17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b

Analysis

max time kernel
135s
max time network
175s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10.1.html
Size

989B
MD5

9a610a7b8ec7015ba68f35c975cb31dd
SHA1

22604b44702e922396adb911526d56d37d1d6081
SHA256

7b54ef2b8076b4ca243a19f3ea71d6db33aa82c2626bcb4e3af8db1e4fb93729
SHA512

e52d078884e579ad407f7233d743010b8691ee7d8f45589ace8bf80f04b1a9a4d0e1a3de88c3c75f5359d25cf8a4fccaf6a605d4ead4013d8791b8dc3551d1bf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000036f41a205bf747484455ded55386704adcf58bb7c2909d9ac749315bdf7bb05e000000000e8000000002000020000000610a07a684d3d71d709983dc75b8ae8287bb7c83ecddb25852cf195edebf9a0d2000000075e623ea065236426a2b10baf61a95bb2d5a22f8ee4251c58d070c0b11f8d5f2400000005b94f3bb2f06dd4759fb68f5006ede762c087fbc2d6a914f9c30ad5a8ba826b84524bd83ba0d2b89e31e73a0c135225337b61514df559d4d18c479602c37b795	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D896CCB1-4849-11EE-979C-F2F391FB7C16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801f6cae56dcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000049d5669429e022cc89e1bb95cef5d286aa646c9849944048fe25ded0d272b1b1000000000e8000000002000020000000e51948c62bdef6ea4010eb527f8c70b6564c3623646cdfe65b134b5475eeccd490000000426c4777d05eb978e9e16d154735bcdc9a5736c299d746c053cf4e08ebf98a3b1c879fa8a9d56cbc45c0205983756a0c1601d8cedc668f537afe4a2e66a753248bfac7a79552e3c6f4e7faaca10c867547c50ac6c2fdf4ba22ca176e8c7942c6697d66fe946cab948239a6e3e5a13c1412b267b6933af0f97445f4d55ed650075a6e1b18b252d427f25c6a6940fdfbc640000000c22685d140e1d4661b72489e5ca0752e7b8e462584fb093c0b6e2ab06fc711d02f018d21c078660eb66c6b68428035192cc51b7634e98aba1f817a2b6d6a4ffe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399681140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2592	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2592	iexplore.exe
2592	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2004	2592	iexplore.exe	28
PID 2592 wrote to memory of 2004	2592	iexplore.exe	28
PID 2592 wrote to memory of 2004	2592	iexplore.exe	28
PID 2592 wrote to memory of 2004	2592	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10.1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9323f5e3467b520e4c31e922ab8e0fd1

SHA1
3ebc039f7a3bf50aea64454c2aedd86f914d2ff2

SHA256
911c62b7ec1ae8c4853d7f3a10297a7f13272c192f927120ed4f04e1f668db8a

SHA512
807abe210d40048a0a9782309d2bf44001f668cc48c7865a104f5fb01032b5b7659cc323ba4f8f09bc445d2ffd7aa2978a76131918c46bafadb465a396317531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10fd64d536db2720d77a4b12c78e5c69

SHA1
bdbafedfaed2027346a674b8f98c65d3e163880b

SHA256
a5b4cf79d3b7a1846196b219c3ac2222278e635764b72c15625df40365185b9e

SHA512
22e8b03c110d6cba648933498d44509e84a6db53c093d7dd6c723cdde765fffdcb1f32fee6ea2a8cffaf88b1248db6d6c6e651fd08c15b95af5602d2a0055dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7d74af19c9916ad310c7188173dfff7

SHA1
181772e88b53519da2a6ac7722520ca0dd07d188

SHA256
a1c804450b8a4102c1ce49bc437059d76ad18a76727dad7d85c34934f5c12544

SHA512
04c8ff4432c9dc5181b29f97885df71df23c09b737b5fbab6333e1eff5f9ea8f17d04d567d1c74abbd8e4b4b88dffbd052bffdb83fd0d1d79e2f5f8adb5b4b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a700761685a820732fb1876d59338ecf

SHA1
510fc8011bd26d8abbfc9cfe6a84d2107725aa24

SHA256
47a97a3efcf4cc3dbcb8441fe8b4579c7c9bb28644011ed10b2b0702e7156948

SHA512
3bf3eb7bffa35bc884e1243cf73c48d5ba98e2d653c80d49ea62614fb53e53728a354b344021f067a31ddf2aad9133aeda199202334ce9f345c1a7ba53bc3209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3122a7aa8425ca0cc11a952c7171ae7

SHA1
9047ee8f0485bb2cbdb541e3f34272b4a3e89857

SHA256
0fe269dfff1bf99ec4c8fcd2cc19c31ef7221d521a8e9305ce223950a1e2ea2b

SHA512
cffbd21010e643fda192aa086b092b12215603e13b28ca9cc86477161d160cf4de229c3b34df0994a521886f055866c222d1fbaaef5dde430b254ce881871749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1861e2385a30d41cf6ed43e268d92f0

SHA1
327a394306985a0dd77988ee111d454c4ff07f6d

SHA256
24f37c17989c79d401848df27b3176648fcde4cc8c07976727973d4ec213758b

SHA512
a13332c54b6ff45cb3b0ead28ae1d7be90b19c1f30c06c58c52a30ea6d9fe35aee981df1261b2f200f9a42ab9f96bbed53effcddfaad7f6afd7a511d533e7951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50466d6b1cd8f0a172af184ae882517c

SHA1
929b57cfe27623c2ea214fcd15fcaafbcc32f8f2

SHA256
f3fc780b18ee96dac4ef744657e65f059eee26e4792e8ee4d1d841b4acb4e79c

SHA512
dcf2a93aa5d07a43da419b4ae020dba265d2b1a5381fe4069b4ea854f2f9e76e8f0f95707fb9d8f0f4683fbe08b032c34bb3229a076b8f22e4e3f24902eaf2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d3d6d56509f1c5354c2ee0b433aac2d

SHA1
ab27e792014c61c178e86a14a508aa8090528f3f

SHA256
38db5da7e9ae459f8c775adfcc0b1db063ea20e5692441f0392867d8154227b7

SHA512
32189f5d00201f09294785d918a1ca2e988324600d303b2bb8a818ed037e4e6cdd076b48080ae75b3239cf9cac89edfa1281f70d0a3057d0ead7ff630ba2d35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE5ED.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE808.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit