b59d43079747f8f280d0f2080cbee060e9fb7d3e0ccdd2882f6f5ffcac350efc

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mit.html
Size

1KB
MD5

2b59448d2bf91d9936df3d3d99512ed4
SHA1

07db88895c80a16dc12c7792feb8b515e883b3e2
SHA256

afe4673d52c4a4124ada793652da0c69f93dcde8ca89c0ee82ff17d34c5c9139
SHA512

c7efc4a9bba5b3212db627e00a85cd736aa872e30f9eaffe7161a89cf0c8eb2d8b337ebf0009000b7a165bc8e4e6498c237925e7649151138ab499d092df0784

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000002e7693727371e3ce483ca18f1c84630ff51bd6e8680eddcd12f878a3b4312182000000000e80000000020000200000008690f55a542803098d8256135c87a50995aac6822b600ac8790cd421a414e1b990000000088cea9eec70ca70a4a0923b03d3f6f5e18f4f84d46323e80c8b474ed41019c66e09b16401f1a83f1408971b25c4c26725f3f0a1e13edb276155179d58b197c029dc67d2e401e10c02007bf96c64d4e0039d6da340d4dfb819050f8ee47e8eb689ae951330ff5d8c3c4f535320baef0ff5c38a5af069acb1d3d4023dd4b5be7dd74198779543bdacacbfe329d9177e4040000000b1a8500797a82b93129661178a5289c4179967c87817eea8c6b0cef5972ba3f844f39e9f54d505a9a169b5946ceebe84a8d1b26185e6171bcbad15f25dd10ab7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400977084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000008ab62a836d2a413519137b8109fa2b437f35c536e430f72653824bbdf572fc74000000000e800000000200002000000003ded37b8db1e56140f25df17fb3b710b0949168a19e49d6b75fd98fa12e707120000000b62d9bdd443e07d8c7cee1d434b1146fa297208c8b5d09d9d1eaefa662916a23400000002ae50dbbfa0eccd701fd8cc8892ff3bdff3db9a2755205484e0056322f4bbbcd7930fd772704de9f21003f55301d55fb9ef4942dd86ca94a4f5fecbab6467fe1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0050d1620e8d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41082A31-5413-11EE-B4AE-56C242017446} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2076 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2076 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2076 iexplore.exe
2076 iexplore.exe
2368 IEXPLORE.EXE
2368 IEXPLORE.EXE
2368 IEXPLORE.EXE
2368 IEXPLORE.EXE

pid	process
2076	iexplore.exe

pid	process
2076	iexplore.exe

pid	process
2076	iexplore.exe
2076	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2076 wrote to memory of 2368	2076	iexplore.exe	IEXPLORE.EXE
PID 2076 wrote to memory of 2368	2076	iexplore.exe	IEXPLORE.EXE
PID 2076 wrote to memory of 2368	2076	iexplore.exe	IEXPLORE.EXE
PID 2076 wrote to memory of 2368	2076	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mit.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
205609d324a16e3c5e952efc4bc4dd61

SHA1
fa2d953175f5b03919ce1e6175d1056f246338d0

SHA256
4f5fd736fb67e0c192d5ca4a6bf20a1acbfa1d20396709b16e4d96a9f3aa8bb5

SHA512
c7d54733e37c7896a8b4ea88c8d8db9e8c59c42e1a744989c89734387f3ab52ecdd96a79da380f6c9ffb907fbb34706068528b1c027cba02242466cb91f73408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e1eb9e158c79f30a0bf3bbb7b4d54f14

SHA1
44859eab0c57fd4fa06fb4a0a3b509f127d2e08e

SHA256
576d7b8b8f7697ef60522ec2224ec813f54eefe52933d9e53cf5edcaaab0f833

SHA512
b66d143a3e68f1bde89c06e359e6a66700c1be15515d1ba273c558578ae52ae2e353d2e93458e601d29d135101ad5806c8790d127f4e79ee633cda7342acdf21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1166f219c67c636523d5a73716d85c6a

SHA1
0c2e75bdedcf26bc9e61ac7f26ee3ba3b7935e02

SHA256
f23951e9c72693b24f8741e8d980fe1f12ee67ad74b1bda7e5392a654d00825d

SHA512
c0e45ca8846517d8a1c118b072db76b9cecb8387476848dc949c03f71c18fe015dde1bbf4b46925abc709ae4ed0a761c7269c4609504ab83f79b52ae7bbb16a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d7f09ff58c30850c3dff6e4bf20ac864

SHA1
8f0e5fc83566b9e4925a60ffefc04e6391893b40

SHA256
70e1f061965b76ea10ef20c923a8bb82086f7007ef4ff4e954b18b1cfadda8af

SHA512
93883c3b71b277b8c8e8e14e41b07c632e4fae025d701052a3ecbcf7bc1dceaa0458d3fec354c115e7853e8c2eb1e23302b102a4ab417abf24af971b57f199d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b55cc272bcd8e4ebf6b12ce5e556de62

SHA1
d64826b18a02d5cb6ef3d9beab7f2f6d93daca9f

SHA256
0991411297a2e0301c41382c63ab482efcd11f4feb992558e1e081254e4f0a19

SHA512
57ea699844256eb816abc0220143c4f0385f53b0bb431cce4e3175757b238d1d8c0222ba91eec61a768fc9e65090d078df5fe5bb6f9dd1d4df9aff6a08efa0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0644eb19468bc00f9082c2e19d0aada6

SHA1
b2f795a27f91ad0cb0c2d78715c0880eedba5bd8

SHA256
6af39caf561464e776028b9963b651fd9ba18ea6ac1f40ce32601a8cbd5cb05d

SHA512
8747d7f2abd96bbd13c9bb82d8eb85ef2a63ac1cdb36ae4c066d1b9fa05d8e797c863007bf864f29d58e0fa71ba580f6a669a413ebe992a2dfe98c7730d4f398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8344ec751107dc52c0e186c45f9edbfd

SHA1
2d10ce743c4c0bc224de4b1ea99e4c12240d413d

SHA256
282b2cffdd66c269e88ddc1bd06f03668e2cf49e49522b9db02afc7ae1c9add5

SHA512
f737597622fd10125b8d5da3753a9d9bb00ef91420b25e91f8ac34f823b010a3dd49c1067b82243e72e390609226e3f49f37f7546f9009d690d55b9abc576c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a152a0b0e027a126030310743fc54f19

SHA1
814c3bc42426eef1fca46261c7b2de9efd8d6311

SHA256
4714e7830df5e18ddda223126e0c5dd1621874c7757ebdf1ab0917c800f5d92d

SHA512
b12249da58b525948b0c23824dfecd9a9ee0d485b7a34cf42b7bfd4bd137089920fbbd3de7b8ba583bea401c112d24d85f4e6d7bf6caf9631edc5bce5a34946a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2fc6e1feb85b062a4fbb3244c298a6b4

SHA1
7d547f7220959d9582eb856c266e924cbb6f7711

SHA256
d777a854a89f506c40da24677ae97b42da45f692e7056056db1563a118239fe3

SHA512
10f5847d0a8762a75321a4515cfa1fb0b6d9cf2b1535d6e7b4f1dd9c373a7459462db0b4bcc648d8f4faffed988e3ff09cb7fdc71316bb9f4ae24514870e3ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e9270762aac622b2637be9a6733a708f

SHA1
27fb1c1e270b1a15cca058daf31cbcc5ecb82972

SHA256
377e08950a8b11b79a0836b2e877ba64397efdc250969c5279a4892fecc6bcb2

SHA512
c31fe9b91fd2cd33f505606236ea81200a911215b33b081e7068c1332d62ff882053dadac0abfdff9dee88a44d1d6e3254703c67ca67cfab274ca752cadfd610

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69FC.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A8C.tmp
Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit