d09cfa4dc63462f8ce86a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398967689"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2972	2444	iexplore.exe	30
PID 2444 wrote to memory of 2972	2444	iexplore.exe	30
PID 2444 wrote to memory of 2972	2444	iexplore.exe	30
PID 2444 wrote to memory of 2972	2444	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\z3hrs0sqN95O.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c7bf37e11cf56f42987a8fd64c5fff3

SHA1
5dfaf7519b5face714d017e4e6c05e2625973eb6

SHA256
e20e9de30be68536f7f0be5b4b62b93e4d79603afc6c2a1b177e8d1c3c8ef940

SHA512
0842fb0a74da5d43d338e70f3f776973cf7d9b926dbade02ed6b272c8c2c2eb5a7028b1a352b54e9089c936dc56d3f657410905c1207da5b90162fae325b30a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
77c3fd9060357c3d9de949f088add68e

SHA1
cc0af02a8b77bb6b2028bd4588a8d354d1a31f42

SHA256
4822b56bb3883aa9c1e7463bdcf7d4c194850fb4df77393fc0e515e8e0f4a989

SHA512
8bfcf594bb9acead78e6e71949fd633f4c9ff8777e17bcedce977cf1aaaccb28a92a5aa0e693294c73714ef74ad20e435ab144e5857dc01039b4fb1a016834f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a53c864c725471f416cbc519979123d2

SHA1
6147ab54c6219ffaa8be48bb76a91cbdd0da11db

SHA256
5ca3b115b28a565e5971896c5ec90ba27a7b0cabac44f3329c02b992560ebd57

SHA512
cd7eaeb5d737b07b1788d0c7f16f05c74df4c71ca393264b7bde6b57670ecfd55c0c89e1f9b9486e90e348a714cb0e7677506e42df27fbc1b93d98a99b9c1d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7bd22d6bc2133149e89b5a3ac90acf0a

SHA1
ccf7d1c0cb8948aca2438a5d2e2f8b2182188abc

SHA256
544876c754456ce137bb2801a3dac4c71054babbbbb7b43ea01fd35242b65a04

SHA512
f2747f583a55562b51b795e0fd95671cb755544aee9dba441848a755f29dba9cd4aa5d2c365bc7d21a77254e5decd9cacebc655d95da9db6be376ea04ae079ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d3f1a3a6f999041c24dd9ff413ba4eaa

SHA1
7410972bb0c8b436a1a8bdabd76d583ec2b14608

SHA256
d04fe7a9a745866841bdc84ae1a1a0570ad44ed16716c31bc351053beac98c4f

SHA512
bda918750363dae0b05ef26ff26d2a80853904dba3e054833883ddfc031d13b7d159248827ad53bcebd55355e919b7da1110318d49267b6ac8e15a6b7fe8cde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2662d2a3cb7c4c13d77b2180210b06e6

SHA1
671b86476f13f2c0bc4c7c12aa6561094b7a5f3e

SHA256
1debdb1c89b02c7e546111bd2e398a58c6c285d676a166ce688855cf7178ce5b

SHA512
a1bb1a8174b89bb5beb52cc11a4b85009d03e4e2cab0f345c448112a12a794de846b308d42dad63d07d5339df97cc5eaa0ad578b0bbdd29958f80ce6031be2b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0e37deae195f39182423d6d605207083

SHA1
2b5f693e5237aa663471e84f6c37193b8c99c077

SHA256
bfacdd90dd287624f992551e80909c9c1a0b63964e4127a096093f2a505fe0b9

SHA512
183e2ac8cf5c09074547901c4cc8050a4682109096437a5420a0932bacb92f8fc19c6ee8f7f9a9249bc329a5cf5c45a7290ded67c784cb8a18583a0825bd7a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d670f97b9798867206bb214f9e4531f3

SHA1
c2a157bb9a28412048ec72ecd820271f01a69073

SHA256
4878ab9dc8247d233b0dccbf3f575995115ba4c0dd0b30d53535910ce81d8495

SHA512
67238f1dddbc8242ede5eb1c1a9f16a0fdc239f9a7511ddbdb87d5dc705621baeb2146731439f1a32f1549585e945f37fe43ec93cd58c9b334ae2c71cf797f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BDA.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D77.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit