c0c8affd1c31a341db91246ee7f281199568d8ba6ab8e3e25bbc0b791276f351

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

warning.html
Size

2KB
MD5

a61e2a0530bec9b307c1075f9162f549
SHA1

267f3fabdf909f341d2e4c57eb17f9226771b61d
SHA256

c0c8affd1c31a341db91246ee7f281199568d8ba6ab8e3e25bbc0b791276f351
SHA512

c5f3d0f2f3bbcbe9893beca5177a343d43904eb4dda350c45ea6fd71b8779cc2e033f72ca77209746dc41dfdfe8d3d3df906cb617be2054db022fd60f32389f8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e289985cecd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C398B651-584F-11EE-8E0A-7AA063A69366} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401442878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000c6f084e42e0e219dcd788136744c57e3edcd3611a1841247e10c288463d8607b000000000e80000000020000200000000084ac3d691d749cecf496cfbb668fb44e5b6ea67519e4536cb6836f7645c86920000000d1a23179dc49ea63c5b2e08ab928717cea477dcb49a7f71f6951850c53777cc540000000dea6aac2c346f3fb37ddd82e3ca00e2235d11025d341a7bb03253abeac70b4025eef5329b7b5b0044a9894c891df4b85aee37a01aabe48650311ab725c42163f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000c18500efa6f9531f4bc2089622744f543bcfd49066356cf81da060eb80dd36ce000000000e800000000200002000000071fe9b2f46eebf4f730eb8dc140c5549f1641ca5a111063d0c880758f371be1890000000b71015e5f29c307caa3fb04ea78019c80eddfb819d8fc3d7591d31530c0a3fe873ccf5e5fd1ea37c75fa96f934f706e7b178003ce8b6190af93004448a7bc73c2591e2ec3c9c9ea7ea686c529a60b88c2be22f8e8c191575e8815b9b2e461cfdd640d326dac5a17857ce00bd5a4a06a3e95505fb35f8a006ac39a851e2d399a76d04c00beb7fb00b5abf799ad71a6a754000000032ab0f7b38390341029ca62825dd03eac4a0fbd6cb52f53f490feebc7ab3dd8b73ef4c2e4034c40fe6b10dd99da7a202b863ec7fb56e7a46c4eb72fb2c243189	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2704	2236	iexplore.exe	28
PID 2236 wrote to memory of 2704	2236	iexplore.exe	28
PID 2236 wrote to memory of 2704	2236	iexplore.exe	28
PID 2236 wrote to memory of 2704	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\warning.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3ad34a32e29c7b47b83ce65d13dfe734

SHA1
d4e1191c18a89d26ba36d21bcb670e6a88a99cc5

SHA256
03b791fff88db30e49797b952d18a9402cbb4f07967ee148a4e5fef9466fb0cc

SHA512
3edf3b8e3e9b72193b5c1052a32079bb0005d262e9f69ae1a76d521867e2fe85666c70b5606b6996473a6e26b18a7d868025758e8272c9185f0d03601fc846bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0463146c39405a446aa7e673643721f2

SHA1
3f4028443986cef87f74bcbc63afb05b718bd4d5

SHA256
9aff84156719e9c891f7a76502ac852b378c887c5d38653a25fbc1a35912a977

SHA512
f0a63c693e0b89d7f89600ee15085d9a1fd109b7c1638d9a0faf5968b92e80e5010688ff4430a703d839c572d34581fc0b637d6e594c4ca333b18c690f367343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d4603ec05aeb35c2f350c55796a29f16

SHA1
e39471b14f03249f85e69c119b4eacdc60020dab

SHA256
48bbccff6901f57793ada1408871235b0ae1473ec660be7db1c1d45c229592f7

SHA512
63a93fec4fce4158381455ad6624c4bb46fe390e1069426f4fdaca667b68b8d60d7af39ac70c25b96a79385d866e712e1ed1e45c28e33fea21691734e87da883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
354b43d2edeb26e3fd58c0ad3ae5e10b

SHA1
403e05b6518176e1b9c772baa10862c356d880e9

SHA256
16c3063a7c7aa17d8bee883b1cf73536629e05a65fdc5a357fe7c94df3f69e82

SHA512
ab17c0d0245a9e10d16346ebc5c38824afe40c68e495fcb019a6d877d5336189357ea390000a225bb1a8bd99c7cb1330738c0bf8ade0b8f785a9329f8db4857b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dbe23edeb9b3fa3854b9d340eb3d221f

SHA1
d0ece33cf07a75300c9a041fa452006f4b65722c

SHA256
701051c5f5a7672c0f27407e44e5ee7df33575766eda2ca9afecc8af04b8af40

SHA512
a4380bede4352e2c4f074b8e1467329227f2d80ea5dcc12ce38ffe13a5cc9aab7f0fa7a6dbf0818fe818905a45c46a9fbcfef3cfcb0c04684fefad93e827c845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
91997f981438fcc443854ddc6dcc3d75

SHA1
20f82dde038f05f8bb65c43185631631effef29b

SHA256
20e4dbc861307560a8a296c91663bba55480ae77807f35432a1672ea8c7f9c81

SHA512
bd49eb1e0ed9afd813aca5e975c295329d609e3184002fe5504f20c8e7b54f93f36954802197e84528333be170b560db2f16363fb1e23cecd0a7f302fd0b4c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ace2ba9b56aab72e30f05690d7771f7b

SHA1
0cd9da07dd37972c357ce087fdaead7c1b777261

SHA256
98fcc2e0d44dc9278959d3ca85e439e368acb4f3da63c2b898a35b0cf3899695

SHA512
2e1335fe59e897544f5a07144b2837989cb2aa064318b5eab850e4646f555388e85dc20ce6d5b57928051f4266776cfe04c6dd283ada48c8919802ca3d5599b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a3857decb40d07d7fb158b471846d159

SHA1
47eeadbc49518184c1b61185665dcb1e891517ad

SHA256
1352c168308a495570cc05f3b840dd1ab09f7b3c7878e1744060ca582daa04bd

SHA512
51e85af7dca900c15ab48ca3f888dc152ae874e3df9f7162ec849dadfb0dd081a3d6e68f7b62b800009f2fb58fa806ce826cd1c85687c0e3154ca2a1c283277e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f7e07343f6628418166ca3d73860564d

SHA1
e8f9e39480fa8d970f0515d9b0f86b00f4d4647e

SHA256
928ce51cdada6c8f20ff9629e32758b4ccd49463d8cc576b8af07831bc5df455

SHA512
e87c40e40b441cc4203859550d605cf7d308856a1806bc2350f0805e0a61e8e67f3e732fa0cfa7889f6591368813bcadb584e7db6c6a76e90911e278e4a7c1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e3875bf5a085c970ded0d0c43a439dd2

SHA1
e7be18266ff88c4af5cbd35052e95505182f8ea5

SHA256
e2d941a6ac93b0721b2df01398ed1886d5eb29a4b641e6516aec0585198e1da9

SHA512
75025123c94020f35b1e4dcb0d52100940aeab8b7a5cd316c6e6ebbef22a847cc398b74847692b4dec02fde0fd7f75347cac61a22ed7ca02cc8f401226f6faf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
13a1af8d2109d0e3ca035c878dc0cc34

SHA1
4da582d18ee9f0a79902bb8433e07e2bbd9442f8

SHA256
c632dc2c6acda5880ed6e7bac9f29344a3735222465fd1bec39e652e069107eb

SHA512
094052439434e4fc104a28f146d5923bcfbfb3d76da76bfd2444bf1814a1bfb45de7cf8799fea3f0ee00ec333a06bb242c6b5adc67a74a5e194e7e33d17a0e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f93d2b5224e0a747276034330adc4fd

SHA1
70b76ae74ef476ad7dd3c9582401a3d0c04438b7

SHA256
4a4e0f46e852b1a8a4f37a1811c4246ab44f03d86826fa02716eec689f0188c0

SHA512
e7d04e457b4e2407f766df2f59628a6d1870bbd51ee8ac87d60a612248663b0f33464f14b6a6339bfac6d726d629a1e0792fc6543aae3028d7b3d2a634ea3006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fe7171dba6f3db97b2f140ad252ee184

SHA1
46c638ca5b0b01512e2f915d8e0aa718a4ab18ae

SHA256
a715b3360f4f7d63259e1fda2cee97a0943986a612353c87612cc837c5bbe011

SHA512
b6412368127b2dd1dd5b5060d164cceac5f84274fc971aecf18a938081a22bf97ed4849a4044c4192e80d136e5489c725ef4303959db512c27bfc6e45210e6cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
92f438e7726b26a468b2303fa630a295

SHA1
a5e7d40bc172c356ddb30989f082b62cdb0f32f7

SHA256
b5276bd0398533556e5a7d18cf7ec202589271717c8ec45c8b75b5fb62b85848

SHA512
56fa632c22e8c25da484d76ec8b042dced7b3e08369a65277d9600daaf4e33094f1cbea6ad0b849f7456821cdc98b227776fc3b1bf9a9f66e80299d380ff71e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f0c48a5dfd056f059773feee20fac74d

SHA1
fec9521b7f1db5411d4863527ce7863b5daaf61f

SHA256
79aae4f622b7cb401f92f06d67b24d84019ddaab86702759a97a5a5b3ab950df

SHA512
b33d15f012f1e38639c879c03d5495e21242aa096b89fc3cd2ef27a7a3335446ad3f670baa1c55bb0d424922ae691fa902e5314ae2c4b55ee0f3142213e74478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d0b8be7eb8f091d73c5346805a6a6430

SHA1
f61503b727fa1ce29cb02a1ac6988eee2903d1d5

SHA256
f8a31a14570b9769cdc2aa0b6a8112c9f2202af5061151e24b803fb2e37255a8

SHA512
dd87e061240c0cb106ae0b9466b5f8255ed81e0d9b340140eb2688b7f9e93dce30b86763e979c552f39199e1a2b6a895886c399ca54596fb650c8704cb7e235a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
171e913cdf6f61e3c00e7df44b3b6ec0

SHA1
17d12b2cc115a065d436376015b649b6c939febb

SHA256
8ff1889265726a0f6896d5355fa1342a6f55f4c9fb85c4bc6d9b39ca5e0708a7

SHA512
b7363ef5721b81c9dfd17084e3cd51c6faaea837272964d9c8222370f0a7fb3af3f85d18de3f71196693e27cc9b70acd532a099ff05ec9dc2aad3924616ccc88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6901.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6992.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit