e97e638274241fd66feb9a11f92deb52114e11e730c7cbe87e2a7e9b95f4681a

Analysis

max time kernel
137s
max time network
158s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

about.html
Size

987B
MD5

c39aed0165b175ab5e316f29741572d8
SHA1

5a061dfa3949399848967338907225d376baf509
SHA256

b8d95d8f194c4bc87799fa5fcb7b1f68106a3c0ca55afdf3df727e7e80a4a4ea
SHA512

cacf029cce7b2108353a8bbe98aee51124bb71e4caf789efda09a206a5158a595b522b3ba0ec01d6dc77ea13c4b088f081e83b8662e6806044ba6826c9dd2861

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f0000000002000000000010660000000100002000000083ee51da1bac7e39c0a023b064fa3cc85a5266402e41f16754c6fb08511b35bf000000000e8000000002000020000000854b1996276b3349d32568bcffb45674bd84078c9b272a328ff04d7b055d41b220000000be648536f6d0069da285137dc99dcaef5dad3a8b48e1a83d52341ec0b1e21b3c40000000d5fb0a962a501a57e8a901f0e6bccec4bfee0247a1e23e6c3aaebcca69e6181d67d64efdb63d202923c8a1b46b9fb18a2c0edcb63cd30b954fd34090a01dbb5c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06e7ca775f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f0000000002000000000010660000000100002000000064d945f1017adc89d35d074f509981196d1782751e5c2bfa5672ee569ee895c9000000000e8000000002000020000000143454979bc9aa56aa3b3889d7a6e8a82ac9b4231b9dab4b0a630827e2085367900000001e5a3ed7c91b2dc19c20831f0db18291220037854dd95e9e15b19d6ea6f4520a2bf8047704829517417be8ea000b18eeb164389d0d29c8d463fe3b40e576e134cd17c1d2336b702331937fd452944694694997cee8875c181ce3527e7b5fc252d35bc3f1c9b78129611effa981b826818253278437518213c749acddcb7a294ed0df1adf30e4e609aa8254113d00a6a8400000002b5f4d7ddc680a9367553a69b80fb9da311123bc5e84476cc6077f3a44d08380d3da813b2ab0a87369393686837e8c4f66362b18f71feebde461b2d176f9f61a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF1637C1-6568-11EE-9D95-76BD0C21823E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402883001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1732	1980	iexplore.exe	28
PID 1980 wrote to memory of 1732	1980	iexplore.exe	28
PID 1980 wrote to memory of 1732	1980	iexplore.exe	28
PID 1980 wrote to memory of 1732	1980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\about.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2adf0013efe3e2fb99cfdaa81d02c3

SHA1
86328acfca5419d6c0284b51ad6c9d6afb1cfda1

SHA256
6c4677426c26b0fe7978aced36c803b2c6d340f02c93fafce0cb265dbcf58586

SHA512
b89fc0bb9ff3ea60c68e3a16854a5a70b610d283b0dd1938b02cfcdbbbde05417b791bbaa256cd2f361f2679815dd674b0f58fbda57c9165c1fa58329846ae91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58876cfff332b9907d08b37e57b3ec52

SHA1
e6c22f39a15810ec30556ffdcdd5cbaae85f6d6a

SHA256
1bf2b5d6cb75ecf0a75904304ee0e32d1f5543e89228a89c6054e3f2ddb15527

SHA512
5f8d546d6cd70829bfb6fbd49be23360874f87a011ac8b344f31edfedc156c2a1c08a79e44e7b27fbac624c522649ab771e8dab3e3176d547f99155e716f4883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3d0d4615de5afa8002691ecdad5aa6

SHA1
8eaf523999e829f25dbd2680c7af21b310ee9780

SHA256
7305d241ea0d47ce4c748eb64fc7c6fe808f8a0106a459765a3c1ad771eeed25

SHA512
85ab0800c38bcaeb659aee8372de065d46f00f243cc159a8bcdd928b476d9a4b238e743d3ea8826ebe52b32bd001383a5104dff4f3716309c60ca6479c10d550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11a98029af4ad501dcf9e23788ec075f

SHA1
e0cd44592f29edbf7852bf2e57120bcd8dc52e86

SHA256
ea2eda8b6b691f5f6e51a91e32b08b67bff9786cab946b32fe4f2b2590adccd3

SHA512
08f8de8d2a390616e02c2d0979bc9651b507298121196a68a019e2a5a35caeaa6b622ed0a6474d268c6869489e1d17eca51b8ab9b7e50888e4eb45cc2e7a16bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74a6864ae3da9eff42ae2febdb5504fd

SHA1
fde470cfd35e153aa77591f6e488c3b1177e8466

SHA256
ad762269e346a3b6a78a1b7da12826285e5eac366cc4fabb88b53942833fe609

SHA512
c1ba7bd6746c0a39314e3e185971214e85b3f11b7fa888d78d7079dbedd1f6e786ccee4582f915eb350b01272a7ce305e9b90f04638394c41117253fad6c43a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347f6360be0fa475a1ed28ce5fae0802

SHA1
e9c30a2d61b8c4ad4fe0fc6eb6a5626428bf8212

SHA256
fae8d9ca2c4534270fb79ba7c0dcef2ea8ce784af8681bf103f4cb82d10773a4

SHA512
e3cbfe1c87b0cea093db89a6f85fff79f874c5531e88b72b2d4d02b2db8712561a120cb19e2d8e4f5ffa7851db1100d008e807fcec08b5d66c70a41d9a7034ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29e7ac99505eda5b1b1e72c21dcd94a

SHA1
5e184cb5e5d3d0baff89dda468450bea78f10e63

SHA256
5bc518bda0629e6801796ad1f9855fd532a4ee16413f68b47389655585fbb976

SHA512
208d04ccd91b9aef6d6d6f7195c022b6e75ff617cc48826850e8c578fade3b560397a22025d5f9e5276cc265c3b5243e7c275cb77c777eb64f462017d259a366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07652b780ab58cd05143d8288c33fa1c

SHA1
84c7190c0733f56240f892f24b2d7445e7c0055d

SHA256
a2c4e9f85dccc87da517e50c2de5b392414ad037d3a3d951c968f837e73ca86f

SHA512
bae5fa78d2352a1fcbc651968fd9601dfb40e44e391c818d7788d33a1f3061073ac3034502e74a2f7aee79c992502a05b066587944a09f97e39ea55177b256fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11681d1b58acb72c96120f62fef9e583

SHA1
3cc426645395e61098fb4d447509d2969195d08d

SHA256
445f710b10d44560d68fc5b5a0049e0da76e1716721a2909969d0aa4ff6a704f

SHA512
6d3d8bd279eb318f0c3672ea1786d34f34aebbdc7bd64d92aa93061ddeebdbece1f62ef2deaf7315222f273e26bc929ac43575ca1f26539f577aa17da7ebb370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed5643e12f47c36147c3e34d525192ed

SHA1
773e71d6f757086e5e96aae92feea3e85bdc8a08

SHA256
ec727b37a81d115900b761b0e8203c4be47ba6ff742f4881ffe85a80734e7942

SHA512
53e53b54f08a12ffc36ea13de2d7039dbcb60131b0187c26ad85ceb4346756a017472824c415352357d074fe8f09f60ba7b4b6d02e00ec94639d501d6bdf4c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00811777df62ffa411700c70b72bb9f7

SHA1
dfa86407188dcf217265a1f29c37223242db30d8

SHA256
14ac284dc154cc88273f057b3b09a6e24563c69535ccd3728ace986479763276

SHA512
d694d22529df4af3e71167f8f121af1e175a10c3afd29dff1a543396953740252b7cef302ef9f1b36181d71099e83af702b3b2ee17ad141c3b5192ac76fa9ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb59d8a8387c5fce6929238dbfc1bacf

SHA1
7eb1b25f6adba35d37c141476164ab4ff8fc2d08

SHA256
c16ee9344e5067fb73c9b3071710523215a3f5876e056ac1ef40280264a966a9

SHA512
ec60fd806788aa0653e8a2e213e3cc5b501e87f49644752e85a4f11fe1eb8f4beb21dc1c2ca18b5a7d5be6b7e7d011a76d842a268249cdedffd417f056fff08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df794809872cf0a572225f260e24e7e

SHA1
3e96c560d5bfc6386b2457c2feb2aea8b6487269

SHA256
fd27e97fd5b77bb10c4fd170050fe35407eb2028fa27696e262411400784a087

SHA512
d22fb15d0ddfc810942c3f9d8dec0abd7611a355dca4aea8b2f7a98b4252c0f4b7a0f8d26e9f524bac295c48506af728d50c73b651b6f6daa1a597e1898eaae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e755a2dd3d4415612bada801b612b2c

SHA1
793b733100480f5e2b80a4fde7b6d31ef67cef3a

SHA256
452d8cae06bf9767e29631df1e05dd2f6d3e5837959547edf9ee2f845ad98943

SHA512
4698863fd2b373af9adc68ac616d06701f57348b0cb6ccddc04373e60e12b445e561701109cf463e2c07f7a299c38ffbe9196517794693f8cd79c907d1cd9892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6fc290b29fc19400569e45a7b840887

SHA1
7023494c00aa9f77d182886b9d5b1350023536cc

SHA256
819e657f67e5aeb118848003256618a1e1c0b382e5c631da96adaa7a1e2c577d

SHA512
136ca549a1254b906c7dc9e6d0683c32df4a7766ec8d7436d77c938fe61b1686af10979081996a66f044fda2e0ae2bed19d04a59bac0f80179e76ccfc6f22c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBECE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF40.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit