88a50ba6ab5d4368b10010758cc4bedc99d76393239207a2da1626627bfe80aa

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

help_uk.htm
Size

57KB
MD5

6f351ddb8050526c77850db00448d3c8
SHA1

dd253c3d52261d3504bfeadeee08266ab01da749
SHA256

6bf22746ea6b58743544aeebb5f47fdc690e19037d4702926567a69ad426c463
SHA512

e52e1b60b6866175249c33e5b72329c02d2a743673d6845d2ccc2051f4e77967367b095714c583d315ad03e849ab6877e958f6beb5314274e263bc03a8362551
SSDEEP

768:m6At7jfON+B88ArRwU5XG0uUOBiKaBb4JKpBbZM5XyZwhDmILSsb:1UOnrRwtfiKaBb4WXMoaqI2sb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c2bedeb2f4d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000e4820442e0ded11d60a0ee323f171c93f34094b28e0a3582b0df73f6fc85176f000000000e8000000002000020000000c3f3f29eb097e3fdd94102acab6628db853f1c22214bc2f814b53e10efc4b32e20000000a3ad7d75115ab53a72924049a4c8b12e2f0a3ecffb02b0ee5e35e91f8df32d3340000000b050c143a7723fe9a9c4d8f440242f1e4afdcbceeca1306e2e5453fe1740d8982050965554432f92031c390e02d9485ad1c6d03cc76b6084c59ffee7bc9b64df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09F7C331-60A6-11EE-A914-5AE3C8A3AD14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000cdb857a257623bec094d69138e2ef5619848ea794bdb9d16bf3990c455ccfd52000000000e80000000020000200000003c919ebc338b38de8f994da7e40046ac8a41aa587b992638bec4d8628494eddf90000000f9a477ca9f542047f8d640191911a671d4316583c5d705d244309f6ad2b48d217c00caa8a05187b04f519a0c484c12bdcfa641ffa5555bfb4aa01bb133298249422822b953301ef07fae8c393e37cf15062dd5d1d507fc0c6b7f6a2a40c43d7ce0b119f3aaa82996d6b21f6de5a279860893a29c982d9cdeb235460b4e4fc9f792f5ef5087bfb2e6f890831b78f1c54540000000606b43586ffb70523f0c8ee72be19f0826c9bd26af0d6a822a62721522761900cba17a0937bf699dda40c27164e6061edf941071e0f5574d6656e7b86d894fa8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402359542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2348 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2348 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2348 iexplore.exe
2348 iexplore.exe
1464 IEXPLORE.EXE
1464 IEXPLORE.EXE
1464 IEXPLORE.EXE
1464 IEXPLORE.EXE

pid	process
2348	iexplore.exe

pid	process
2348	iexplore.exe

pid	process
2348	iexplore.exe
2348	iexplore.exe
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2348 wrote to memory of 1464	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 1464	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 1464	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 1464	2348	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help_uk.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d5aec04230af761788edbd7b2db5e498

SHA1
52b34fbedf575607ea243ba86def86c5eac64ef4

SHA256
6e75e2b61850255ca40f74b3a963a1c2acf0595925e32ffda76aee618dcfff41

SHA512
94c493ef6d345cf55b91dc8d495f99d38de3ce1c2cf6b296c3db4289e74e86893fbdf268211461de06d7a1735985b34ae6e56644da375007682b1d659892bec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
abdcac1640a7a032b68e8d6fcd77e05e

SHA1
3df12f9f5a100ae730439a3884dbfde6ea56f06a

SHA256
42e24ffbd88c8ec7fc16b214c468a06ac4e5b0194f4bbfc3242bec46ef11e613

SHA512
840ab6d9d1ecd869539e42f4f576201bde117eb0b8c73a4c0ab963d35bc2064ce23ced3b1cc30671a87b7ece88d40acd4b704cd92707305d3f8c6e6b8b4cbf96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
90d3e296af79ff98210ff267d8edc002

SHA1
3151e0bbc52a7ea4623e7a5b965a28dafee215a8

SHA256
209607147a6b891a143e8f45d9afdfb4a6fd63ec8d341c862a2a4be2a604d597

SHA512
c4c70a3ee76e6b63322b394d55f3ae338ca176f0cc4f6d4a6442c1bd58a3824792f5f04ed86faad05b12e849d585bc6e6adff370a3618f43cc64fda93672364a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6ceb68a05f95a41b8af3363a607d1a31

SHA1
649d07a44e1e1eb4472cbdd00da228b401f2dd8b

SHA256
e84df98421c74d9c872d951e21ecafbef132f7f8a7857da9957b048aea5a2d36

SHA512
432df4fbe32062dc1d24494e4bf77a0f0fec2899df3534352d765fbf4bfecbf37b39ac34ccfe34d04c2fe464a697617217f4c9e34728aef2f452a029382af666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
08336d776aeb1447e77238a48be7533e

SHA1
f47c5435d009098b144570e2c4a0e6c21c2c99ad

SHA256
3c8a06fd34261e7cd0816015044f38310ef3f0ef50ac789382ea1d8770e8ded1

SHA512
de9e0da0163843c1e37d54526994c1e24cf2c992de15c53acc7ca616dd1ff0afac40f6becf2f1ec436d53a742e0c4ee08551a8421a22e9cfc36cc3efadfb99d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9dfdb8f98e71ff18e581481799b10f49

SHA1
e0f17f422dc87dd49db6d0fb2c86319afd8ea1e7

SHA256
f2503948e86314841a29bac341844f9d20d0b6900149cd9da2f3842f5b7ea578

SHA512
1b5ac96bf2c8225575c612c4f547324e0ad195d4fa7cf31cf62b54f127a864ae6a2c584c365d6d3dfe1ad433e142f853750068d53245566f4f971d07a100090a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6571886178026be0c75dd9316cab71d6

SHA1
15cac02ec271f9707f1578795ec8d979bc5cbedf

SHA256
77718302271f7eae588339ca006c7e1c0557f74ee9eebc0f544df738fd6e2d89

SHA512
7de1cfd74da97d72db9c396a9ab54f976f96ab46446bacfed941dc17df65b62f20f4ccce3a3b482976f652183401d4aec5203e0bc3460b7f98a20faf2b9da3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d25a3ef967786d4fab1da6ef4c69c79e

SHA1
be4a3cead342f4ecc0ec010bf62e91de2ba74307

SHA256
52d3c8654469bf1dc33c86f0899de3b7ec5d3bf6e47760f77738ea728215402b

SHA512
635f3efedcbcf5c98207a689c7021b60dd2dba626de1b2156b029b127dfc9a03bea06832d897208700193f0383892e7794784c2e12ea875541873dff6f30110f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f3c83ae2d8123b6ee13a5df425f69417

SHA1
39ee7ed9ea08d9268c34f13e4d147ad37ea24e7b

SHA256
45b220fc04c3b2d9eb09e2dc5d0616cc37470d8cd286e750053a077e925af299

SHA512
1e62d4e20c4076537d55a1b74c4f9c03ec33cd87082f7eb93b16835b9fd3e0108b4a469f6a0ff08669d12dd90126cd108798d8a6a433b289dc9b08ff5f230b5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F88.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FAA.tmp
Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit