88a50ba6ab5d4368b10010758cc4bedc99d76393239207a2da1626627bfe80aa

Analysis

max time kernel
134s
max time network
157s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

privacy_cn.htm
Size

42KB
MD5

49b9a40f599b1089ad0b0394c47c1102
SHA1

d0b0fdb5f6596afedf37032eee87290683b911d3
SHA256

735ba8ee4875ef6529757139876824ac572d255b17db2c75a9887053fd0d9b16
SHA512

43a9be239f71d82efdd06855b9532c9a25a3cd9af3c41fbe407a6b10542bdfd1a3da76b154f0e5d6487a5b66a2521a3f88598982b190660301aef99cd03d5bb9
SSDEEP

768:XEqzEM+RdDBF/f51efzdYSFXKtrhs6WIssFXVqCrX8J/2ue5AFuanVzA+tZxMAXp:2jupQFX9As23Egvxj8TWK0HWZ4Mu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a037d6ddb2f4d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000003f551614aac9d104055beac469ca842b93f9cf9b665fec86fa1f71cf04b24e0c000000000e8000000002000020000000394bdd56ba3e8785f322ff9399e098a03a20bc5c227f776e396ae4f7bc51808a90000000f1cc829d4b6c165dd80b8b0b0e74bf44343f088e175f55f12ba9194ceffae88972ade6432a1997da19409821fa139bd23420eae06a4b17ee783f772c5ba16740f50416c611e491a9aeac4f1ff9a99b97918397d717cc532895ec0ef02c93c3c01063c7182bd77407aeb3152e58ae218524c0246782bf5985155a0e716f59579a4b0da5e5da0385a8bbf9464af31c2a6c4000000055f3f218c07f326a8d4a0a784fa8eaff367c8ef6da181103ff6c53cf0a2d9c02e29b5998030ba0e5cba854c93ed000988476d4262e2fa6cb39a776a3b5e01c1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08DF6D91-60A6-11EE-B1CA-5EF5C936A496} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000001574c5239a91744b3ea4e696a8896771cf8cc5ce9087829af6fe314608688526000000000e80000000020000200000003b56da47c761fcd1c18bc091ae02538b03a591eb0d7cc55f32004d435c3cc69220000000ac40f280c7a69f375c92d3e88bf86b68978d04ef1b0db9c7a54940f17f73dbe2400000006740e56e9bbe3270e4d9506cd38be77734c90ae31e7831c2bce38abfd81960624373d449967c788a794f9b5d8b8660ada78adca561088a7da23423e29529cc4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402359563"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
540	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
540	iexplore.exe
540	iexplore.exe
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1164	540	iexplore.exe	28
PID 540 wrote to memory of 1164	540	iexplore.exe	28
PID 540 wrote to memory of 1164	540	iexplore.exe	28
PID 540 wrote to memory of 1164	540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\privacy_cn.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1c94b0eb0f33cd621b3c612b18e6bf3

SHA1
008c4db229502b33d09fc585a578287110b011ba

SHA256
7e061b40fc44103defee65911d69ebfe8a1301e13670990ea2b56f4d393469f4

SHA512
14d467085da46d34ab1733e4ac7fcdeae52d7a5a2f7e7202fc8bb1f082839e54fb13cd54f63002cdcef04de11f0b434fd2a07b3007843489cf4cfaaeb8110bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88be02e10c44c8779afba9bc0088fc4c

SHA1
bbfaf2fe2bfe8459eabed421594177b6026aa371

SHA256
f8713653f0cbfdf7232fa1e39b6d1c665e6c69882024ad15185a5fc2b6b69a9d

SHA512
19c8de2c1cca796e6353558078b371a868a9f91623cc110c76b17fbe911c18e9d18832d3680bd14027ecd53b0488aa8fa2b9431b0d2b64be4f2de8e6e392f48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43a71913dd0074f1c6e507c976830285

SHA1
b76d204f4cffce2f939bd7a48483e87ebfa7ee42

SHA256
51fab3d3c7d19badc20fa03535dc3e37d26c8d7640af1f51596a9611c43d40b5

SHA512
38dc009ab9c305211d18144fd448c1345184fe64092219174f1dcb28f9c2b16ec885a9e3823a5d50ba2f56e75c29b54c38c517940b8895c715748efbed0ede1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cec06579c0749baebf614cf1985c135b

SHA1
47b0c3001eed6e6d9c6f770c54eee4df1ee17414

SHA256
5abe541da9e61b71fef731734f86fb5707759e5317cc77867d73ad026634a27c

SHA512
f8ce20c31257d9bb76cf165d2df1afe2a979dfdd7dac10c3e1a0969abf80a21c0eba328d6c838d5eea2c3c27112bacf9d0611635fe6f4ba5635ac7453cc9cf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0eab0c8e738564fb51adceb379b2ed7

SHA1
4839e4ac7cfda4cc37bb7d528441b2ace2275e19

SHA256
d1974582b644a7f71774640df6cbdc55474e0a84e80c4bd36b37a366fbd0c2df

SHA512
a55d99d179dd314cb9fb5faa9196a3d3e34d75df67892366da6a5a6c5157ce148ba296dab336795ad89375c534f1db6db38143a8dd23e504b119746b45031c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8af852cdee7801476968723ae485e56

SHA1
51bb9878c6e028599f29c0a97977211825581f24

SHA256
1095f4a9ec1a1424163a89f949620c4703b637f2dbba719291d9687c85653b96

SHA512
9713e55fa3d0aaa189da3d3c48a780f5013fe5d1185053e6768fb31763ac3429b609d15fe3f954c903a0839b9af15dc929a83197962fc09d9d0fac4b1085ed14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
629cd9924f1129f00b505eb75790d05b

SHA1
7c2a596416c563595a788de12ecd370b615e8e6e

SHA256
3ec8a33ccfff5d8d16bbfafeb30ec12acccf8aa15b33793039d4ba280a6f1acc

SHA512
d6f7544f479d70b4ceb16affc9850dcb6886cd1567ee900fbbb9f3bfea3ba65eeea44ef820a0e41f6606a0c051ccc4a2fcde093bc626f90cb3764c43bccab7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
682128bbeda498be61d0c622b79cd82b

SHA1
e1709049795f5dab009d60f73fa85e341b0faf41

SHA256
ab01b60d3c0eeff70891892f37d35e79791648d830c73b2b7073f15f40d2b4ac

SHA512
d6b1ed6aa24cfde753b27ccd5376258b86536c83394fcca558131921cdf4cd24c1f633839bd09e567b4ae783c7410a9236e9001f551d1a5dea2b840540aa98ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a15154f105fa7093525074613ecebe

SHA1
04bf12ff6f2c391088b1ff389cb83bfd3d8b674b

SHA256
4fc9a0172671df72a45c4ce818be327e24cde59d56fd0d17fb52a90c2da13b0b

SHA512
9ed3f3ec2c971426ab300795ac7bd1db770947b96ed571a77cb1931ce448e3db39c8d9b31428666a6999aadfbd4756c0c893a569e10095c807f1c740ededc5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59A7.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AF2.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit