8b321553f1a269ee4b68a02162ba2d14c71a92907b6001ff3db0fe5bae6b3430

Analysis

max time kernel
134s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

playstore.htm
Size

4KB
MD5

b5761ec7f4412406c8f521379cbfe466
SHA1

621c6720da697ab81116bfdd6bf81d1c8ad5e7a1
SHA256

27b9dbf27f7d81fc3cb84c6b3b2430a14fcf78d82d351d38b92dd18537f0bc26
SHA512

e4115829d744cfe44891eb753c4b2ef042d6d5397e5138899ddcfbf9f5a7ac84f2a47af3ca496e11505ca501b8ccadd51b276adafa42d709525b337049d7ed4d
SSDEEP

48:mB79CNoW1ii1n8BfDaqDUMmckWmk1ZVEsMToZtME1NOar5McIp9AMF3Y:mB79C2WT16DaqAMv5ZxoMMUbMrHBFI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402505552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F134E2B1-61F9-11EE-9E2D-5AA0ABA81FFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000000397d3167d8c00690e236d6f59705e61bbb86e92e22e6c5414af364765a567b7000000000e8000000002000020000000ff66a66ab5398382f7979f2039207e77d590ed48548ae5cb079f0db3ca72824020000000cb0aa37650184571990ba83eb5ac5a40fcff584e1b0dae8b0923ea0f10aee5bd40000000ba192ac9c05218ed3209a21e2116129fa694e1ec4902bae2de45d26ae56ad45d07706f41111d3582e949abc670a64b4f17d11c4fb8ae58fbc9ab5ab7d9b131ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000008338639fa71110e24087b11a40fa92a5ece62d3ac029469d7688712a81752239000000000e80000000020000200000004ee052ec5b14729f620d646244ae949da19f94b9df246c94d9f70aa2daf0f6e590000000149f3f863b6fa5c9e8ecd347fbd9baf1d4b1cc1a1fac3d3f6e622bcb9a999ecd2913daed66a81582fbada46cd7e7353e789f207919e8996adb0662436408d6ab0cdb69ba0fad57d4e4e6f2179e53f85b0c65e08a1163a1f56a8c9bebd9eea9974fe88b36bfb5783963a5a0ac1f37aed4c5025e1b105ce6b465de3a9c5c592597717dba2279d59f603a4e8aa374a1cc62400000004b4560f1202db1b6ca9d54afb162cf91ef168ef6b20449c56fe8af4a99b69de3433fc3c0c07a5d17bbdbfbeb3fe0b8c98847925149d324c9b1b4367a00593477	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2001c2c606f6d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2612	2240	iexplore.exe	29
PID 2240 wrote to memory of 2612	2240	iexplore.exe	29
PID 2240 wrote to memory of 2612	2240	iexplore.exe	29
PID 2240 wrote to memory of 2612	2240	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\playstore.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b02add30393b0c3365f0081253f3c36

SHA1
0a7d48438d540db52bd94a6b758f33531f510e33

SHA256
61d813b6956a74a681a3909014fd09761d66467b6581f21417a175cda839638b

SHA512
3986d19a23d40c6e1da7216f0a63acf4e0304924913eb29c4651dd4cb61852bd5c9bb905985fe366b559727efe26b6db088f5bd2c9fc81608e543f9229274ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e45489a298c0c645412716e79bc8ae4

SHA1
9da56a3725fa8492a6fb921fccf6b0a475f08007

SHA256
49f909ebae0b884de9cdddc1e4d68df8b37b2d73708aaadbd0a49870bc3020a2

SHA512
251acf0edecc182c59d7cfa47c6bf1f69ee6d7cb5ceeb048679457c00512fe5eae955798bcce2f6dbf2977d31b57a9b728a631135e9a9c6d205723b1434c3be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc49a4cadfea3b3fd2f82c807c8c739d

SHA1
fef0a340342d2910740bc7db9fc4036ba1d46649

SHA256
6445898fd53685c7f5e3d5eb80e70fb9b4c561a608fc417eca9c42278153b0c2

SHA512
6176cf934f86dca85fb51cf01f2f412a08c7d9b60d4f58f918c81c83ac753df2f5c27a1069f31842b3345e3405fbb5d45935d09fb52381cec8c20e9c1a4046b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c912d73e421e2824deb5d5dff8818fc

SHA1
718de73111bed81d95d5d92213dbeb6993c8aa9d

SHA256
27c383b67071ff72a4bc5ad7909eaba16357996490c6fbecd021fc65fda72574

SHA512
64c17f127e9145135fb114dd835f6e39d6c3fb5bdd4dc5662f3e4096e145e8cc9741c49a8f4d6bcef661ab9931f9610b7dc240f2ae6877d8a3ef34334773b686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2a650a6c0c4a074510eda978b28f35

SHA1
01b603ef561549c8e8be011f8234afbf6190cc19

SHA256
bd7521321bc35e450900ce6136e82e858c3fba768ff18dec20f4af3fb52592c7

SHA512
f8f38ff17c9d0e1d3fe82dc1b37bcf7cf2c23cfee29778eac9d7b0ac9d188928ef29e7c5d5773f3cd1133b8d13bc6a003eb0fb2ddb9ff18cf237843bc8897d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e52e694f1879f5f0e268fcb8044fffc2

SHA1
e86564bfc2456a4a274773586be030412c958b23

SHA256
bb911af68f8b6c37c216222a5098b9760804e9e1830a4e19ca213da4beef1473

SHA512
d99130b7548ebd1d396b1027db6f6cb109ca00392de8760e83d993990734cc505fbb0de510aabdfe34369833db968a7fec247297cf4b14ceeed75e01bf9e6ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff7759242312575a404b83065146b4e

SHA1
211ed9661266ca2ace5786c090bf19ac4ee13e17

SHA256
27e2cfbc02e8acea238adf30376bb1f8d8eedc31f04d5bbedbec5458350d58ed

SHA512
77d4d20b486009405f239b9c991dd1f74dcf27c2dd235dd692af7c00656f3f8045962ebf3d586eb09f1c885e1b58158db2b26e55da5a31c470366ab546c74578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3368a2d12f509c69764d2675f8463b

SHA1
8ab7940a5ba951eef730d72a6992ceef891ec7d4

SHA256
b8e5dab2bf4b4a435deb2156d291fd7d096073ddf6a51ae42fbfab5d2f059276

SHA512
72e230b93b74d1e9cf27564032dc143261daf7e27e21e299edefd8522aac6eb4056e38986364f6003eb262aeac5effb73aea05be9d1cf80905b2838b854afcfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8cc81dc2926cd75f0d1f9ed4c3e9f03

SHA1
77a604629f8e84f4605748ba58ff841b3a2f28f6

SHA256
d7c71eb7bbc154cb3f176b24664164d9230108a64a83cc502de27c7ec1e3209a

SHA512
1bed17d78a06463034a5302da81d33abf3e4d7d3bbba2283776f706693cc482a54decffa762250e4a168f8f23baab3ac0aba6dcc0039d710347ba6e4e2be376f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE77.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE99.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit