ee8d441eed3d912b1924bf8bffa9d4fb85803fdcf3ac9c96af5d40aa3e08046f

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63022b407de86h.html
Size

1KB
MD5

9100be239cc8cf575ec46a7a20674951
SHA1

0395fe1104063942ad370afa4d2e425cf78896f5
SHA256

ee8d441eed3d912b1924bf8bffa9d4fb85803fdcf3ac9c96af5d40aa3e08046f
SHA512

0b791a85ffeb36dbec21e01350977b4cf60085f1a7e0d6b523b5552d2137663d1ac61097fd91f6680a50c5ca7ed7d5797e938bd9d61e83013a0a4d6d9663fd03

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d00000000020000000000106600000001000020000000e31d626995bcaa695fbf8eaade8807bb962a16c7212458ce9e4e6d6b86946720000000000e8000000002000020000000609274b01d8c4f11c8e4dc9ac22d12c9e46fe97ec9984a22183f91966da17b03900000006894b19fe0154d1f6306b39b7c6e33c7bfd2acfdbfc6c4bb3649e5f0c8ff45f001bc7e288ed079053cf4773239941c73c76626e4b7f3437816e9f1ad4686bd5b805203de0cfccb9b746db65670f11b305d9b24b31d45dabbf5d8cf80ca5eca4916832eb57cf7ff2205ce383c5d5494b9d3a6723430ce3fd774540de056b107e9299a26b73bcee773ad15fa980e91dafe40000000a2c52cfcc5cb2ce77e32f4f089bd9dbb7cae8e34e772feb86b0102c42fcb99e0b5f50e2893a6cb5d144b6a95f1761b0690119c601698f82aa1f5a060c7a26524	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05467bfd9d5d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAA8A231-41CC-11EE-A66B-6A17F358A96E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d0000000002000000000010660000000100002000000098b41547b08e24a12ddfca02cc9d4b38ba77acdfa71ec7a9593447c0c54d9414000000000e80000000020000200000003f6cefe8da35199f91099c71eb859ed860ceeee5f55ad23e96738ad208734913200000003ad90c6acbae6fbafa94e6f8ffedefae569b946fedae113d409f54c198feb7c040000000b727999e35713b6c5d3a955518a59c0780755d1f9e7d9c439f7ae0554a06f001cda5039db735b1fe1ffef6f4637bb31ed8c13d4139b76965f90327cb8ba0b9a8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398967755"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2056	2220	iexplore.exe	28
PID 2220 wrote to memory of 2056	2220	iexplore.exe	28
PID 2220 wrote to memory of 2056	2220	iexplore.exe	28
PID 2220 wrote to memory of 2056	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63022b407de86h.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2cf626c26d79c04bca548bac2c34dd1a

SHA1
4ba244036bfe799128f378aa16097aad81c47bdd

SHA256
b5661f23808729a18e30cf7067d73d7a8bee193617134b306f29277e38bc09c1

SHA512
f8af44e3837635d7bbc85c55f7e58066349fb2c812a3a33af126d8a8791f9b3bf1267fc4f3e0f8f2a71b61ecab9cedc6fb1081bdb4eb1b8ca5861e3acbee4481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7bfd22e7d0b17ff63a46add75c805063

SHA1
72f0437e754970ab68da829c046df991023feca1

SHA256
ca21f00aa9944f0aab8478b725be04c7e9ccf2767770f609c30ec4c9ceef13c6

SHA512
630bb889d22df4ba5e2fa557deef9f7644f69f22c2ae6569b57b478a91978bf9cbf99c8c21bbdbc8c471dd8997e2b95d382a16b6ce1dc1529582d9c9ab70db07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0b9253320be16e0d38bf6b3b987fac47

SHA1
0b32f9532d17ec0947f08051c94976d7bfc083ae

SHA256
53da10ab849abf5f40d0c5fd10df0f6e72064e33cb00e28bbc9a012e84f4027b

SHA512
9c76ed475c1c015599e36c09bb280b233fa5061cb87f40ff8d901c6d89b558999fc3fa0f095992b09cce972df124e023e18badf7ba879d4494ea482e35b137dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d17e5830ef0db398183dccc10c0433a5

SHA1
f3bd3fcd6c29d01e83bfe820bacbde5e3e95db91

SHA256
43cfbe48f0c9156b7b8a2d498cde6666a2c5c48324eaf013baa04aff8531fb7f

SHA512
ca5c62fd9aba66b48c5703b4f31fb48e61ee07c9cca43e839bad6bd4f9c1bcb6ffd741c6e3665f53756d64524ddf6c35db5be0f4a96eae1f87c159f744b4de49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
16dd2236b82cc82b8aafe48ae28ecaf0

SHA1
18a109bfb9c35c6d78028a805396a7902895193c

SHA256
caf5ff6bd2e2fe9bd9088fb1b0e7c5f2359fe78f547a137a1efacebccfc04506

SHA512
88d5c53da9b569980711219befcf99951c5808c880f0a87b9eeee3946927d1bfd90e60533d4ce23450bc8d17302551f4182aa839a127bacb2fde52c035010454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e4ec7d65caee369a93052feb3e2d1068

SHA1
145ba1beb0a826185b4ca17f0b4df9dc772ed8b2

SHA256
a2f4101f360a2a19aff62006ed078bc66874ee5f9ef0fa52eecad6276ef315cf

SHA512
2c01ee974d432d5959a6bcccb102375f6605c767742fe52c0d52f3d65431e43516f76a435b57875fd1153c8a218ff40667e097de4043376592290b1d9a3308ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
44dbedce09f734faf1798cc8eebe036b

SHA1
09cadaf853760783f26a0dcd17f7e894f92b8f12

SHA256
022e7eea641d481db65ac19447578a40372f1b1b4380cd7cd937f418e04d01f9

SHA512
c91d83f970c7798cd31f22d8278053961409237cdce427f3defbcd14eb23ef579a68203f0ceb6d0f06f378fa5da2dc68737c3b57824a3bc95708913612ad6ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ddeea0cce7b44e997ef1592f0b167d55

SHA1
2b49d48e6142ba67a44379a0e28780f10887f58c

SHA256
72585048cb51976c1e1f21be381defbe5d83956fdc720004f616aa9dc6872a3f

SHA512
cd5ed42b411f4380e58abed72c319dd5d7609e93f18c29b668d3da27d65ef3e2fcc18ef8bdd99c7eeb84173b54b620bf26bf2a022b6f5fa18d674f95f86ee002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b4fcab956e151589244ef66a2baa9d71

SHA1
c68225b491d01d036ad7f86e130905c6f06c120f

SHA256
f76050b63dfaff187ff321856f0e2bc3388eb5cf2fa7fb7fa222745902e0e86d

SHA512
40630a1f9142ea743ceee6493301059a9c5bc672a0ec4e95fbf1911bb63bd4f8dd8a326edad6a6aff245347a58c98727dec7157b1fce814ad6ac07365edbac75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E4A.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit