4d5ba48b68565014882bd62fdf885978612880270aa7c5269d755692d64bd7f7

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

5KB
MD5

8e28e6ee1e0ae180ee5033988127b644
SHA1

3bb12a6d8ffc3e3d46cbc6775d5b25450d8dc6f3
SHA256

4d5ba48b68565014882bd62fdf885978612880270aa7c5269d755692d64bd7f7
SHA512

f53d2e9ecb031506365a7fdc839755da3ddc6738f7c1d54bdb503201681dd662cea9af1d18f2a73a529f4e402536f00f6359e291033c6f42e3b85f4e6cd0ddde
SSDEEP

96:PNysDsT2f89IXo4sG/YwoE6odMMp/URruJtRVweG3NzSl4hN4Yzueh8NuN:PN1YT2o8oS/jZ6kMMFVnKHZyWN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000fbbfc076c99d47ce33bc60a0c754129cc7b241a3dce9b17e2a60f1aa72e1e859000000000e80000000020000200000006b22d95bc861cf1023f31c0a472c89517d4acfb02088500ed6d49eabae953dca900000000b0fda4ccf9899ab174dbf3dbfbf061642068e406edc091b04d153c6e3b74a16e27bc7f764ed1aed141fd51531e257c82c1deb6a9534bbe69f7e86f07b534cbe8801f2d00234e33ba358dcd11e85ae8e599a53300106cb19fc99b036b2c8161516d46bdebaee2ba23ff4de8563f125f2bfe9d1f3b8c00396696afa1ad4421cf666aa5897d0cfbafe3018a826479abf11400000001e13a1ce05b9dbfb6e83b3e33f7bf965cea514c99f473022797e251e0bc5d633642c957a1ee3d7a9ed39ece8f9baa2090bae1d383a734de900242ea68ae98bba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d3078305dad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE1575C1-45F8-11EE-8A14-FA427F214E3D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000547cfe6b0167629d6e60fea703e619685bce1995e7002d8cee103c54a2f444d7000000000e80000000020000200000003d5bb5118fb830c02140c63a59ab10b6e51463a7bf1ae5bbd00afac32d6f8b51200000000063c5fad5d382997e49546c0677e9b05d9c66c1c9df0bcea75222dbe09ebbb640000000d5eb24ebad42e11b23d7560818428312a4d36b1a0867e5485632642d5dbddac21ac8a16d014ef8e2d9a6dffc8fbc39f2f54e71c12d16a5ed72b572aad365b897	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2236	2224	iexplore.exe	28
PID 2224 wrote to memory of 2236	2224	iexplore.exe	28
PID 2224 wrote to memory of 2236	2224	iexplore.exe	28
PID 2224 wrote to memory of 2236	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d00123b9bd16f414a2bdf2defa7d446e

SHA1
0e376a66057538c89ff62dce028f17c73cebb741

SHA256
9a4fb360797fb2a9e346b1a2dbcf2d83848bbb7f7775309152ce1da0b6a3e8d2

SHA512
77eddadee9dbe29a1324c10331639b67914c24e17a84e32f83c0eae15350d0484689507b076e40862372be965b3c93ab712f061aed41ce6a377822f578127671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38ae30be74b45334874b772a7a02ac6

SHA1
c9003418ce2c5d7b4aebab1e3d1acd6c24fb6540

SHA256
0a0a995b7759b9a6a6bda6b4403f474bc8fed4c7a55562750ff9861d083b284b

SHA512
4965c62a9cf691686c779fae63e2335f08be7ce588874484877aa02be2d5beaa8d56d992e730f2500d411031df63681ac30b84c17f0fb2ea3d2ac5c6bccee786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c0c005ddc4e13b2b0f9ef7a493c482

SHA1
4fe04687cfe585ab1122d813676e523b3abf8f8b

SHA256
e0f2a7bd6fc9de56251ab3e31f05e7c2faf3aa3d4618565ca9d8bbce06ed3673

SHA512
11893bc0559f09083f5dd1497cbab88d6f931cf448b3cc0bc16f04025f6f9eea3fff52f2f87eead431f306731f534e98ad39fa4f88d09a38c770d66f21707ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855ed99c5f43ec6a9cb59ce91f3dcbd2

SHA1
e81c96ecc06e31143c97bb595b897ba4f54db6ba

SHA256
59fb923dd6a5f8a711834f0bf2dbf795e7055b779b1f6f5fc0733e7907a10b2c

SHA512
9f437d972c05d5878878f0e4c56542534c01aebc6a5661bd17389d120f00ddaa23036157fd6bcff8cad0be372c6eb92d251b81a49e708f5c397331c4dd8bd881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
213922d31bf40ef5d89b89861d4477fe

SHA1
6538c6c3dc48e4381bcce25cb1f8f27003a717c6

SHA256
3a0dabd60d1391a34670cdf8ff6f5aa80f3f47024333ba81b5d0ef7723eedf7a

SHA512
3e33671203ac6d2f2644e809e1efe3bdc0f595ff0f1a8067d82a0c6a3097f1fd7c67dab7181e2763eabc8eded0e81917bcbe6b253be1a5682802da3cf14b2391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ec2aaabf0f70caece7709c9eb3b1db

SHA1
cb8ef6bb7dfb78d6babbaca48263b0433dfb1ad1

SHA256
5cdfd489a81eefd3cea963fb6a888f551ee809916db77a5f08873972567e4ec5

SHA512
95d3456af6babd4e60da014abf4ebc66fcc208801b571356c6731d467696b3a4fb698e37b4eaccafb20c347173a7a76ee4db4dcff2fc79766b0c92a3e8b39c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71407275d1e64db5ac2ae603294e3dc

SHA1
38c7429bc9b6303fa54b7b648f559b4316fe8256

SHA256
994a180c48d82ec39a26e909708fa26181a374710e86675fd58ff6b30bd87191

SHA512
f1b2bf80c77f6e46d1bea98da93c37c293850a846d42e8710a81f20c0b1ea2952a81e831eabad1aa0635fdb29125aad23019a08c0995a0557dbb092d7529a5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9371ff05ec264d3eed302c29c4425f2

SHA1
26665caa0ae005014065d34745693877f771eba6

SHA256
f56bdb698e0f41129efb29733ef2fe8e20e428ff497a1d7c260d04bebb012640

SHA512
0a9fc04c5844ad5e87b92928b82ca58cd872f7bc98488ec7b67b92ee073d402916ef481b40f8e729971f9c13a850ba0e7b4cadb0c7e72563459a00925a6ea025

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE275.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE432.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit