9f23df054570cf94a0fe1efe0fae1f6e7b2f66fdbd2700bb42c49c5e23214bbb

Analysis

max time kernel
143s
max time network
161s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30-09-2023 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

facebook_desktop_static.html
Size

7KB
MD5

b520bf77d3f091ab7c1584222e533f01
SHA1

dc68118dbbc29e6eaf98ddcba79c93b891cc2158
SHA256

bed9d3347753263b27e513fc57cd3366929b5ee5271542a120474ba8aa954fce
SHA512

01d5a12b0e0824be2ecd14ddc79f3de98328881cfd4d109e86c23018cc6ce03b06e1c32633ecff23f4204c600697cbc1c38e14ab7957a5bcf6aea1ae8c3114f4
SSDEEP

96:0Y8NSXgE2bw+vt9HcXD7tVgE2bo/b1hXgE2bohO/+XF:0tAg9bw+vrHwD7tVg9boDng9bonV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a71400000000002000000000010660000000100002000000096ff2c30fde28b6d8a65182c5119842be1b53217f13311d045d45eea669b01a6000000000e8000000002000020000000a812e3fd04c7d29fa92dcd0f817db74fec696af4e7e30744b918b8271bbd7eed20000000f6ed5eeab103d2fbf840c734a8cc6d90a0ea0d3ac7818fb9b7bb9dfaf906398f40000000f1bbc2bf192b6788975611bec09911d6cab65f85219ee10b77aa54c3a36073e4b89dc5d5e8fb41f3385875da67e8b6b8e14b3b14b4357c2c4da85b1dba156f13	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000c286dcd829c94cc791873d828517d7993cad235e77d75bad9b7ba753bd46aaef000000000e800000000200002000000021b51367194caea936bc39629692de295d6ed0e6c9c1556b13613a43ea5e0a799000000096220ad79eb3678a4caeebafe5019250aef7e02ef37fb29fb038323ad6eefe217af57c8bc224f3934926e0dfccd5df031bcd03d1edb54fffd938be06c9f4b894eabe83cd1bf63015bf4ef9c5c8af4de35b18ca5f32af8bdd643a64bc1142c0f81bbe2912a45831a59ce4591339f2bcf2a48245a8483160970cda8fd3b914395d6fd14254f6efe44773a49dc9ca5f0aef40000000461977267bb0374314d0b1c8a4e04ea6faaa6ef71a46acd98f02d51e0561b6c7fd78a11702b116a1681b2b09ef9a0e09461f2edaf30aa1a43c6281d391b1375c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{054FC041-5F38-11EE-89EB-F254FBA86A04} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402202338"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0aa58da44f3d901	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2704	1872	iexplore.exe	28
PID 1872 wrote to memory of 2704	1872	iexplore.exe	28
PID 1872 wrote to memory of 2704	1872	iexplore.exe	28
PID 1872 wrote to memory of 2704	1872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\facebook_desktop_static.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c104c4d4c0299a159d8a0e97c8b3209

SHA1
73206f7b7c86fbbea724e191c874938a0d48aa52

SHA256
29bdd2555a71a20c0647002a06fe155299efa424bfa73f3345fcc7e97e72c02d

SHA512
f2dd54c043b5a066699aeec58a7fd700df6517a07862c83e36e78b84294f2631db7b4150014563c7aa1903f94b3a43e1e0e2ad14adb5867e9406d73116c0a08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecfb10671ea937334adc73d5881e2931

SHA1
bc4e585b4148155340f296da33a02594a32bb1f0

SHA256
2b111b94eb0bf28841a2242d6d46c87b9e06fe88c45e01fe77c2b387403d0278

SHA512
eb72add36cb7746b92f99753be881de5470c9e39a7d3027128c89080f534ee6075bc12849b33203446050f949cc4f4d7bda279f9dd6aaac5bebf085bdea27ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52997a06efbf24586dba84dd65512a2d

SHA1
eda28cb4884692323704111adba4c7b81ce601cf

SHA256
44efd00ebe629262cee5171c1ccb1c4e6827c82d33cabb9971835f6bbbffc163

SHA512
7788f22d823f1145e372d9e56db8fa591d2ab07b103eec88f20cd1134b44bdaaa63855dea3791aabd91929a535b5c655a03726c9bc3393e1e75ba4c0034b4dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38c3bf685c8350e7b3e9b89c5e03f3c3

SHA1
5597692f35c6c9652d15868afbdf058eebffe139

SHA256
8cc85c86f7255c2567d10b0fd3052edcca70a024a338aa2cc3b4787a450c6130

SHA512
a49385368e5c4a9a4adccec813d0c80f60d7c2fc553339350b7a5402dc980969694e52d67270bec2b48dc9079e891b42019995ef8f5aa76c04a1ae61f8ab2646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc9d0d86a163bc391661486183bc5d6

SHA1
80f3f81b2636dc1f79f191ed9bc27de4beea6f44

SHA256
1f6fb7ed801ec53c999153f971c472c6c216ec798e861c5f346bf68a3bc1f0a3

SHA512
a2a9c35d1bcf6ff71d7b280ab7e6916307257490a01b2513eeb678c4b3f2e1ca71b06229c8221d0b2953a4c22dc09b911a09798342f151886ac9842a62219a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31661740ca920df4ae5ec6a2350265ec

SHA1
b5bff3b3ddb8aa9e20947f60e08266e343c24805

SHA256
3316bccb0ae522f5bf458e2c92451ca138fe0fb972fea05ca4b6cd77c05b1ec6

SHA512
a220fe60949937f10bc9c809371325c0d31b4539262fe437e787e4eefbf2cad3fcc486bfabeb3e29969e126387bf638259ddc2aaecb22cc5edd01c1145fb4f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d697d88c8ed532c2404c4bd78755c5d6

SHA1
30369d0a249b4089689d0b8d0e67e761d4f1ebab

SHA256
a2421a42d45ddbb32bc40a946633230cf5dfdc6779487a7184c93a87218338e9

SHA512
3b4f1e4d279f3f0d9a949a3efc30339175375d5c7000e656596d3c6412c145facb963653e6d51e73ba049939976c785e22902dd976904439b28ae285775dce25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb233930ab8f49035d38b1f3962293e

SHA1
3ea56ef3d4ec82c43cb7a7fe011e385d23fe11ff

SHA256
310776053403427b622c921ac62019f3e644985c05a2a5bc6dd65cc4d97acdc3

SHA512
91ee9fe2b6d9cb23f0ef0f31c6988668c74537c758bc2f5b7ff70a9da1b3e010ead67135f1f97252ea104390e70dbfa51f6180b411719c262da4816780ce6337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52813b39589e626a00bebb5b367ea7f4

SHA1
adc29fa915d43365d8ecfe003b1912d112f3233b

SHA256
c194de469410d6a0833fbef62b301592e6041d0da789e58312176a516239bb7e

SHA512
17889942c575ea64bb9f1ef88a25b08b9c19b3513cc441127d94d431362734e9398a94279f28cee8cb5821b52098ed269051728fa0d8e0605aa9ad33b74e5feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4011d59be64a2890ff73e42d695ed37a

SHA1
7731f445a31e3ee23367dc27cf6149aa2ce96be1

SHA256
b499c41ffc16359f9ffe56284c28c2b0a11b4350cfd6c9a2d888322cd875c283

SHA512
40fdda3bd88a25fda376394e71d019863b83d93f752f3dbb96123b35d71d0c8a47fccee817aceb156c132f2fa39685b2e2fc9b3fe440763c6a8eec89e064eb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e09d2e009add47a4b9fa3fd6afa0a83

SHA1
d20f2b7bd2bd74753af4619c63db7a1a00ae7ca3

SHA256
9c1c319701d9aeb70d3611060daf088c0de30e9a1ed1df0c1f66149eb7a41c5c

SHA512
2e9e531b7935895445632e1ea534e2493c4185d4b9b244d53ceb4ada08ba83999d1dd33e2b2ed0177af071fd4499970f1341f49a43f3ef74157781c0fa2ad34f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDD6.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE65.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit