53849a4eb386b120629ceceeac78861ddbf73209c5f2be0b0d7a00df95b10dc2

Resubmissions

05/10/2023, 06:30

231005-g9yv9aha9x 1

31/05/2023, 20:00

230531-yqyjtabc2x 8

Analysis

max time kernel
42s
max time network
35s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32.html
Size

5KB
MD5

916775167caac5745bc1095e9ff654f8
SHA1

d563e1388016bbdf2b2a47970207a4b966eadc55
SHA256

53849a4eb386b120629ceceeac78861ddbf73209c5f2be0b0d7a00df95b10dc2
SHA512

6476bc71f0772021c8e828f783c20a974b34d62cc17b5306eb0a5e5fc2fb2b66dab37c4028bdf70aab7ef36f9f0505383a241968e98b2f80d8d98ce6f8b24629
SSDEEP

48:TApOqA5BAFzPJhVI/CLQfvaFzYsWzxeqs6Gp7vlcg793cjvynM:jDEzPJhkCBzglsZpzlcgJMjvyM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3EA2FE1-6348-11EE-AF7D-C6004B6B9118} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000fd41fbde0d26988d5b31d9ae3820404393ec3ecffb92a5bfc59fb24ce38f50bf000000000e800000000200002000000065d2c9f87369b8ef13e7f16435b5c3727957bdbeb2740163a9b3df87ffb39df2200000007a2bc75cbc944a5942f719e3754bbb7e13529d307cb11ad3ae1a59f0a3d1046e40000000606250ef86248c38c6462dff0b12953efb3d52ed615d011d9d8b4e58e197ba320bda1b2c5f22c205aaef32d2b7ebfcbd39a8f7eed2a6a2b79ed2b02c07978910	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09fe68e55f7d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000005e77f69adaf127f00cf98e745c8a4085ba55c55e57790540920a97482158382f000000000e80000000020000200000000a2773a71e8c43c6386715bb48fbc2d038d4b2c9897ba0688413ca0a381f19df900000008307558ef42140040bd7f4e22bf7ee1798fdf912449656bdac83fb4f54a945962c0b089f10a5586188e69435a025dd57ced622e04a1c768a1ba6bb272d5f23d82d1fef703ba89b784ed3e749a573ceb3e43dc4647eb28ae035c3d72b8bf3c6bc5b636f5398ef5d67f9283dae8ff00fd454e19e0c17b236de58e6aff572ab11c5624a5de6002d34c77f37f0cac590101340000000f1931525cf74aa61c223a4fc0c0f845cc383eb114985ac0f0eb447e4f6ba317aa42e9c911e9a2735ec1c8609c1a0e2ba93cffa210ae584a330e1bdccd572e200	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2244	2124	iexplore.exe	28
PID 2124 wrote to memory of 2244	2124	iexplore.exe	28
PID 2124 wrote to memory of 2244	2124	iexplore.exe	28
PID 2124 wrote to memory of 2244	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1060a05336fd5379e1d93fa8a25449ec

SHA1
4c2d0ce54a9cfd7edf0eeaab544e54212ea4c7a0

SHA256
4f01fe399e7835efa0846ccaedcbf66694036e9ba5c842d16419c02f1019563a

SHA512
08c83dcfa93582b348a0bb708f9a927e8dee3c14b6ff9fb0587dee877b579b2ca9b27af027383e4051a26dba6713f7bcb4483ffc88e9d3d80cc0b8d6d370153c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce18b23fff7389f996cda35f69da6366

SHA1
f405fe54ec850a3a15883c4d1fda6e62c316465c

SHA256
7ad79b929114d1c4df9fad2386e134e345c7a9e49068c642710df9542f9ad725

SHA512
f401bb8a95af4d73fe9c9a0bd01fa7d9aabdb7fcca90658af4dbec26ebabebd09ed194e9a080b1e86a2f2c6cf46f26b4bbf7861b80d0f87e3a098cb769c1ae4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed32af1345377be5eb030550db044ae9

SHA1
bf7e245c837619781e6bc86166e939712b9438bd

SHA256
3c9fcc5e64dccaff2f83a2300ff997fe269bf755a915d14c37a90eb707b9f71b

SHA512
ae54908ae9bbdf5aa23c0c40203b53d2fb2713c47aef2da02aac610643b3eab731984ebde712161d15d3d92c74c36e591c2fdb36e1fdd7eb29ed9d01cb24d835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de6537897cc29dbb43e3290b38b2ec6

SHA1
ef8e6ae0d2c8e187d5bfacef67d6ddb9a1a78f4f

SHA256
2ef7176c9b7ca4d0429d6e937b9b7d16fceaa1a3a6a0b87eeedab90c9bb67640

SHA512
b163ab3b2f9e19477da3bad8004fa8864fb661bf31d1ebafed9d0823a51da169add9ad10f7d63111d3f477755814e51901faeb3db6232423abc8e16afb91e908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749b04f2a078b5e8e33f50b09f3cd635

SHA1
03d8f1afaf036427a311cb26243b3d8d0ef6f8f1

SHA256
162881e12c63207daa4a86343a9547e12ddad3cdf7dae3d66132fa939164abeb

SHA512
d8651b1c5e9bb24b07d3af65b55826e286215994996f3fa97fb3d11b7bb55c47fbc2f039dc288633962646ad0cbdacb21299b8ce201cb77eef3727c0b1aa58de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c46cc69e072c6785a615c0723ad2af

SHA1
0d7410f58dc9d0e558d9d4c46ddf80fea27d6b7e

SHA256
3ff52666cf3c624043e5017875dee27f7864965ebd2fe91d841c72342011d445

SHA512
11d8e4d734ea2d7ab32955605f52cf91e2f8c5c83aa4771ee1370ea0cfb2151f8cb2aaad9ce4c54162a2e4f71e51ed9ad3e99f755545575987320eed9b4fc1e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
880c804703e3e03d575cc0424e19fd8a

SHA1
5de6528befb75b8a29a5293049d765bf6aaa21f2

SHA256
1e74af5854847b57cf33681bd4fe42c0469777cb8f5112400e07272075050a3c

SHA512
436e08adbfb64eb537bc9a556b9ddbf5409a21b12763aafb7466d5a398b0940bf70e99a5a0a0848143de356dd2f82baebb0504be2d1e5b650c85a9be5cb7a82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ed530d0d508540b43e20a78d3a941fc

SHA1
f2f3cfe65ff70587e352b66547eb4fc2cd31d68a

SHA256
c5841dc6c1a08e91a945c681035244c5cd0376bb2f77550aadb0f8d10b40d009

SHA512
98083367610a7360cd179b2b69e8470c8c9437413d6fff9ea04741e69ed21e46614835711d5935f1091eb75f294078225555de3222e39b95308707f08ec5aba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80841379f4a546ac74bb496aa4e98e40

SHA1
d452b4a456e1a3b12fb21a5b7fb6474b8b96ecc1

SHA256
2786ff2e6a53180be90041ab47f334f88ba7a78ae8db68577078eb028acc18a3

SHA512
b3f4cfe9ee71d4d39db6e4cd9c15c2e9c559d52d71cbf7d181befd3675750aa488620b1653f3995bb301ea5b4ffec2effae0f055883f362feec5b3896bcecd24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cec12acbb013bf2f929c2629997fde8

SHA1
14137aa40c27d6b2a3d2cf3c50f42e6ade35ee8f

SHA256
72a6ca525f5bfdb87cb9bec9cae1040fe095c1956e3587e46b0677515b1b5f04

SHA512
9479d609df42597bd1254f313a079673dbe9ec2124355054f01de816759133161bd3340402abcb3bb64cece16008bf98ae54be82be9fc0a02d5499c323eebf8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a91015296d00845c54bc8c20d5cca4

SHA1
715646c5e85ef013df942c590c3dc9611adcb505

SHA256
de300c1b853bac31f3a58fc8e3236cd2b3f556eddb5e35da4301c92b70d6b12a

SHA512
a7346a08cf1c52be4ec0ea5184c808c045a51dde29bf228d7b3a18e0c1a47c885ddda2ea297b749e50a4673ebc03ebef89c939d8d519876448bf68d96334e6a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba2a56da7c8d5826f07a1cc2f1c3c2d

SHA1
6f4a8b52db939ca9acaf5a7148316b7a4267cd2c

SHA256
3778d458e1ba0e77f6d56da4a7b242fa7280fc9c147bf63a5d59224765e37575

SHA512
e1a8e58b6fdab07054855f74c2758e8e6d11645a81d1468ba643315f78f0b2da43c4408f69b9c91c9c1f82a810e2938ee5bf76443ef958b690bec8e0e1412036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd837e724386233864720bdb9c3d5cc

SHA1
dfec3d4c71387b9ac88b73ee84880b898a80f712

SHA256
dbcc14349d0bf31bfd6eb07d182b935eee46633f75e4e7cd09af54c2e7a64cef

SHA512
d1f8a552ab40effc36364c921ebe4c5d188fd2255e37bad69461723e03fc073dedfe80986dcdb42478e4e180312c3fff0068a621c323aaca02185a18f1aa43f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F0D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F0C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF0069DC71E6941019.TMP

Filesize
16KB

MD5
d944faf5b8c41efa9a9c16d728697fa4

SHA1
df88b62b938c9599a921eed59c3a33ac3428ee9c

SHA256
b24ecd376843f4c77c5d37da173a939c4368ce6b18b5d734efa7ffb44ddaed26

SHA512
0bd20f29407d04fc632aea56bb5315120f8d9acd287c7f391d61837bfd7ae9eb59bd0293fb8ee618627cab0d809cc155d7e0a1a04e2e49ad75f198cadb038d72

Download Submit