63b0a15d6e92441701d15f76576a8f93065d1ed8f40672dce8dfde7fc788ab12

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

license.html
Size

18KB
MD5

57d40cdb2111f13e40a7c92af27d27b4
SHA1

27f72955eb424eef52715ccbde22d1cb5b23f622
SHA256

7dda06156acbe260754bf5cb0ff2acce418c4b2a7ddf4176fb4e2c892dd85ebc
SHA512

8fa42a10812c9ef10327caf5d8b618cda0bfdcf477f7914e8448175024cbcde7ae1a5ac47eb3e1d4500ad1cb7e904a22e97c2e1956aa274182753927cddf5b0a
SSDEEP

384:CwQfL6d89D4eefdN7aEGJ6Eyz6h9rx3pc/:Vo6d5eMdNbxEyaJTc/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae0000000002000000000010660000000100002000000002f17ed41f6b04a38d85b89e32443b00bbd7a6e42b3a22860dc0fb57b59616f9000000000e8000000002000020000000329034ea1ac77fce994b1269fdd77401c30f8dd6b6c544efb80bd1166abe7e57900000000fc09242a77346e4510f5ba737ab089f09a717d8a77e86c93f2795e98c0ea1c4d3496d4236cf3543ba2a5211be80ded9d253f4d7e39cab6922cddb26b262d62a710f9c1d3b3b49cd421f365982421a639ba12bce8f9435e58f3e154280ac6a1a69acdc9e98eaa52471b4e24d3a8e86d2a51d58f05f6d14f777d6c2014dbf7fae1d55b84a08250ea66c9ef738b219903440000000751dd8bbb52f2272f521e1d2383d5df34971976e9e7943fe5e2c8e1e615caad59fc12e8d15b92a495a30ff73bf8c93a20c70d12f0854ef49c905773850e73b99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BFC4141-4393-11EE-A95E-7E694F6CA729} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae0000000002000000000010660000000100002000000061fa7ecadc96cdb6ea90454febd4294da5411be8723f74415df3e10b1b35cd30000000000e8000000002000020000000b0f7971d09a38914e52e46cb7bad4827b3e6c36cd03c212cc3f728b45040d31320000000c4b8bd3ef69537e59a971114c918063eb113d66efb4f964e3d292eb27d0d1822400000004e25a6bcf18d584f919ae987abedbe0b3c81c276f1dca378488568748db738a14a8ed3327a4fe7cc997b310181c33013802ce0cdcb9368318fe98b6cf0c955e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bcd830a0d7d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399162976"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2124 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2124 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2124 iexplore.exe
2124 iexplore.exe
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE
2104 IEXPLORE.EXE

pid	process
2124	iexplore.exe

pid	process
2124	iexplore.exe

pid	process
2124	iexplore.exe
2124	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2124 wrote to memory of 2104	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2104	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2104	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2104	2124	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\license.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d2432e01ffb9e9fcefc8dfdee1f3c11

SHA1
490b2088369648ddfbaae98b9b64ac79d28eceb2

SHA256
28861041c090f820d2e7df77c70aa045f5e76df5ae19a8114446c846842057fb

SHA512
b46bb56be45432a73e659a81a5ac07247815a6acc08c3757437207daa380c155f32c9a103d83c84a78946c3d3b0e36bd5f9cc8061ad6a97a7a30a8f0c9e9ec20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f62b5a3e8493a6a6174b7777470164b

SHA1
d5a08858974f8295d9fb54667b4d8f94d07181b5

SHA256
74c6aac0ebd1642d1c68318ebccd87a2f2a23c85e064668d8d7ec6927892a72a

SHA512
46b6ffee5bc66c608286c0f3f350377816fbafc3e0ca16fc11412a8bebaa6e54aa3d7ec39b63fe4ac89236f39c834486827f3badcbb64ca4d288a3c550e80556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d4cb55902492c928b364f7de7342d46

SHA1
4625fc18aa6f6bcd6a5547919c6030fcad20d86f

SHA256
4f591c0c54be3070511c403b8af77b4ada2df77ab2a1c505be53fa75f419794d

SHA512
d29ae56d019d73d5bf18def79c8c3628c886dcf2fe4676d470f5dfd90e7e3506e7128e64de29524a5288b5b3001f47c7b804cb348be948433bf4f507cb026693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
207424fdb5a849c77baef38537510013

SHA1
d57f9ef73d242398dd38ed1c4dd4fada066878a8

SHA256
d02c7f9dc7249870438ec82599b68ac44e54dbcc96f232789563cee35fa40c2f

SHA512
81b3aec7e4bc899a6d9e03c934051755bc4706b40689f9a7c3605de362cea3283e5f5a2d80528d25cfc1b248d107dff2bca318056888ed781a91a01fd23ac759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a20aa236bacc1e9ef118ec2f86b54d

SHA1
e39a02f34f61e7ef9df024e0701c3bbae2723b97

SHA256
bd02df7f49a2eab1ad02862a611df5bfae1db927a0eb21726217d93e9f16763d

SHA512
a76cbeb9d500c14c412bb2b67e1c858482b9079f2f66dbca43de10302a2d052dacc61aefea5bd9ce44095b1b1135d8775818f0764b1c6a9e1a765e705fbfab0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0774ef0e9e0b2fcd48eb56fee2c43ba6

SHA1
a4aee5f6208fcd03c385be7f96ea6a69ee3c23e4

SHA256
d90fdf497f734423f2b9407a989f3ec8ea96c8f92082649925ff4bd98432a559

SHA512
b0070e457ceed42d4818c2548268a9fa453bae740792b219734ecb6080edc62ae444371c65486362b7b859fb28b12c62ad2764f8ff5d33d80ca5635a4d9a209d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
393bda327868afa61d1a4da2341d7500

SHA1
a6ea10d54c24eec401c8bb1d87641cfb275cc9e2

SHA256
8a6c50681b531d19dcae29e189dd3f1d18df0b782a018a37fc6a5a0247901d2d

SHA512
446c42a56232ff211de5f3b5d0548877015065642a9d53b57d4d84915618a884398bb69343cdadb35967fd85d6915d87d8b1447087ddbe25beb196e531c732a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e490662308bb7f286d339bc4568fe1f

SHA1
4e2d6ce1b7111954392e71dd9fd3a2231f99c7a6

SHA256
9c37885c8e9b3265937af8b35934c4d73e2e4835851b28f07e79959f2e48339e

SHA512
b27166b1f276c0e2476a18e32f64fa8226abd2219473718faf623e820f95eaeb342a68efe77f02862ff97fe8b92dab530f089b2f44f534ec6a70b052b5cac175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05a7ee5ea03dd27abfe7fa0ba4c2030d

SHA1
7fd6780e32cc07a756f10a09387d16a0c0d82c16

SHA256
7d20aff2d1c3f6e8ffac8ef01c20d10eec7c275fc81082c9fbd3d092ea20620a

SHA512
bad1809f99a0869bb0ec263b992bcbfd8ff9ab855061991e9998e7456669d98d49a6f7b2918597b7fde36b8391e318bb0f1b9b1e85a532a52341fe02d37e7191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9982.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AC3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit