e767d70fc57483aae7a20cb094a9bfc1fd4f04e97fb772cd6892d057e5be4260

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sksKQissjAN.html
Size

15KB
MD5

0fb684cc15d197c0b937e5528359d7c8
SHA1

7d963246f52f42012bdcddb31214283c84c954ed
SHA256

e767d70fc57483aae7a20cb094a9bfc1fd4f04e97fb772cd6892d057e5be4260
SHA512

c40335f72f802479dc0926704d87670a782362fedae5bb50179d427fc343c6a33cfe09f4640acb15624d1511d3d66f76d87f663f9ad430fc2ddb00c54056103c
SSDEEP

384:yqlDCMADJnWeljnLm9irBe54/EHF2rLOQXw9HsvQLnB9ydidkQngumYwmf:EMAhxSU4wEH0H7A6QLB9yUkkh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000c633563e895402725f444bf13e09ba5343945761c334bef0bfaf33b80e5b096e000000000e800000000200002000000001be68db5698125679662dd0c5e62b7a4e14c2fbe8f920287c7a01fa74b925dc900000005ca7c9329c023c31eb5b1c271ea03642a28e3e1ca767e6dbc66581d28a4d115514001ff0209724100171b2d9bf6f1d55b67b14960b4280a9b7726a9f18edf74c20119e415c8079db2d82edbcefc299add0cc8df921db0b5c6bdc41b5e0244e6191301555789fd3c043709e0e52c275bb22c9375109ae72a249d612d6001cae200d2206e90e00dd54ae4a50764f26b6ad4000000080daa9b509ff8830671fe4c74c8f3c9dae6b036c0e577798e83b506d741433124b083e3eef903f7e6c62a0199a9e355696adfc9411a55dbace9be5ff2e0e0df0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc630000000002000000000010660000000100002000000003cf6081b95be780acf7da6a41f9e292a3d3b56cfa541d7a7c4647b9c7a6325c000000000e800000000200002000000095d9816bccbfb93e7485bfcd6751c7e204bab431596429745f4c2cbb4e997aae20000000b6c7bc004461748ac0f6bc151a99dadf987ff11f33011523c7d0168bcc0ddc24400000000df8f08fcb64dc1a92866d81d483acf616d97317ac2727fbf9c4620a63b5c995aea3b1458aaafa664af2f73418cf531adaf0f855b6d599a1ab58f7ad0b5e3909	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e5a5f2d1d5d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D82D3E1-41C5-11EE-837A-C20AF10CBE7D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398964405"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 3048	2616	iexplore.exe	28
PID 2616 wrote to memory of 3048	2616	iexplore.exe	28
PID 2616 wrote to memory of 3048	2616	iexplore.exe	28
PID 2616 wrote to memory of 3048	2616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sksKQissjAN.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c870e1d989f200c46cae6efabd98e95e

SHA1
ad1ae7f2c422072148047d00007d76a76a699988

SHA256
ada136b5429aad8a90c37fc82938f2e4ff19919ea1e6a6b3770df50ba3cabef3

SHA512
e5e1030fe13b7689f3e1d4767c3bdce2ded03cf591ea2dff2fc0a04c23a6b06c0879d8832514725f7d72743d66e53e9069e2ff3b022d520f779fe6974801f7b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2150b2f6290c85364b5563b074eaa9

SHA1
f1a44a0d958d5f136805df726af9356271089108

SHA256
9c835c749697665b9469d725860781c401de2e17ff5b6462d0f0cf2e067730d1

SHA512
4ffd5cc7bc158a583b3d5efdbb6dc02265fd878f7eca24b14baf2c486c75bcea7f14eb8d94d57e6485f157435ffe78156136ffe5f1662638ba562385d603a88f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0bac8d01fe2c7c0214dd8a3c5f5bbf

SHA1
040a769d7af0b108f8b847283c233a68b0b84ab8

SHA256
5524b91d81449b394312c84c21ed3514ffef0c8a8b92bba4c50f25bf5590c8ee

SHA512
901af5c882ad3280db22dd3290f8e4e0c7f4a36e8ebfc5ad548148041d993ac3051f4b2f861fb60d09325e372bc60b2b510078ef0366f8c0b02d7031b0dfaf63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84627b166587a171e805b4002454d94b

SHA1
1eebc4ebfc8666c3dd893bf133df53f5fd5b0e15

SHA256
eab40d3b906002f3e238e96794db7c284038c35608a63a7714445e3c9a23cbf9

SHA512
0d72a0e3c3e3dc28dbcb6aed18fc564bf885208a84b38fae6728bc3ee3fd6ddc6c5abf0f1c4e3a8ea5204b21eb341ee3ffa62cbdc56deef814c939d61a5b65bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce2b502a4cd0d723f759d4c45ac22f8

SHA1
40c260621688399970789993ea77ae7633a07609

SHA256
58859298dfd2842278a63f26cf924b086a66ec187e852479956da7080848c397

SHA512
2ca617873dc3967c1f157d3c1954534e91c280dac244a67d94f95539509aaebdd6812ffc7c9d86fe363c873acb85c28582d20bce534077d371e9322472e06fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b28ac45a5cb6c1605769ff6d2d5a572

SHA1
ab62c676f141a4334788076b2653c59fccddfb74

SHA256
cef6ae006eb677412868ec2ea39ecfe270482d85a74a1b8b70a091460acd6531

SHA512
1f87436abcf4095c3d32ce3ff417f4f6cbcc595b9296dd0cd48b8a1a3ee506c321fb8a07c64dda075edca1acc18395b86fb41cab664617f5152f15d57584250c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5806de429909fe707d5ddfa49e4a79c2

SHA1
55405a50cb275becdb52c2936e7a8765837d5f19

SHA256
0dd8724208230093330a8dcc4265d784666de430524e55b47b5d54687cdd3013

SHA512
00e0ca017f126e3b12d0a108ffec9058e705dd9a8dd00c4b02dbc3e4440a962ef90a526bde4eae9615630d1b87dbea88c7bb3d95fa1b5c5f0ccfb8b98d5557e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ab5ae9dcb7ca1a83673b7c3d495c37

SHA1
28b31c7f0db3bebe5eeee3edace91066737f6099

SHA256
e28f1ff69d9db986771c9719021a2fc2cf8019eb2c9ca0d132670781e19e17cb

SHA512
67a438d360af0f8610916195e36bdf9b934872539e16830e5517baecfcb2850224f03549bdb0720a9bef9a99b1550ae6f790bed19f4fc3cb9668070eeccd9b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDCA.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit