17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b

Analysis

max time kernel
134s
max time network
170s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

102.html
Size

1KB
MD5

7c3edcfff9a4dc672e520da9854bf808
SHA1

d381be90deb61d76b062d973da0b4f01febbc197
SHA256

602510663076fb5fe38060bf7c45fe578bb605991cb36a3cd91e5f28ddf1228f
SHA512

40edecc447c2f2b488df81a217c9e4a6746f924487f667fd5abaca1634284bee5290c6e3146d072daef3ba27d23147fb3cd0e6d20170e8ecf4809112f353ef6c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000000922087b22a451f7283d2a2855342c8ce5688999f9bd15fafdb3bac6011dd9cd000000000e80000000020000200000002ee03416b8e2cd3e3414c3e615194f66c017fb98de1eafb4bf1a2d6294392bf29000000010452c61ccd852d9f72602d9f359fda20a9bc6135fb6dadcbe3446a3ef0b9346de5595cdd548b4b1b68100cf4ba06faeecd8f3000812e476c9676e197d1e3e1d6f3257e08a1dbd07d458745d0c5add870811f7cff853b8fff8013ecaef45be57c4b02b311778bf36ddbff8bcadcd14016a7e9b539fa5f96695020f3ed4e23228bc8521321d7ff60ceae0ada59156d4b7400000003b0ca907981b56bd5e61719df8ee5c1fe05f02478d6c15872a4fac7a367b84ef09775dccb1a70b19c8f912cd20cb18050326539fb09af7e7410c06ba12bfbf59	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1CE8081-4849-11EE-9DE8-5E587CD0922C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20db26a756dcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000008c5307c62679452dd0af20eeb2d9ed9504bfd71737c6d6c1e87565db0ae2c44000000000e80000000020000200000006abe1e9fbab7d55d296c72ece89c344164d28e4da086601b25e237be8425d7882000000070c04fa2dba145edfb7f3b284d15762576e248b7ea60465cc8fe2437a6c37a2540000000273927addd2bc68cf3b367454ddc20bf2f0b09e1671512ae74a091318632c2460e52ec4e6083f875988a8f4e8889c2bdae851b090c73a8af9251a4897c30d07e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399681107"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3012	2196	iexplore.exe	28
PID 2196 wrote to memory of 3012	2196	iexplore.exe	28
PID 2196 wrote to memory of 3012	2196	iexplore.exe	28
PID 2196 wrote to memory of 3012	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\102.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1199506bb7111f50b1df1971719bf6a4

SHA1
4cdb23279fa700de75b309d119b740b53ff8f7a8

SHA256
63e8819eae6d2cb6615aaf94436d383af381d1b54ce9b89f5fdd3e11d2920ce2

SHA512
5b4e90fd637e2d8b02abed83168efc1a705b1cf44fe7dbca69fa6f18cebcbab6bbd8210bca7b5fee98d2b11335782e3e28e79355272faf2cf9ac3d6e81d30b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b77e909d276eaa918eedb8f951dc70f

SHA1
b1f5491a9f82ff1eef7542f2ecfc7ddf79fb9fc1

SHA256
7cd1f68f6fac1780f6d11f0d706e44298e669ce5eebeef86ad8610e4ed5d2f73

SHA512
7bfc79462fcfca5eb9f804382eddb5160809ecf9cba22ee5707eeb3e247940717465309472c1204d10cf70aa27c24ced357e740376495d7f15760d31bc40e8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cbcf5ee461e800ea54cdf994d29ca99

SHA1
b20b62dc7e78d498b7a81d490ac298254665421b

SHA256
52b983f5e72f76e19b47ce2d97d0172bf101e723a3787e98a2165fd7c4f4493f

SHA512
418c6515e40c4715b34fb465efeb64bee3d03b1e156e0669b5c6ccee22dd92905f7354b9eceee623b3457040153889d0448473a827472ca1d756bb4d49b61889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94884c93071867e0d493bf8ef21eae26

SHA1
b05a03d97d931037aa5f28f2a52766554a885aad

SHA256
24651fe9cd222c03ceeb86c55192f06cd77bcb1fc72dd0e69bcbe823a5ffbf70

SHA512
cab5ffd7ad44981450010d661cb7fb31486b1543872a6bded593ce19639f44dce0c5b5a3a40062f0e63234b1641913e332289342c333f87fe9421f6522bb91c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2e3ab5b2c5eb28e577252d02041e123

SHA1
f79d9a866888dc868a702ce244e6a990926472c1

SHA256
77e90da6e21959ef97353489ea08d40bb8798a896fcde1fb4f1d367ad0331d40

SHA512
39544431348b569a5e49c793a09521e6d025930886a6814e236b130a7ff67ce23e5be8b25ec01e943878a06e34a6685e3028027b2c8bcdfec75aaef38db9c1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a896beeac4797b73fc97fa110a188bb5

SHA1
1e9617e8ee204c5fab74d1998a8fb5f0ef5bd908

SHA256
8c96863b64c9f0f39077ebcce50d0204503bd568e03bc9fde295cd5d0df8fcda

SHA512
0730cfd5130a3954c4bf04738bcdac1cf542664cd16b2c067028bdcef960d8375658c380c2c23d45f794ab12b71ca146f04baf987615bec7d543a90c8ff568ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9984f3bdc04eaf062694f9e69bf336

SHA1
be089f1ff8e155c68e5e88f31ac07d071e9a1480

SHA256
05b6772d2fea557e3cf4e3663106c17e3187ac1c0e7f5a3aad07554bcfc2c7ce

SHA512
eab6d98b5ea146dde7708ee1b69a5fe59763b9f3ce761b0c6a9f46bbce24171556145b4d2d23fc3232cfe3b5da7273677c8c46aacdadcaa12360ab98dac6d76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8c8e559fc1dfcda66e49381568ddee

SHA1
a062177bc0eea6d984c50ae15f5d5474f5789a8b

SHA256
583a5f11151b4275c37ed996f1bd9575967c2ebcc3ce0e7c32ae2419069f3271

SHA512
85fb2ffdca44a7b21eaf323561f5167692511b93c4cc6b4da8db6bb4bea6d2533602d2a17c421a6536459821a9402ff15b25b68735a6ee7300b9ba9770962b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b2eed6eb33e7620fd3f2b3bc9de576

SHA1
f7ca1989e568146ba50e46cfe117ed1b5ac2460b

SHA256
760f6aef2407c8d0ff0f32f089bde1ce5f52053ad7aada45ac15ea5640a21e34

SHA512
76c0909d3f502dac4abdb935d43366dfde15abea349ff70d685502dbb25803e42c75525eb30d5b65d8cf24d3c2e916cf0d330ade1970e6e418943d40fa879040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8babcabea39b2018e3b47d9a3498e20

SHA1
85b575f2dcede4bcde1c7198255f53c2e9c97cef

SHA256
1f8bf4dd1d8df3e95565bb034c11dff6986f973d6e4fa859824883cb7cb85253

SHA512
43add067433ae31526d748efc1a39704f3850cbdcd4855b766c6dfb867ad57d571d85ed25f8fedafc1e661da97143a3f20948e7e853eb091bde42a96086971ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD4A.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDD8.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE2B.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit