d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08ed3b.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398965440"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85B1F611-41C7-11EE-9057-D63E05CE97E8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406a705ad4d5d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d000000000200000000001066000000010000200000008e22390286d34b0f51b42763d5cfcf12420cd115ee32645f8ffd9e9205771f14000000000e800000000200002000000064a9206837c216cd8bb209d56f559b8cd441ad04d720d842ebb25295ef0ccb0f900000001f5143be05cd402241561b8a1f226fe264586ec0df91db43d60116983dbd9babc3979ae62eb551dfd76334cb4a4224971469045c45c0775d72b7b40ca7832d304359da904fd131300090f6c23206eccdc55b150f03e41732d02b8681b94ef3147edd97a39dc7f4d595e86325176842c88832c8de57ec5fb74465d18af3e24dedf0c8796275de172cdda8dabfff3db60f400000008dd50279869fcb0129d5810371dcf13f5ea80e8b4d155b633c1831631d483e3efaab0923a387b6b79929063baa5a8762b4745e269fea12ee7dbbfee38c8e0ebc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d000000000200000000001066000000010000200000004d56827ab093b6fe62f8829df8a41879a0c089c01e343c1f456fd185f78f60e1000000000e8000000002000020000000ee6cd4fe166e0e9b7d96fa3ba1f916988f698b7e2efe332b48928f3aa91efebc200000000c4b6e3e7e3895db8f1eae6f69cadd3f039de7688f796f075240c01b3dda3fe5400000001cb5963317eec3c29ca878e7268e62fac46d864a2f59a67f7ce1cfe16d39d267dc24c581bdda71e3e7d1db7a9d63019219dc2f559ac31c4100754268a63deb39	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2992	3068	iexplore.exe	28
PID 3068 wrote to memory of 2992	3068	iexplore.exe	28
PID 3068 wrote to memory of 2992	3068	iexplore.exe	28
PID 3068 wrote to memory of 2992	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08ed3b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e199081d3120ba428c14b425633b7f02

SHA1
f14c026c654bfc875504b33baca4bc19be2303d2

SHA256
8db49db596a208bbd483bcfc3d8c3ce3fcf620bc00537d9129a5a3f2a724aba4

SHA512
88e6b462c4f255195501c8a3a5605eeeae2817a6c909c17db907193acd72a51f7f001d6f0415ee9a8e4ce6a9cf11c917ddac0c112bd31fb5b70d2a933eb04714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cf089876f4dbaf28d74e508ce1c740b

SHA1
01ca3b86ffef364e803ebc859037832ffc132c31

SHA256
15f3a141318e56e3f974dcbb7f5e72a658c1181e1875cdb7e423e6dbdc2ce652

SHA512
4fd90173c82f65cd9f5ca158d229fb7d78e75dad1ee011e60aecac5e889b69af77e30c28e06daf1de956fd7540335db191dffa8229193173bf72be72a98c7eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0271538c4211f187751c11a53d0ed56f

SHA1
d7d9c5c13d4bac2cbab92590347ac7adfd883a3f

SHA256
670ce4ace558ec8decab75b4cb644b4307075ed7937fd8dcd9c80520a6cb0a1b

SHA512
86c3f37e762b22d94d6c0070c018edbc484e09398e4058c341f5d5e94f8ae47736e0190911c38f8b33bbd50ee18b6ed5625f85b62c52553c512fee11628ae4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efaa6ef6025a816f8c02bb04e69c532b

SHA1
20521b902bfd4562a90e68d958e8a1b615ebd44f

SHA256
c9fed0a679a7cc1e01d9dc786ec5e4c2bdfdc2e22e020eeb8732d8fbac1496f8

SHA512
81b469532d21d275731501a419ae0aeda8b5b2cce966d522a76677752a2c2305358b1806670479e1ad75209a2121a65fa2457425840b61d6e9f0ccae08e6af75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f8f52b658ca93811453594ccb1f40b

SHA1
df0ce2cce0ef87870a37232eb241aef278cbff53

SHA256
3b74026a05aa90fe7b729ce004e3fb3dc3e8ae1b995a62a81ed9fac69197c16b

SHA512
a425027770a10b4aa1035a3f5da3281913c9227e1d3b4d1b2fce51970c5320c7cb409d922e5c58efb5c707d783403a4d527610288cead24146796f5aad50bffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3793398c03ec923bf84ed69c06b002a5

SHA1
a6373b65aea0f2d36548d08b0f19e7a4af05b888

SHA256
7dca22272a39a898d9d3f851ebeabfb5eb42b188f55f8c7e7c65ea5f4ae12a4d

SHA512
115148fac34fea5372c6a6fbde66b67faf1f89da67f1da85aeebb658c955691c4a5a4c308ea6c05f46bcf3914855586979d1b20874f1db90b7b66fd23f72047d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50380efc767d7e9ed335e7b66427d70

SHA1
2e4e1fda876fce5df21f42aff06f8554bbdab57d

SHA256
d30fd2a75633c59a462277dc22627c327791f21d6781731a8fe2d9f9dc29328a

SHA512
0fe3214f71a27a62e5c70f03f1b32bcfa29a03893d65eae7d68f3641a81677431c3f8c6102b655aed3416863551ee109a807df424bb32e99030406cbbf248fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91784bafa4db02ef3904b7a30b84b64a

SHA1
f8748b2910de255c3d2c21e6a0cd3b474fa1779e

SHA256
8381e7b733c1ae4b0604660dc6c8aaa3677db0e2d244725679d3479a35541f4b

SHA512
d34eef190d9ef85dd59295f11a10f515f03b094889b022f2fcd46dbdbd061423f18e32e4e786b9dc71ab4df3893f0168348921c212a680a3f1c81e6d19a87876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f6dd5bacea79bdc68bb02efd0ca489

SHA1
5c584b14ec7e620f30d8a75a28d8e55c2b070279

SHA256
a5ebe07da9aad0505ef7525852dcebb7177f3c303effebe0ba826936f4143b5a

SHA512
4c9ebb07034e094215007d4a447ddbfee21a99bbfb8fb3f01e93ca14f7343a19f3284b1b1085ce71ef549132286c0f314ad9523dd52f69ca2d4d7914b59c2959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
762a6c541146b7455bbfc214fb8eac83

SHA1
378644df1b3ff2322908a19d9b3d00e921916d53

SHA256
9604dc8f7a6ceae83978a05025094d53595dce2a28043dc4ab13e3e7b676d770

SHA512
11a179f1e89a2c0b51879d62cb7d5a88c9fe31bd7e936ac9a380baa4af9040899a4e528f274ff32fe7bedfb47e00b7b082a220f4289bda1d59dbb1dba1c3c929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f933a20fbf550bc08afc07148e5a0ef0

SHA1
bf6c8180d6f15a30c9729a0308e5df7d85849bce

SHA256
12e8a500bd6c2fc725352365ca22ba5b346b06cdbb6ffe7934691f298001cde5

SHA512
fbd232391d4532a588a7bdb3eb6183545ea276fc2b9b1173b3da82ca604a56b5c7c062b24a5689f7e39b8644021a837b8623c785a2fccf678e0f4aade98e345f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8d179659bd9e4102286aad5ad4e146

SHA1
dce6219263157f5f026c7c057f970bba9c13c308

SHA256
0289a05189f4dd028755731154eb1d27ebe7d76f773e5a4e25853237552e49da

SHA512
37571efcddb4423c69a3fd795490c872a9dbf1f6ce6f0c716b8b015ed027737dcfb10ccbe01f924bddc85d04d25ae2829f8e57900eb5298b90e79bf91bf40468

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92DF.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar947D.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit