cf3f8f76d8b5d88073448c5ac2f6bf7288679c5ba1cdb5ec6d5f90f50299d190

Analysis

max time kernel
140s
max time network
154s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

3KB
MD5

b43c048fb4b3b06228ef844783673ac2
SHA1

0900aa8fe609c928c859467fea9abf0fc7155e1b
SHA256

3e687c6b6c4e5d86516775b7803dc004c83baafabe456c10c15f49d87a4f1a2f
SHA512

14cc4cc2767b659f08edd89ea3bf10a4466162d46429c66cb5983e5d51b335c992aef18b1c0c8a2ceec2c6f386fd73fb6ff6435daf4196815a4ff1e93e846bad

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401640151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13775AB1-5A1B-11EE-B26C-76A8121F2E0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000d9859d55eb1b4daaab6cd396fffeead21742fb47d9d9c349fe70319475616443000000000e8000000002000020000000f37cee763b23513fd89bc75491c4ffe1716671a94992e1583cbba84c2f8620de20000000da4b408df5657755099a634e4e4971ec4454e319a126c2238a77d79bf81d05ce400000004db0e28136eefda47b655b1c162d08500952d84f899554665002e6ef0eb1060e494da8570d970fe43cf3fd56a48816070fd0b4549727c11fc822f680d1cae0e5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f889f727eed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000f977baea99ea45291eab07e3b850d07b1fe7ac8f8830d481aebae4ba1f78513c000000000e800000000200002000000006e4d99ff84233e23620c5c86324b0696dac7b793393ea8163c350aa7bf4570f9000000079a516114de428545bdc1b06fe812c50665c40b868b3ce6ca0be6c28f42615b5a03f0afc9bf08020fc12c598c1665bfda495c75a80daac19a97b44d2710a6bad5776161c7175bcbe919dc81af4947f315b4459f97098909a3e81d663f35483a2c8264468914ba199de94fcf192ab40c2da1b662eb862218d3439a7e8bb111220149730db0b19069ec798e1c2092871e840000000bf80778e6a957fa2967b46bb563dc3df8791503e27c2a755ace519d6e6a07fd24b4f138e74f633d9fa4cc32c4c80fdd7987653ccff1a4feb201f29f5b81959f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2248	1696	iexplore.exe	28
PID 1696 wrote to memory of 2248	1696	iexplore.exe	28
PID 1696 wrote to memory of 2248	1696	iexplore.exe	28
PID 1696 wrote to memory of 2248	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb3cf8ff4bd125966418afc315097ff2

SHA1
9b34769d67295331496b316db21561fe0e306cf5

SHA256
21376ef5e2633eacf5c98b188605b2e4f9a0e2cf7e102e476017e8e1ab8a5f7f

SHA512
87980abf0607508487407dedb9341e1670c225cdaed266bd82c963cc19c5048d70d068ba64723a9ff458f32c20342dbfb0d8936a4d981356c60d08e00b4bb75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4fa6e4cbd31f9bcc5ff4fc5d7b7bd709

SHA1
874519be524c2a3aea80c34e0d4af811655bbe97

SHA256
fd92427968f1403dd8435b97e32874bee5db2414fd2d83c84dd6f0b1eb4af6be

SHA512
c741541d45ff137f5d89acbf922ca58297b7fe7612530f245cc122dba2a05bcf60ee788137f1921147dd0bad2f3161d678dbe19cab438099e935d6800df740c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e4f2cfd7529b774c27921627f7ae575

SHA1
094483129dd5cf1d527ac289db0b95d1747ba223

SHA256
85a6d0b1ae4846c5a016a83709376e4f62a3b1e8727203f90c054c2f07ab5415

SHA512
7e0f897f35058a58b9d251b26769a4dabefd931c9a850993a4edd2ccabb63e2d310a5c90a843403be57adcd021d4a5c17416dbf1f3ee038c1bf3f276ad2d0dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5d6fc6f56dd8589193d9ce2457c5e41

SHA1
63a1ffe65a7bded995399f763ee6adc745b12e82

SHA256
cf36efc1d8f247292d5931b6b04c9d5b629d40eda641bfde23c2738aaa5b6faf

SHA512
4e212a86b672a37ec7e4dde1b49181e34aa52183566ddc308a61ade7ed365df164ed0bd2ecc2d5b6bb695c50bc9fdd4f5474498918144e3b71fecf4a9e5c46ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5853302bdaf9faf91c84fc44253f9f25

SHA1
be4fe1c93ec465878650ce3db8156824f0182ee1

SHA256
bdce6dac96cc5bf64cb45ef87f1a81c05abf94b49528a38b63f0473cd1284c8e

SHA512
4e3d09016732ce2ca1b72dd0e4a22b1e9f3508211c8de618f3950a6ab38c9b0dcf94f88ca9723be8cd142502609b860c5109e6bb87367dd06548dabf76e6ccf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
50f231c9632b0fd59cc37c7ed56fda3c

SHA1
3c47782ceb461965918c91fe0fee2f8cce328e6f

SHA256
10b1c29b67202de2179b728fa32a8080a4a570b35a8b692bb3e0986861c33ebe

SHA512
6b58d0b6a47951fbb3a8b11b9cbb27f4537401fd09cd95b826e4345ed4559139feb59325c41bb6936631989d7ce7ee0c20b7b536ef751417d34b9323e8cb1ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6598ca7d2bb9bc09edeceb0eac171a06

SHA1
705af891b58d26a70813ec23c48400ad297af6f5

SHA256
05f0a34e162f3fcef147b705859dee96a2014417c2e057db84f7aa871ba4126c

SHA512
83e60213b17a6f2c59a64c743e6800db8a9dd1ba3e5253c07bebe607b723f7c0c39ff06ca65ffd841091fdd2eb1f3aa206525c3c3218854008323cd928576bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
08dedea98ebe0c7c35f55d4e2ec7be3c

SHA1
7ed296ab9229534d18d8be15a7f98ca5b1e1a49b

SHA256
b16ae374f0341f367f3d9a8dcc353a7f2ddb9239d18a8721b21f831eb80d015f

SHA512
dfdfdcad2e8fedc479e0d282d41fe3d14aaad457b0c4bb49bb8a25415e107a438f07231bd499d14364791417bb580a8b4901efc495e4ce0b45d82f91568b254f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
300361e7242b8d40ec5069e22383d4a0

SHA1
b6cc9c7691312aac81f725695c1ea918e3246d65

SHA256
65b0069730b41ba55829118557fc0d8697ed464c9f2c8e34f6e4be61d0f6b73e

SHA512
e6543eafd539609fca4887d2f9fbf8ed1b48733f9ed6f8c6e9b9c4f7247fed7464545dcaf66275f7fa541c230870f0e492459a3f7b16548938a2199323e10946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b94cd37bef614963d94cc2277b4c09ec

SHA1
91ca8032e0ced45a562a24feabdce0c2c4463c47

SHA256
1b57d581e5a6579cd8419a5edba665bca162f957232a5fc0c8509db60cfd7869

SHA512
f4e3bfbfa5ce65d98459c0f673a310bc16022b8510aef7f5346d5790210f15139bf9573733413e954d04a8c8b1c564f9b86cc7a6f0bb8ceaf09f9aa4085e5059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2b3accade4d035ba632f1b93d60687d2

SHA1
a5f72b322cffd1a2bb188a2acf2b7b08abcd17c7

SHA256
ba9f5d8e0fcfacc2e2a473adc202688f9636c360e3a814f7a93330346e2d32fa

SHA512
35286cf915868c69f71311ad579e1d67c2241c8631ebb3576133471958151902c01851d73de063ba5e9d0cfd528681a28138db0db31ca5a182781cb7fa8e2600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
00d5bf356689ccfac654cb1df6856880

SHA1
a691bb7362fbaef04c31894bd600a3a29e3cb571

SHA256
ec06543cfac47ab5785265972757b8d0f0756f4288df8caf9a2ab2884c15deed

SHA512
a3b823c094fe99f43f41b598e33e51e8e4ab6154e6d40807d5f549f40b683083f613ccfe00a8d92133a0b310c345d8203916b30f0382f95a392d0773a15facaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
227d998f067edfa72cbc6d2939575d9f

SHA1
29ea358714bab9706fbeac21693266f7bc63dc08

SHA256
ee12fe077d04837de77ae9b1526741d8dc82ee838d300330a97939a05af9207c

SHA512
138cda13f7c26b29708cf260062474d36843cfafb60461111ada527a59d8f2dbec0d7b8954c438b1cfdedd5364b6575996cc50f3ff6f040ec3a51bcf10efabc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
17347c676b5115cc6574ed0b175da5a5

SHA1
fd64366875659382edf02d9a64977fd0cf659a86

SHA256
05a71db3b067c52114ff13a797ba9841dfdd7bd19be066bca8733b6e15dc6e90

SHA512
7ebaa6e87ff10cd11dc663b8ed310082ee4eb4b6a493c13b5808f3f8de0510b03ce2f01d03155424bcd6367fee653f44ffdd570826c6fc871fdd3b5ab66e7c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d52bd6a062599dba64257b593dc431ff

SHA1
84f5b7a7e414498cba5dbbcf03c9a41490a8875e

SHA256
e2342c1966f29fd5533bd8511e7cd64c2b0643aaeef6e7b661788623b203cfd3

SHA512
55ecf68f5a238f4871805d0a293f20df40f99554a48cd558b18e27e4629a036c35198658353124bbab43a0454a88870cb9974d258eb032a7d54c8a0d66761f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
872963e5f671cbdc5d3bdadd3fe8b058

SHA1
32b6e96764c771b9c92ed30c2e39ba3560e25978

SHA256
fe8f03b0cda353c112980b50152bf272dbf5727c7c20f7e0c7b0026bdf80bed6

SHA512
603a5b338d3bafced16b7a9b0305a6a27cb6438fcd4a9953d1e47b9bfad5b53c4e0bf5878c09e4315e60b253dff78375be94419b8ef4bab8337cd868aef7d08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
919c50bb7c42e91381020f3a84047684

SHA1
9278bd53af8f69888a054342f5119111076e6da2

SHA256
88e70e729c9896f6c531798f52d4775b1a04fd03805fae0e8b48f8d7a0c947e9

SHA512
616252b0d7324212d8553aa41bbd0965f71767a1fba5bc1d34f53b6bf29c4073dcc17bb0f981c60585a9bc857a63722ce6ea2538df819d4ede38c6cbcd095510

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E0.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar322.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit