d51af4c716bf7980c2e72f871356a68f86bfe276d82beaf0e2dea78c9584929a

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

closebutton.html
Size

981B
MD5

c8efa039f4f84b2705a8e3a3b31da61c
SHA1

669749429feda1599c4ee980cfd67fbb1a54c1a4
SHA256

494693c2ac56ecac1a2588c25631e1bf71211fb0f06108649a983c879315b1aa
SHA512

db6c9817469c937a41eedbbbdaeb21a0860fa5228258978fe59d29c75ab1497b8d1a0ceaae2b236206d6935e186deaf0d83a73791658fa68a985dfc5c314aed2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd690000000002000000000010660000000100002000000070a8e1494b6acccc5b19604b3d4ef6f8a9d9eb472760523bf9dfd6e3ea7990ae000000000e80000000020000200000009c74be647924ef24ad5d5d6bead140dbe8fc376f028b862ab66f6d453ed424eb2000000041c6c8b10029b762592348e2b545b4ad1de6edad95b5c0b16409eaf971e98caf40000000ea3b55636693e1f8c033ebf7fe221e1bd10c261deee4b9786d545c7f8d38da2418307b7eae4803d5759e81c203d92b8e7f58b2f8284b0ab45713d90357364138	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000b8cfbe857cfa0817996eb615dab428b3bdd3dc40e3f8430024d08a0d64409bec000000000e8000000002000020000000644ca365df2d751c4e3669e77b6f9af7d87fa32465ebbcb5beef704abef54de2900000002d63772fd1933200d13795ebbbf89e123211e70641c01df95d4d2fcd0706040e97137b8ffbf2c198517ec7ba4e99d3178b7062adaa5f6003811edde6a6ea8befd291c79596500cbb2c65f1278ae9128429d9617b84841a06615f877ccd086007b8141fa07047594e80a910df24e7ad46554c573d44603c155a8238273f27550c990b3b3241aaaa8d74e154d8220781224000000054c3f0ccc7512441a5e203ea3496be1ccc52e059a7edd3920efb5986b056787de6038e8a3dbe8755f8f384c2740db63ce9e71b39b02daa07456d23042074552a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D2D4F01-4393-11EE-AB40-FA427F214E3D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399162942"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bcf031a0d7d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2140	2016	iexplore.exe	28
PID 2016 wrote to memory of 2140	2016	iexplore.exe	28
PID 2016 wrote to memory of 2140	2016	iexplore.exe	28
PID 2016 wrote to memory of 2140	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\closebutton.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0d978486251a758c30fa3c68e0f4cf37

SHA1
437d008fed30892d9ac530994e7c7d8941b3fd0d

SHA256
d0e8da906047cd85fece0371119d4fb65fe660ddfd79ef6dcef5533749136d64

SHA512
49489320723086a7aca97878b22355f7be47572e1223d4dc383639c76ee1d0621849785b02ee86d1c363a157d06dacfca1de8e3f6db0f3b218bc97120322f11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556e57e7cbc5cb47b6e3feb418cf3739

SHA1
5b9f0fe6ec3af477736720bcbaaf4d8cb2ef64d5

SHA256
aef02f9f06e8087617a4d39c979fee77fb10f5d176b6e0630ade8328cdee5736

SHA512
98b3d34656184b0c3a93a9a06651972bdf46213acf75d8012adab77795ea62c03416d650af49f90f0c988e246bdad86beec3eae764de0c85d826c747d76b466c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0aa6a9bcdb43b83458a459a53d1248c

SHA1
5065bc9131390f2cfa040a738340e89bf28f94a8

SHA256
5418daf65161fc446d6f2cee2549dd1a26592b5dda036e7207aaef465e7304ad

SHA512
433873dea5ef67d470a363c6ad31347949d2c96cc90422f1ba5ff0f7fdee9a3c7c67adbb604568f4f329ef1173b754ccd296b387a86f96dc06b97b94c18bfa84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc597c7d45aa5c0580254979166595b1

SHA1
55e72877be1a28035ccaea98a44537c45931050b

SHA256
0ed6c116ce090ba34b4845591d78023f69f4301a61e79449cffc11b7f5239a43

SHA512
ccfcf75c16403c474f95dbcf74ff9ce6deb6bb9f85b6bc34c8b7d702b5530983bc2cd62b12ecc97350e025f8b0e5fa056c40a53e2cf6b7cdc1620baa65be5344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7983e20258c9dd85987ffbb0b39f825a

SHA1
97b37967c0d307c205a23f99ddb2d4aa79017f9b

SHA256
3961d392bef1a2c94fdfc79dd3ce8a6062c38bf49cf1cdc3abe9484e7464fdb5

SHA512
e9e9b6d9ce2ce8b9bf1a634b32cfd1f90aea0b00e7bfafb1fff9fc0c885e0fc5a2c6dc2a5abec155609590744dbc829e547ecb49bf169bcf273e6ccce046a1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6bce16bdfcc1c2d355943e17b6f0533

SHA1
de79c50e61152688337b396d9787b31e72bbc440

SHA256
7200412ccf2062b85b2aa2638137b65ddf3009268d2f6530789c0f935de1deb8

SHA512
ff519e9f6f7f5d3666086151acd866035225d11a5c8f12311aa397ef6a060e174f9a0e2d0ea008167db4ffd1981641ec6b96a089f5cd007eed833b963a105e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
690ff7726f4c49bb1dc9f89e1e98b0de

SHA1
1b76d155deccddc9682fe9f750cd0b1c7afc3c9f

SHA256
6a78e7208340d7c9e3d4448976d88167ca6c326111f707276f2b2e8437763ec3

SHA512
acfe0095fb972cb8aaf2c729514ca162d47f4f73c7205b567158e1d2ccd0110687091c72ed88f613d73361b46bb349a149a259faa0a03ad63a6b8df0093ecca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a1d9f569332c79f7d106cc8b67367f8

SHA1
2105e14ab2e91ee83430f66dc58eee76ab0cb7e6

SHA256
b5f20d78ff0470ac1c309de7c4f0ea701943219ee6282659d66f4b4da26c3a0d

SHA512
bbaf53b95a5be2e29925768be02b05abc37a3515bcc5c3b9fc66fb8a5bd595f9579129f5d2a9dbe18d05db5b0b3ab36c58a6303f4a9f71d8a1193aa07624640b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f367de26912c850780c357b9515646a

SHA1
132579839f7baa3d09116864e9127850806c9398

SHA256
2abc739528abf6f9481efc733dddfb48983e91bc48b8faef80994f88bea602fe

SHA512
9e3e66dc9d337d7a95303b8c6440e3929a808d9ac0e80c9e4b94e3fa163b2ccb2f83002d13a8a5bba12938404ce19ad66c8965d0974dc62a6e45e242f30f1647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53262bf2b1ae2b34d8df59ef280b4c4

SHA1
4b856df54719cbedb4fac0f2721e493240523890

SHA256
83b62748cbd23c407d939bcb7c3b9ac62781bc56cc6242d5fc37378134149e86

SHA512
3f56347d5357c9b7d852d68f0aaabf1b5d5f447db28ccafc64222d09beedce016fb4ac0365cbce4a2b89d5a71782fdad662bcd778c9d82d9a865104715c3a465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f681a8bef603373eda8853f3510ae9

SHA1
609501bff42ec6f60cd7ad98f4e417e1d81aa035

SHA256
11abf4e9bab97a0bc726c1dca2796e518f0ac53c87a429ffbb0081571ba65ef0

SHA512
098aabf158d0cf3b19aa3eaabb1b0771a95d8a586f3586b39d564b1993aa2619bd457fb9e2baf2302b70c253f919e01ec414302528604750ec9321a15d691050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f0c1247c6634c0c1b304273fdaad8d

SHA1
66f4d93beba0b263fa1f4012ad951b58d5ee68c1

SHA256
9f9593659014f5ffa82a51a670fbf5c1bf81326acde7fe1492bf29cb97869a68

SHA512
4f7e3810c10adf74b590a3779dc32f168f03e4c188925d533b3ad8d7ef90816bb0daa4a3fa4001d936b5d6b5931abcb1121ed5c68ad82697038aa0796012a789

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9601.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit