5a509a6504bfb7d09682ec44554c45e660bf5e20dc756360c052f97df55a3a37

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
submitted
26/08/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

license.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30905c5769d8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399249330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb00000000020000000000106600000001000020000000c689b8e07756ab4334b9a4377b7e89c52e5b9a600de44818e7c5a35a1b7fa4f3000000000e8000000002000020000000485f9c82e7eea151db3b883201176e8748bd25f80621817de242294997fc60b020000000b0be4bbcf56135a60590105d1707f5f3875b5a72904550ec500f488fc31b0564400000003d3339c614b033da8c96b827f25bbf1846fd39705a133ac9c2d13e905556f20c4d08ec200c39015b09a47f8335a9e16e9162caa23511ec2ded4606129795727c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000005fe2dcdbaabf8012bdb134ec2e376c0cb86c8ec7fe7c70d213a61ab656d84f5f000000000e8000000002000020000000680bac57c7fa56456f7c7e020b9b1f88139178af4c51c4b575a25488b57a6fa9900000004f5b2acd06c2c39aab75f92b1f9f11e9144b18149c3282f7c45972e0972bbc42849a74cd94a2792f85533fd1ada7b15a49f17d1e8899854d4c6d126573fcadc6ed81f7531a1672fba0b0211d189fdace6285fcb62a8eaf44a1bb7fca7d544ba64291bf9f7fd7bd722d02380fd2dec952df5fa3906d3428ebd06199012388a3c4c5df61c589956c763c10b063888994894000000036d5459b84f8e0de7354ed15e18e2e61b946f45d108692a7e94d9867c0bdb342683f034b5ecff450cd6efa16215b9123cfd470f37040cab8d06314ce9a21e4cc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{825C5041-445C-11EE-8D08-D63E05CE97E8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2832	3068	iexplore.exe	28
PID 3068 wrote to memory of 2832	3068	iexplore.exe	28
PID 3068 wrote to memory of 2832	3068	iexplore.exe	28
PID 3068 wrote to memory of 2832	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\license.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d91d515756ed3d56237c84f71a2027b

SHA1
6e4cb9e98be8349b5d40370ec2b5982c1789012f

SHA256
31cc893d9ca80604febc8b0cec4898d7b395da8ab6a49e15189649be4b891f9f

SHA512
585036fd0ae37d810c485dca79db549812fe22552341cad2490cb66ae8ec39b21d28ebe9363f48d2001878cea71a9c9dbc3c89c88323a817433190a309701b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d9f5aebea036295492401a9e2590c97

SHA1
5b61b572317c70578ce80d11af425dc01720262a

SHA256
fac07be416799e22af776c0749d9e005e2c4291c871c1f9a7cb20a9fe7f0ca68

SHA512
46d54bd0c578fc0b68744a9bd28cad654aee28d78d042ff204e7f3a2889a93b0c492644a630c5938912752072b5fded576a2bd000d76dd42c74339231cdc109f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
355a591698f0d758f50cb585d9b2dcb5

SHA1
4a37ce8dc4988ff50b65faeb663e9daac421cc68

SHA256
c9f424eca13bec2aa93a1571ef01f50467e4f3b824eb5b902a2f2d3ee3e4174b

SHA512
9784faa948207d86c5b44db73794277dda0484e0d11468c3b987eccd9b916b06d73a245647e344244ee7ed3c7ad525abcaa3089b5613946088c438f17deeb611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608e5e7790365dc3003cfa4537dfc4e0

SHA1
a193d5115c619d59dbe29b010fb2edf2d472db5d

SHA256
9ee88d49d59423269f03b37455913cdd7c31db56bad0cf6c528c877b4fe1c92f

SHA512
69670457549eaca99f6c4b02857a3256c81bde04077bd93ec302e5c805fccaeb2d1758bef96a2895a88d1fe0ca7c10497cc32d109d4f8ccba4986b5c1241935c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c56fc39f74736ff95279f3ed740ea23

SHA1
9e32512a5db0faeac14dc2b758220df6651e0843

SHA256
cb57d83ef0ac0524b7310c66b5f39179c72b23d0d01079a1293db09d16d49c79

SHA512
f30df0d3000d74fe0cce6ec2366af8100053169782ebba3862a7f339f94000c1a2f69ec2f1b052a85ff6eae519e3d819a7041b2c141f77f4eb18a94d6573c1c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57dfd8d259a9f1dd3cbec57e6d886429

SHA1
030ac3f54c39104bd6abb52caac35cdbfb48a10e

SHA256
da97dbc11ddba06a3996063a34843c9ebbab1eea213e66498e317f030bbb8c40

SHA512
8fde6907b37bce01099622022f63ae44ab80fdbc3d49bc815a2a37883828029f7891e4c4904dd5b970114411c39a9767e26a126e4c9aff8c96876987a6041b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2351f60e29392a5e84e287c836eceeb6

SHA1
3c98bb7b2ddc0fa8145cd7170c4bcac5eaee3461

SHA256
97b26421b0a0847e4226a1335b458c1d5735a3b7334ff7f723a61dc3c5009297

SHA512
e6aea9a6b366a5e4c3bfaf83f9912143fe18cab1b24e6bade5ae3e275f1d5aa5117c7088ec08d2c12673c37b11914a81bc85661ebfc4fa10fbf44b4509666842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
507e4b91f43ba623f6739b96c27f10d5

SHA1
d038d31d9c629addc432e4f7648801519a274b4b

SHA256
087b214290d6a78b09f4e877492892090813c069dfb000a508bd6ba7479a5ce7

SHA512
76c722251f069c048e690778e3dccd45e943b6fe87ea5d8a7d9c2d1ea3c3443ec81829c7f762b3e29446bbf8c85764159521c7b0586c404860861209d45f8ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc9097504268f1ed7827f75f0791998

SHA1
24df4d46ed489876e44e1fa19068cdc4b4408990

SHA256
b1b52a5c1a7c998adc1d982bdb459da5df78d9c3484c0f93c33bd8f17deb841f

SHA512
91e24d15036de95f3e27569e101ed80433ec74d1a70371241b6656693d1efe098eb57674c5756fe181457cb756646c5775025cc37380a9b13c5aeaf72a1af68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc735494cc89008521d94e7c9cbfbc9c

SHA1
42033f6fccde5f01932a91e0fff2054043860e80

SHA256
cc6698c2f778225f6a21e2e24e2bcf72617ed49ed158ad546b54e7729d1918af

SHA512
094d3f4b9c270c92219c2203e869a9752f6d474901c4e7e7d56bda808f8fbce8e2bcd566d4cafb1dda17f97014420490a7aa7f6d024b561a3d641bc6aabd99e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc83e7e7544ace94be70846481d18dd

SHA1
f92336aa32076311b3be097596729c6108a0138d

SHA256
11e24d997f28e1c636061f2fe32351e8ad7cc2c0e4b94fb131bf5bfc7e266887

SHA512
7b231cc3a885a2ef128d9bd7ac715fe8cad6c4df28bda3678efa4328d6d6674c5858a4b9a1fd4cedac020ffdd1c6f4905b329fa67d1f3d3ccf4fa28f7b647b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1A4.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit