17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

101.html
Size

1KB
MD5

150ae59149ed690ec913f46f08e0bdac
SHA1

a3e0065f0aceec6f7453da7a8d54fc5b3249ca7e
SHA256

a7b62f50afe83f3445905c3446874192a9e10fa3af22cd031148198ba376f114
SHA512

23f60972f55814fe81fc019c93eb9ba2aaed9f46b522decfde528a0cb0e2e427a817f6b4a0e7064ece1b4371c47cc1943b471515b08d3bf036dd1e7bb32a1e70

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399681100"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000c6167187298a1b13cba2315fcd14f28a2297aa0fbd4c3cc03b8ef04db59c5c74000000000e8000000002000020000000f1d6889857bcd7f876bfcebfea543674f174f4330882c91bc08fb8d7064f2b02200000001e921602f1738a5fafbb18fdbacd4e04e6276bf78402ee60f8bb5f06294b2d7b400000001c2d7100aac9f316c662366f0e63915ca833c8baef886a51cfb8dd2afd952fbc441edf2ac1643d1e7a811cb87d2418f0f4a691a1497b4d742565dc2a0dcfc170	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD17B701-4849-11EE-BB71-6A17F358A96E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4006b3a256dcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000fc6437fe7db3029ec2a44978ff6da6ac986b45ae51f9536803ffd4d99e66ec49000000000e800000000200002000000077efef875720bfecabbb65d90384626dcb6a7c2d9521522a24221b5206170e2b90000000ace9573cc7e916a02c2032105ed92879bf9b42b1173d6634563eff1501423bb9aa1f781dbbf3d0d29c8fdb168ce989f2da2516ede9462f49fa61fa6332514d75e31016d892d3d35830157c18685007e8ef2fd5f02d3fbf5da30e391c25b7e66a71857f7c5fa26ef5c25660c0ae48f9580f92ffc3adaf5e3d5766c381f3510e1d8ff1bbc6bd1f9025d38b619b51788e5940000000e2dea70693ce69818b1b6960c59876ea5396be0695fe8c5501505d4c0717c79243db074da14d3ea30491af194ed9b7b1674923fc7d0605e421b965c49627f674	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2152	2364	iexplore.exe	28
PID 2364 wrote to memory of 2152	2364	iexplore.exe	28
PID 2364 wrote to memory of 2152	2364	iexplore.exe	28
PID 2364 wrote to memory of 2152	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\101.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8021a41766348dd4631116da95ddf95

SHA1
a82817daa9cc23a7c3f9c0267b533076914c6718

SHA256
c0f1e1b07872e798c1bff5d25a8170845a910f9d9bd2ecab44b87c5a333941c7

SHA512
4fdbc1de30ca8a9d59747ff5454d13dc6e5895976a8a53ec7e9f76780da000ecf18bf96f9609fd8f7e93d46d737623a020de73f9376fc3ea987546fe2e30379d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f150017e4db800243e7ac4e71f7efd15

SHA1
5c7e3553ed08e5181d7b289bf1273c8d89a2d899

SHA256
8670c5d845b85370f75fa61f5ae73b93e5f1822fb1f67fb416c2df4e3265b351

SHA512
74520978ffdb7c1e68f5bf71036cd7b3d213dac1796221d5d4d6fb5d81d72d5682f95641ff1161cef61e025e0926a4150d3a54508081315f7c5645c1ad06ae2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f813fede1b23ca3eb902e28d168f8ed

SHA1
59c9ba70f054dbb46b70b6680e19136759beead5

SHA256
eb509d5a4793600f77a0dd4a314b4a15ade75855287762d27a024d9341d20fd6

SHA512
373e4aba212d076ff0bc3e9667ca945ac5adb0261394102920c0bc38177fa84194aedab6a2afb8e4d70557a5a308334d728aa3e067f9b698bf36bcd66c36a879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b09308534aa679ce714b444c3f169e9c

SHA1
e660b65d227a0284bce3335517acc45a039fb37c

SHA256
e2e7a32eafc56c4578ab6b34c8c7b36fe8e5de896e6f3cf03ff16be664ab8d8b

SHA512
c8dfbb065a7d06ed7cbf8fb0a33c39ae59d7fd10ed5efce74b749e8d1f01b0fdffe8bb41f542424a65903f5eea9397f1767663da5502afb6aa92949ce98fb15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
453930d830fce6a3b548227f368bccea

SHA1
5d5418ba663ee197f539358f55c7b5fdeee5c9c6

SHA256
2f4fe9e2028c96cc58b51aca370bf9f5b34aa85ff9acef593f168fe3ae32c3a7

SHA512
feab51330120a609e83a7f524540a9815f859dc32be49ef93ebb19e066422ffa7ae2903e3d5144998890d429c7313a76eb78def4ae6f244ec5ba46be2136a97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
108f1d517605b2332ff303ff6f3d641f

SHA1
cc80869966a6227c822f2bb18ceaf57c91d24109

SHA256
38452f04b24dc9e1cac4c3f9fd0c278115db48bb579c8a1e160e95a484b3ab06

SHA512
3896f0c16da36a822ec39df2ab495dea1b32d3b4cfc503919c645349f415fc22d51cbba67b742f647c0244152587266b997fba63511751c89385c7a2877436a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e964f1dae9ddf1a7cff077067aa2dca

SHA1
7f18e40536099da991d37932d681b2d76f4acee3

SHA256
6c3283e5e2222545005832830bc01f56c13bbdc353f0a089a42676e1f6b9d25b

SHA512
fdab58abeb14223d28100bb60fa0de86621648bfb18e48b8d723996460a1a1aabc366d17eab6fe273ba7cf2cdd3f6669ecec2e61fa1b7257e240fb440611f9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB666.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB748.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit