4750303ce5a24d4adbc33df186560fd813f1b3788734e38c5320c904ceb1fca2

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
submitted
14-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

license.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000031249572072b10d0e684b13754d5800e1a8519cdede2f3b7c103aaaee4ef3053000000000e8000000002000020000000382e7f95496e80774743197fb1a1a4059e6bd67c03c19b8615b255d78249117c900000005ab5962f932642957dc28e266c16ec35f6209a60eaf3ff0b858460545fb98c40107e0867a6f2b3cd15141544dda62fae6b5f213405eb34127c2893c65e9c6304bdb7566196c7a33a32440e3cc848e14d34d6eee951b2d8de2e8502ba3cbdb4dc8ee59794cacccb78482ee4be9931595f46724a3ca1edaa19770b0f9226a2b24dba4171af251570415ae2e9f512820c4340000000d772905d6d3c1663c44501761c80bccdd17891e521c5f99fd4d82839263caa6b1be30b1e13676971d79faec6af7e5deed121b81d29828afe05040e399c203a17	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000000b8cca8b5f4eaaa73ead98a92645b890714cc5095c3c114e3f1246d5e1a48d95000000000e80000000020000200000002a32790cb409ac92c7c812e3a7f323a44a71f1aa21d3ac0d163ee1146bd8488420000000c424a6a67db1fd9abe7d2fbb31c207b89a6425c66d9f2e3c8944d96945943b404000000037d3e401f284e546651b7d997f5d754b4032d18209fcd8145b131fe97857a277e91d20eef376f988ee0db5eac37507c45bc78017152871cf574216d2101f551f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400890697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DA5DA71-534A-11EE-865B-4E9D0FD57FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a092acf256e7d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

752 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

752 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

752 iexplore.exe
752 iexplore.exe
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE
2348 IEXPLORE.EXE

pid	process
752	iexplore.exe

pid	process
752	iexplore.exe

pid	process
752	iexplore.exe
752	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 752 wrote to memory of 2348	752	iexplore.exe	IEXPLORE.EXE
PID 752 wrote to memory of 2348	752	iexplore.exe	IEXPLORE.EXE
PID 752 wrote to memory of 2348	752	iexplore.exe	IEXPLORE.EXE
PID 752 wrote to memory of 2348	752	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\license.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ed4ce640e0d0231ffe8b71dfd345311

SHA1
eb9c8992956a03551374ecdd951c2059e144f2e3

SHA256
5c393d413b42af3619277cd008104d2d736ab1b61c6d0991073cc078dc9b7c95

SHA512
b5726411a6487f38048e788ca276880268f1e7846a2da85404f481d25a817be342d338cbe68cc839d89ee02e9f5c46ba0fcf74984f92438c0823e0db54be408d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5198199f3474f9a93e6b010f7eac3320

SHA1
aee2775b6fbe41180aa2599a20bbda54e9b75b1e

SHA256
981f9c4eaa90dd356813ac7428b8a7c1655024b85cf1bf4f6fece7d5add1f07c

SHA512
0a76cd3e573f7378b0a69bfa476b1fc47ea1d1151ac5dffdc60822a7c54b5726c7cebedb2be84ca7f01d2e06c77e35e1a373e35413ab5748a3c78128601beb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4872423272d87dab38a26ec4eff546dc

SHA1
dea5214ef99b7d2602a824e4b6b826d5fe3a9d17

SHA256
c05dc950aefebb840eb094e13a9c919e5c202c5833686fe2e6a5fb8dce69e6cd

SHA512
a49cb15223f5bfc513ae27697282f6a4c39308306024e1e2bf9d67f08af25eadd8611262a73457821126be2cb49ec3bd2f9b83ec938c972a7f0d5ad0afa74c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f161fe1b482bc85738455b0fb7692ff4

SHA1
50000a31b49e0f93a1ad40728df5a27d8f6ade14

SHA256
06cd71060c8c3c5e3e977d022d53f701bcdd94e29b12eb4c4832c752e5ab5bf5

SHA512
fc8b839e7cbd2bfb6bf572d54454da3748571ef8b3d60798767a32b194f0bf8b00961517ca6ecf72f2c0b114386633e6cc19be9f56ba499acdb648dabb393964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4341023d9816a070b0b41f670e3ca559

SHA1
cf23d55e6f58799890fe7ee2282e882d43750340

SHA256
23ae011d0e995143e7d75cb590c026bf9a81c6d366601dec0741062b36067301

SHA512
3675d2ed1f5670468187230353c0950da6ea9528454f709f4b38395648b067126f2c6029af409d4c82b81238350f44c484491368b6e025d6206a5ce18cf297ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
456c09577ef46e490bd0c386556f7d31

SHA1
1f4836627b0a45cfb44a9459a2016b58788e9521

SHA256
21c137a6c359cf48164fd390fd304cf5ce73e029bd92b5fc5817ccade63e7f1b

SHA512
9a9f47b82a0b664e0dc27f935fb320679ab9450485b13e1e7337331f4bcc7a5e604eb4511e371f01418277eb67d04c65d8a93554cc9f55231e2a6e5204ce6bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ddb648b57a948d101a583afae83087

SHA1
498a6e19321c0e7e659a7e92de87c79db19926ba

SHA256
bdc054aad29e9e7973bcfdc6b545feaa13aa5a5cdede991d4cdf789d0b72e80f

SHA512
f9e311c37fafc57aa54ef0a63cf33427004f48889ce72694bd683e53152a6657e6d3bc54236fddfdb48d0552a18755f95c4c3a039dc44a1afd7ba8a740e181b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad4b0de76c2b1da0272f5dcd27f539dd

SHA1
daaf5ec024972b99c70665007c493abb712b4718

SHA256
1ff1376976a9a8a4c9943d770032d0d6baa8a1498116c9c02bdd73762114caf1

SHA512
b5a234120fac264e335b9917a0a4d28298be49b389c291d0ace2f36eaa4d7cc9fc6e77e9ea8245845c8179aa58b39ae7b9b70c7be273e9615e067ec972f8d243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a642595e7382b889c114ce772047760a

SHA1
fc2c32202284465019954f3c9540bd0236b5c8b9

SHA256
41581219b59813b5c4cbc2ee879b633240e6464c70149cbe06d69624bb344a77

SHA512
4df79fb08addf3f22990f3c9e5becf7638feee934238a7317d99aeae3cd7f9b380e0519bf8964b6df9aeaaa2578622823278b686e2d840448ebee0d61aa659d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56ddf0fc41465585d53b935ce498daa0

SHA1
96db34beb093e95fc60dbb54af815d2135c2f835

SHA256
92e7bcc8aa837e5f24e271f9ad40a084f9fdd4a4794c3d3ffb2debe7fc20cc99

SHA512
e6a128003db1b8da9311f5a2e24c234ce3a90f78713ddc974dc7b920ee789a94bdc4a8e0904828adc2b5073dcdf4e9aca5a86d5316ca17c8f8716463e29a3df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de92c61ddd1f7a294db1ffa657f56e61

SHA1
cde93ac0e650dc9ef0a86125e95f779b2c271247

SHA256
447ebef46b4ce5b9ec4366065262c2e085930b78146d8e0e9e0a40af0b892eb0

SHA512
75e7e48e5208393febae76f84f0cc5f7b4f4f6d37212f8f08543cca9d6dd68f68403d9d772f95fe792491413e37e32f4d55108f8cbe9e5cc77785f2d856b9873

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A53.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AA4.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit