9f23df054570cf94a0fe1efe0fae1f6e7b2f66fdbd2700bb42c49c5e23214bbb

Analysis

max time kernel
150s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30-09-2023 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netflix.html
Size

24KB
MD5

d9e67756e4a151a36014a507492e818f
SHA1

b493799f682b281ff2502727e5a453100e55a0d9
SHA256

cb1a061a6b48bbd4d5ec35cea27df807195ce217a148ab8cc1584f4c38854bd3
SHA512

0e719807ecb716ff0cafc5529a6ca6b4a26cdb0a73e20d9e93190551234a5f69381cc57784566982821b0830c240dff93f65f8be7cf3d66a616c25ef88b539a9
SSDEEP

384:ECQ+vcD1M5NCVUycqdSe4+PZCC0o1K9cFka:YM5NZycqdSe4+PZEWFka

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000f3b0d32fc84e1274e2707dd993bac9fd64e3652665a52638e33a74fef124f8e0000000000e8000000002000020000000b597914fb8eeafa67f2f714fd1842d34362e10c14f101d031a9579a546b3f7c220000000cc31d454b1691e37f4e21024636bb9b44bdfd37e6ed296157a42a361880c677d400000006fafd86b5c4450d1f905b1e6864dee33655b74c8565c46440af0776da8c353d3db7430d812d8cb857c3c69a865a6d90c268be08b2820f002743208d6b88c6650	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70abf2c944f3d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000098554090505c699a0fa9e5b85005013536ab3f18207769e9ea84748783bf503a000000000e8000000002000020000000f574c6abaef5c2a64d6252ed29152a3b835e8ab70c3377ee8c4d9e8cc8c875939000000024cc161707caba8ccb434ea1ac63ebbc64cfb13d98ca349922dabaa4583c57771842260be4a1bdc0728a3ba9d318f2c956fc16fec53012e77f99a37ba503001f33f0437825fd4ecc691949fea72e1d78ba6df53602067c80350b3886e88d70bc09c072548054fa717f6e844292ef74f0adcffb7a3447d7746b03560f2e45b1a054af0dc28727cad2b4c3209cf9586b0c400000006e670e57b5d48fc25a5aa07588a0b816d412dee2aeabf71ffcbc191204c071958bb244219e4abfefafa77b7cdf3d85a6ca4718cc268ed27a19fe19e80ae67a29	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4AD63A1-5F37-11EE-865B-4E9D0FD57FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402202311"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2260	2392	iexplore.exe	28
PID 2392 wrote to memory of 2260	2392	iexplore.exe	28
PID 2392 wrote to memory of 2260	2392	iexplore.exe	28
PID 2392 wrote to memory of 2260	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\netflix.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3dc5a8d206cfe9defb1ecb08a06fa2d

SHA1
2e54478bbf594244fbce2fbf556c74679ace0e11

SHA256
6374b6b6fa62d2f26542990306c09f5d9768b915e775212ec82b0ad2790b6457

SHA512
2c3d31c8acffe19444e04e346dc8af614fe8855c564aefa2a1d25a1d807b1c243a4d84f5fe21337f6c46c241cddb06dd82d4e01921ba97e6b55a30be5c7c52eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7607bfb1041c9a99be6e931949ef80

SHA1
d3e1ffe2bb89cdcfce5614ade63de19684e58dd0

SHA256
b7a406304594c6f3a25a19a8bf2e34310f3fee65099ad22003afa65b03ca4b24

SHA512
bc5489ba2ffe57a3ac24b4fdced175676e490debaa96e0d0990f5e8927e48ff0cbc25c30b1fcad24b87df5e7baf6c293b817bfc5ffd0007b7426475abae0c24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464e4c6cbccfa85cc9abcc87926e4f84

SHA1
824bf2b41560360189772e6d14ac27308ade03c0

SHA256
0607be669915140a58cec9405986cc238ed49105140d99202df5de94a51d7bbd

SHA512
12999a3452d19d7417d7dffa5718bc2330209983937c0716ad47f75054f314ec403d6bc9ec4d5c9d1f2bd59d998b7580e71f38f3abafa5c19d799a382db1361c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9479e15c9b3d987b1e69fd47d9caf6da

SHA1
319940d300bb9084d6d9ee24039bffcf3486c890

SHA256
e5cdcee7421263ceacb83479b94f937e630814bc81a69a8a84d8de335efb5d68

SHA512
05fa42d5dbfd284273c6233b2addd5cd9758114de2c9ee351a25ccfa0e583b83658f81fcbf19d78f11459285faa0f23e19f0bbae4b80835320ed7cd4dbe5d00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727801cdba528cf401a7a3979b334142

SHA1
2ca073cd2d6208fe9d8dc84cfad138f8375a67bc

SHA256
25836b09cb602bcfe67b952859d46b8e51d4a012bbbe3e950d6e7bd6fee96703

SHA512
714a81da08022fdd6f46481196d4731cff5f2d2ce0222a0ccfd1142d08fe2e02cda19edad06f1d8d219fa8415c1894e22f541e5a7b8304fc8bed90183c45475d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
effa0ffdc6da4b78ba5b41e4a0c48d18

SHA1
c9257edbe4433f092deeb21900e4d94698323b39

SHA256
1197807edec873adfa3da9d43efccccd89655efa1f7bdfa386fc543a44e95bce

SHA512
138bf1445adf38657770c6d48fc1b6f1b85426d576e1e2ff5904ebac0e779939d26e780be41ceec35f245a8ed107e13b69178caa0941c98d96548d61e236c3a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511b276c06283f017bcac6316e451a00

SHA1
ba84c81b632f5c68bba89a5743cbc234cf3a7cee

SHA256
2f539e878f204a41494ee33fa6f1c4a49c6ac14308efc0213c9ed802c9a98ed0

SHA512
25a456aec2e988783cfaf588ffee1b40d0d461eb054715a238f4218e3b39bc97160353a67b2cf01ab082b1a529732f4b9b77113c6fa200cb1109b259a5a6e0a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314edf2b958310d23e02da62adf0e7e0

SHA1
8b549bd54db037a9de966c2071997d19c5e9f648

SHA256
d74ebaba24475257450ac6dd3c2b7eb0e4c306e7629d15d188775c54b101d9ca

SHA512
b604ea99a3a5039dddb2c47cde7f9f33f0e14e833fa271f3c599da102447baab6a6252c7123448d98019bad69bb7fb9dcc03553e00d56fb4d6e22d6916385480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b8ff4d6e1f53707f4b1ba1fddb59b8

SHA1
788f025e37fdae87fa963466ab1c6f5e11f52e10

SHA256
df5bfac10aa71c1b2738df33d6ee22e6853204424efc4d66e6bfb364af1f79a9

SHA512
7fb60f41520a40b160808d71b8edbb084a80c6d86598bd670426c3dd245db8f6514acb18e96cfa58ec017004171fb1671ba017dc9e95fd6ae0be87c01fc3041b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f1b593c863bc9e5ae035f1821aa43fe

SHA1
2d281edf004d4a51d697a471c214164f8ff9c05c

SHA256
acb86f4b7ed5b42b9798c6b42e7fe78fba449882b4324222872b27832db3ffd5

SHA512
0fed6afddc26571399508ed3da03b835f93074f14e4659dcb14aa7a263d686424a006b9cd87ab2fb3a3bbb17ae5381d9d101486e7f0c12933e5660012042e095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BC9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BFB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit