8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

help_es.htm
Size

61KB
MD5

31772dae5e7e480072ed6d872134201e
SHA1

4c19adebf12a2aa4be9773ee4226fcbc79b89e84
SHA256

f088fe7faadb088d3f63ad8f6d6eea2d88abf4e7318e31e17dbe52d5e4f92707
SHA512

5f19c826336d100b5d104002eb0b35dbaf24889225630a3e9c31aeab3d77d912adaec0470d1d0fbd2e60956a11eaccbff385bd7d28ef8acf7dbccc9434fe8e2b
SSDEEP

768:hLYLmYEm9UhhJ6TJ5w7NKVwvTAybuosWqPOg+YS3+brRzf:hlYjikW7NKVwbootYXfS3Sx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000487f3e977d6f6b3b5d2587712a0ae510ad7120fd13eba0f9d5872875f93ac267000000000e8000000002000020000000b1674d41475f5e5b8b809e23c8aebb2aac69a48eeeacd3dc6c2202b0ee1a3c2120000000762a2d1b8eac7c0aa2d62ab35d808d28e63970c61bb7452f0c824d927c0c8b3740000000bb3bda560d59dd731b84cd4aaa81885fc6ff98deca8cafa2e93eebc073d8421239707963f8797b1641cca14ded1a74db7ca68090f850313056b166188905a2f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c5cbc606f6d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000ddf6476d7edcb17258b134fea36ae5a7c5433b7c206a36b72495e275eae03837000000000e800000000200002000000055db04d91114e847fa76ea7e7f9b2382b1b0a21ab80b7491a23ffd90a2d9e797900000004a0fe7004f387296264aff7ffc97b1c0a82f932c06bb201cfbe6ef4f72e112427099be65d5aca421eb5ec4fb8a223cd1b3135842fb50074da6d838b764a8dd389f03a7d7b8fb05609977f3ceba88fa1ca7b3f26a8b302db94bd7e68e01a3749e1cb74bf5a844681bac3521164c63b8bf353d1e3767529a5029f75e8005405d2c41fa0407687fd72abc703acbc2c1b627400000003b21e7fcaba0db725988d07cd70a1f70c9a9900dfb740e1e4644de2cde4d03699520bb8bb473ddcf0439a881052440994dc44c534385c54aa0abe3c80a180b84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402505530"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F13A2A41-61F9-11EE-A52D-FAA3B8E0C052} = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2712	1648	iexplore.exe	28
PID 1648 wrote to memory of 2712	1648	iexplore.exe	28
PID 1648 wrote to memory of 2712	1648	iexplore.exe	28
PID 1648 wrote to memory of 2712	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help_es.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46bb6c5a293140f69781da5fe6e0aac7

SHA1
e10c4ebc1b6db5763d803350a43a5b9a0beb1eb7

SHA256
c243f470f8d88cc8e517e12951c19ffbef8c6a92f78d3660482a589caa019b7d

SHA512
ff55b97bbbc058dc0facad6ab53af43b6d23f8ca5b7ad33257a785857212e16f6312439d5ae27c6ce5c0b8bfacd25a1e8d5fc299d8711d77626602a0992b3d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c853673a197934d8e3d3ec23e6b8244

SHA1
29a28e87cd85d77128413d4bfa564787dba6136c

SHA256
a02c27564b353bd1bc4480e2588d36092000265bf925fa66a5f90a8d29c9a373

SHA512
a824d1f6d13e6b4e662bfbd174109f7e907481d86782656e715ceaca02ddbcce72f584658a91f333fb6aaca50732664bdfe4c4c995c0c4eeef83d5c32a31af44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594b9fefd92da53f68437e642708efe9

SHA1
2b05b3ae3cec764bf90e82338b9063bc218c3d94

SHA256
c0e8fea4ff183fcaa2af3dba362676e380996750d07c7219590e08c27ff37d3b

SHA512
bdbc33004fe01cc6a55405491679678bfb1b0889a4af54209c3662da7a46ca87c9b93e15d46b8ec56694b599ee5f771467b58383b2f20d58ef244b89e53a1fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e0b0ff77cdbbd8e95b50d6d7c7b010d

SHA1
6e21352cc01274d50c009fcc83ff104f6c67e10a

SHA256
0e5cf4a0a02e7ccf4aaa23b9d267e69fb90c6f54c1267baf5705504c8d6bf924

SHA512
989a8d941e7cf46f35b581e62f075023ba000d2e12c1b13ea2db3b82b8a64c842bcc72960b7091fad1ea0630b33b2f65b11536a5b1d313b73fe3b3342dfda849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62e279e66397ad31a6ad1f6270fb7e64

SHA1
e88d69aee349b078589ceb73e52a9cb84e375d50

SHA256
c0071e4b586eecfed3522324e1f4d08556255718b3bee49a111a3cf08ef32bf0

SHA512
25d24ad282ef2c934e10e718bedcacb2136d1e7edcea7073e6cfa3281079248db37f8675843b889f3a1b9ee3af1665bfe061419227cb628bfba9d41934339f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7809dc47d1eae3687eac1c3d00d244e6

SHA1
59371e5736df4c53a4184e54497c243c6ce5388e

SHA256
3c578c61dbc567ff9524c13424701131eee174996c4a62bf4beed1b499a907ad

SHA512
85707320f206ca7bd9373767e2fd540b162429c5de595f46400dc324c605042cb94416d39ee93984350ee08759887cfee47c2b0007120639f5d1147b678fc785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc1f4fbec940cf7e6c4e3dbb2b83a9ba

SHA1
e339a6d658c14bd16e93dc67f947e3db667dcaf5

SHA256
c822fe5fccf60e563b9aa51f459c66f1aa7480a64fa26ed3211f07a76421c790

SHA512
c5f334b5149504f0a7a5351704b2ad5cac97c6bcba706ee99cfcfa75671950a0af2f98637442624f514c2cf337509a0ea26bb1e48d3e436444a111152bbceceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fabac6f4adf171c04edd80f9beadd636

SHA1
14ed0db076544b55ee3d1b868eb3e4f7fc3d5427

SHA256
ee683a442d71ca3152f1b2035203825fa738a234a122022bbfd04ce0acf69ed1

SHA512
5b8af154b7ed5dc80c3fd794df46f1d5f08ccdf9c2ea47cf69ea0bcda034bfc166e7b103dd366c8cb77efa1cba310d2483e1037423480e5f4d3f4e95cc0c2260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6444e5c5f36d589168a8633b4b992e8

SHA1
83091f6038f629faf55d9e8bd4efcb1f3e5bcd46

SHA256
2f7088b70a6fdb69ff6588447914e688649eec3cfb3893bf10277d0305027d00

SHA512
8a1696742d3ef8a0cae8f698ac7e3926c0ce5e260aa7553bad1cdac7d675cae3c2979798976ade86938a107bb59a79179c5e1647ed4cc1fba358249c0e93348c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6413.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6435.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit