a4476908423f7b2e61b27eed308d5b75ffbc6f873b08ea99868adae6dfaeb260

Analysis

max time kernel
147s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LqDm.html
Size

1KB
MD5

b17ae67792d7788f66a79d3ba981fd0e
SHA1

7c9652788ada68a5a39f22de954074d79c2439bb
SHA256

a4476908423f7b2e61b27eed308d5b75ffbc6f873b08ea99868adae6dfaeb260
SHA512

43c0c1e94812d6f8136e65ee94bb0190dcb22c150a302e112bb5ac02125524e5765e57d5aea33ad0a9ee58aac1addabb7099484e8f1069cba1be930e031b5460

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd690000000002000000000010660000000100002000000073a85c4b3b3d69b522f2d97e246ccfc3d443513a922406187ab1cf36d5552314000000000e80000000020000200000001e4788639367fda83e39b78792f9da19accdd649bd26d034c27de7817008184b90000000e6fb458ed4a91e2c29307b2b2a4b64a821376775fa475dc0d7c2c7eef409f993a9bb6c3db764913ffa25d05cc1d6018fdd2481d0f3109269502c745a238a5d460733e87ee3b075b1b667124aaf29c65bb25ca6bdd02a12583a12d597e255c218a0c3eb2ee08ae15ecee620eedddb43f44f1ea4a980dad85eee83f637c1cf500666b8c5274840f68de8f69b74f8a6d03840000000510b5961d3ea3a5b8724b3478668ba0952c7468d1610cb19f9ae7498ea8748caede853c945fa9a7f8a01663fcf70dead9ac86078f7ff7a1da1ba3e79dc24e406	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d3bc30d2d5d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398964512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BDC7F61-41C5-11EE-AE2A-724B81B1CE5D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000002fc95921f1ab6c84caf1f8d338315bf5f273834c36e0fb894e338d2880121db2000000000e8000000002000020000000e8ea564ab57e1ec0bf258654dc5a8b2e17b4e7a3bcab9258650b18d5c5f712e62000000080e330ae66b27888bcbd8eef018341cb6a9c67d6a708afb6fd33e5a078fc647340000000e2512c3f88bbfa2b97a8168e0d0ab60ecbc871db8e0a34b1d828d30ac7e511a86c45fb0c1dca57955d60bdaec32b8388722f154918c2444973a640159329f5f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2632	2196	iexplore.exe	28
PID 2196 wrote to memory of 2632	2196	iexplore.exe	28
PID 2196 wrote to memory of 2632	2196	iexplore.exe	28
PID 2196 wrote to memory of 2632	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LqDm.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6998da58a605cb9af6541d1f85ece29b

SHA1
c7ab0c3232c8069f9f39109c8cd05cc2b116f575

SHA256
bca611ca071ea3b55faab46276d1d7ee89c517e89fff45b90752ef18cd565910

SHA512
957ac8425820117b5f75b3b911999870a23bc1b42e6ba507daa2a696c1170ca4a0949af4fb572be00087f1130bfe6134c77785ee9967eb7bed9d6145afe0ae62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09641bb219381a02ac6c7536d73aa5cb

SHA1
40ad2cb5fd170d2569126c5171af072b6caf2d24

SHA256
365c8ae990faf33519a6593d1e52c5f6a40a5780a5a536d5ffd93d21e6696946

SHA512
33f48cf4e7026b1af95d55a5b68f684d9291587995421393d57ae7fa0756bdb70e8312f6dfabdbda09adb6e41ae356fd1192cfc17a4dbfd8a8553fc3dbf7c574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075b7bf9294de843c2133c79eaf842f6

SHA1
8435397d67fbda8bd4ab7cc4c123731c19cfa3c1

SHA256
19b63b6c4381bbd2891f89f6b47921f7d0466e3f06a7b96f6aa1188d04b36a61

SHA512
8e33563926e704b8b495174869654eadd25d043a328b1200ea19416041c7e2bf779428067457e07db05be2a6173c1d38408ddd1539fbb15ffd269afee8d1e800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
017f6beb3980aa756e606ec2018334be

SHA1
37c8360e28fa7d920faea9d9e8872021fc306855

SHA256
1c2813e172374477a721263ac634d7f710edc5433ae0a2bc066e7bd0a39bb186

SHA512
ed6ed6d1684b7879f518358a4eb69e84cf72e0c92b3ad20425e13309b6f4300eaf9863c144d73558d8dd37735f0f2505aac750f272d917fd2ceb19601bb42449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba34f0640bd5811604bfaa7ec79a750

SHA1
3e27a8cbfa843c9b0713af733a62ef070c73fae8

SHA256
1becfd836541126175e5167b6c2336e2aef6ef6ebe1b151203f9863a2e0b5f0e

SHA512
e8ad2dad1981ae6a092bff0a97cfd83b75dbe8f3f7b81e24d7d068fef0ed509a5c86cfe70fbcc3e4a778b9d514d0e5ea979989df3a4f6ab8b06da3a7eee71862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b11635539bb27535301935426f344f

SHA1
29368ea454be1db849e6ccf24bfd70e626e03f31

SHA256
01dc5403a2663da443cbd747372351908ddd557e2338a5fd435a1efd84cd09f4

SHA512
ab4263c9d5849d06b966ccc151ea18232fb3bbaf89f7fbb0839e25686301d34e69b3e28393ad706b63dfc226886e4b565d178650928b9232e5b509a555341bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd86dd720dba172ce68eb42474d57462

SHA1
0379b96e1ab6998b4f7d4c1849c6c1cdd9418b81

SHA256
d8cceeefa0298b8ad83910c3f93ad0338b55b560864b8c5fad9cbc5cbb7cd723

SHA512
c49b659eea24d5f4716c9b370ee8a14b0105a6a9aea621f276c2f90f51a0cdc0880422d780f52bd108a5d64261b190d11c8ef459c0a0d587d509fbfb246b19b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7c3053c19b863b8b08eed88993a339

SHA1
d1f7c834a9426262cdd479a5b28ea7ef075dd9ea

SHA256
90e39854eb2560280a51af515fe6a4c44c0cca730aae33024a9f109f8778ed69

SHA512
f49197e3b4216a0cb252a8c11550f8b0663b24d6b8286b809c25eeeb868fd1de7acb3c5a280a628fc4ec271bd72c38da49bed871693d4a29b6247719882b4196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
962825455d8f6a9a8f6bd289961c070d

SHA1
404969ddde1e771acf5489e03cbb1c5950f13ec4

SHA256
ae7c1d701b283ab287620981e4c6b7de5bfc83436badb9022178bfa287f90ceb

SHA512
fd13c4a8045a17e0af37b25988b047237df0677903438f12cd3c5651f3c4081718e87dbb4febb3499a74bd1b49e19adb50423d38a8f6e3ebc3715c2aa4e6e8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1a2ab4059bfaf55945a800e00baf3c

SHA1
31d8c8a2c4a59bae68bc39a0d6907780ac03bf39

SHA256
4249cee3597af80e2cc4467f84f61b475bee5b2dd8b0967a852ac876371abcd1

SHA512
8bfd9ecd13a674d106722ec3b4714b09501a422e839687ba6e8697cd43f1eb25b3a2e926bf23d52de2fe7c54a899f4cb98fdcca93e4078e1d62408c5dfddae47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8852e6f2e255743f51177bbea731b2ee

SHA1
589d76b4709c69313994ec627212ea67de197d1f

SHA256
9577192794a8722bbc8ba96b7211cfe9c349c1ba8d0bebf51c6b97a211a8d920

SHA512
71f1b521681590865b44b4113a23f8d20093c34a220731bfada6d5a19820e45005c75fb256242d4b97ac0c2a3d64fef42661a90e86cebb38abc61f082b0fd96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95B3.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit