17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10.3.html
Size

771B
MD5

72346cfa34d86476b07f09b97129ab19
SHA1

f6ad4b0658904e10fb9a11d39b8a0ad64c5ab848
SHA256

8909e65cd052be8432dcb930ed019e3402b91104683191d87973af624b30fb83
SHA512

e8ede3343a26976012de29a9b6070828220d7f849a06e634898793869d6db2a32d04c93f82e2649e4a696187f9954c667706b2a1da35caddba7ae82145b5275c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d00000000020000000000106600000001000020000000b08434eec3a37751451f4f48e4586f1c6c8ed51d08feb02ca0a05a49639eee13000000000e8000000002000020000000d522a478815e500f79192cfb5bdccd977fa513f1e823c3ac964e0d0f534c8368900000000383311e775951afeb71786501c94feacba85fb8ce92de5321500716f229b254f08c3711e466a7b5080b93358922400f93c722f068d2ae18114ca61ffce2f47af3b9d3c077800e66be200f37fff78c187f09a6e19a9f6524ad3ad42530b6df7c915468d55f2b6508cc85f567e833c365b6a1ecf415ec0377af5f4e4656bbdce8ef634d4655c403dfb16ca4f3051073a840000000169529bc47b268d33bc6e3fea317c74458b5a934d8d644dcfbbcb51dc271a76c8ae13af294e254e03caf5f0714d89a67715eb47aae961dc6fb1d4744d57015f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399681096"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB4ADE71-4849-11EE-9A2B-5A7D25F6EB92} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d00000000020000000000106600000001000020000000d144897bf8fa2b87de307f7419fcbe35e2c5deb0e0750e3d63eb0efc84fe8909000000000e800000000200002000000015c53d835cf1ab2eb051600ba845889f0a669dbcd9cc4f144e2114bff5a0be342000000081251e6d7c3b33324050fb0e28b7e0fef01df46f64eb128e4fbb7f105b7affc640000000e51b54f71eed4699f1d0de4ef04180c6a461608be104d10d9df1e9292cadd41cbec926683f837ca096864af8f2d6b25c0b110459169265a3cbe529f96f6d418d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303249a056dcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2584	iexplore.exe
2584	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2300	2584	iexplore.exe	28
PID 2584 wrote to memory of 2300	2584	iexplore.exe	28
PID 2584 wrote to memory of 2300	2584	iexplore.exe	28
PID 2584 wrote to memory of 2300	2584	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10.3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6f5d0d77775be2e7eb8c8e5eb9e07a

SHA1
15e74c9b2ecc1e7669e64053bada1875955b6ad5

SHA256
61f92552d4a541e6fc68278b2fa554d36b21b0cc52a305d2f4dffc208d03183f

SHA512
a03592e4f22f1de728227bd81c00e132df52ab654a92b32fafffe89ac9e5a28f55337a4658eeb265731c07a674120ee26b3a80e2159977dc65a493704e7c8994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f4cd49ad3b467012bf7863aeb281421

SHA1
725c6b06889ae59920e5d769252dd71991a91cfe

SHA256
2911ecc2e07ef53dfabdb9c52180edde38f556882279cf4078d588d092f1bf2d

SHA512
26e82f4ce43d5ca2c9b45acb6f61d8dc31114f72eea5d66739115dcd1c26aaceb8519a0aa4536ab537fad1b1be6297ba77c0774b9540ce2c9f3dbbf4b13d8272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e305992f5fc3172a0790182dc23fbd49

SHA1
11fe601256506862e030e0ea25c8b850e21c1b72

SHA256
30264d31d8315d2b0e0dd3ef8a52939ccbf1eafbbc4d6fa18bb2b1b172a28e8c

SHA512
b7b85eed697457b82fdd3a8cdf2396f514892af4879816a2be87f6b0cd8d59d94a7b7bdb737f49eff6a1ab55331571f72587f69b5fbfe0a6b5d1bb250732d810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e55c24c693c4393aabdf2f60be70168

SHA1
11375ee530ba2467e7ca156b98f331eab819ed9d

SHA256
38e461db9fa3df4ed02b302c1efcb3733b3a028ed1a7edca20ea1488ab2355dd

SHA512
9467e24ad64ec9fce4b483050ec5ed455f3419fa635bce7de05711e44f8f875df25de8ac6d6688bc8954e66fd9758bb9c85a0a1484aebd69b0dcca11d22ba0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0cb5e8c86008245b21645c5ce994cdd

SHA1
cb8452343d994ccd20fb4df0a484124f0ed3e89c

SHA256
8cd115973d629eaf7300e2f7d752982bec4a3340de0fc654c29402eed0b66361

SHA512
aefb11b63afb3ae53eed7de0bcad0c42cdaf079900ee8ecac10e2a6d47cdc57457ac541b1bfe1bb8c0a33b9b525dc88d7c7749dca44a1a6dbf77e88535b67d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59180ccb06d7f6cc1d99e84484afb29f

SHA1
a2f1b3eda12d920b91a2462ea9a11b7ad200f8c6

SHA256
fd952edf0477bd938b3b8ba1a09a54b0326b959a68fdea39a966265c3d8f49f4

SHA512
1dac38d5ecdd153cde83fc19ff413b29c810743d2efa6dea0f7043fb694c95502e1b21c43c52f83f27f5e026ac650d1eb69e1a1ae0171e60a63b0c7a1a6f4cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6efa51d2b7563f93781746e1e4a8e4a2

SHA1
07ad920a11f17f05c663366b2f8335714bb253ff

SHA256
df6f8a0c086797a8f15540e85123e30ec9a525134a066b3817698024f29395aa

SHA512
f502b4ae7b416a555a26f1dc728038bc40259547ba5ea323e87193cfb737b2ebed85dfad4b5edc32e01d99b80eddcaa16604e4c009ecbfbb3b1e62f6922a6fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b199cb6f85cd58f3f4f27acff6814a

SHA1
023f8c2327dfaad51e8c77c33f5419b7f70ce22b

SHA256
2249e194c5a4e95341ec9c7e6d659c631ae8bbbbcc190194bb20e6f3d3534fd2

SHA512
2d22083b19e310c28a6238df85e84fc105baa6f344ee91e962af7198b18295e7dd6cf761c6775f14bc278b3af6ff62cd43a5e75d194fd9c10e6ed793de868613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a8d0ec636c3fb213b512e0ef61e91a

SHA1
2751f62c236bc5c47565d92cfdb843220f2c471a

SHA256
0e6d1df5fb21fe0150b2c7b8577a54cb9ac480f80d5be367da47a6fc97bd1825

SHA512
d66159736c352216de8dbc504820289d5996f7552bb1747a7836a928464950625d4acda04384f984ee8c52225e335a694e11ef68642278629e065ef31b989c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae6527922908a83887586f36e82c3c3d

SHA1
16c054e8045f781090c5f6024072ef4144c6aaa3

SHA256
736296b45a4496f82fc1e26807b4e7bccb0dc3e1579c0f699551969ef5531841

SHA512
9a0ac53ea8b64c785ca7db9a2cb4a18e1e94e5a8b455f14ad99b2cefe42243d8aea0eb0d771b1be0e0084c96b9abd214381201790f8398609ac124f2883e9f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB968.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit