d295301005a004060ebdb80e785ad3bbccaaa242d6924ec1a12d32bcdb12d6d3

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

editor.html
Size

4KB
MD5

c5e722806008c9174dfe48580820bfd9
SHA1

3dea65dc2d6188e90f4838dcb319a0970327da14
SHA256

e6e735c3a0b86abee8ee19c5f66a45191981ab1b8559edc50e606b54f8b4adbc
SHA512

72cda53f81266220959f1e7b624500eec7d0ba1527f2229dd20710ee1b5dfa24b826a65f7d3b62d805ac6d260bfe27507dac27890246bb01f9fff69f30b7516a
SSDEEP

96:v4iTHFwvusy3UZNVNpBqAyFVF78umEyUoiFAQU8HcxKv1u3iq8Lhui8DY:vjTHnU3DpBqAojXmhUoiFAQU8HcxKv1p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000082ffe12963f0d984ffee9f2328012bdac3f47cabd6e73ea35a447b1676658126000000000e800000000200002000000053db71b921dabfdc80392bff15e68f54008e46da6d2e3a44729294b8752e98f2900000005fcdf6df6b1157edf83286201e6b3848f218de21aef69c0a56a468c3d34c58b46b96893364dfa2cacd4baa66a6a7f52c3b14333d3f6c1199eaf855fe1b5c59715ade4d2093330cbe98cfc2c00615cdcaa5907e78e48300541e1ab68a4e0c8d32b7c699b5350327964cb451f69e07e3129c708166cc482e6f059be19f7bfb47a0952ea7754f2cc56d57444bd4457644bb400000005ce8f2a011310cd9a14e8b7967b18c872766cf90e7296abd387996d4f389f739f60a0584e43691f3afe59297a4ca5af02e49a8cff93ec1282963d617696112e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402887476"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000064d78f82320ae0d9d8e0bb64f97fbd023adc85a867dcda70a8b668df3bfbb793000000000e8000000002000020000000bec45cc22bf13ac71798d296899ce7413f6fe4ea83eb981a0bdece7628f91896200000007260528f1002b01a60719d605d95ff5158e21f5a3fb1dc888e15f655d4b16a7d40000000eef479e7e4ab097010e2695147087cd8286fe89643dd7383162d4a610413bb276b0ed523e31a6df6b653d4e22095bebe91c23a7d9bec2cbdf7d9c41cd7b12468	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807cc41180f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39E455F1-6573-11EE-80F7-5AA0ABA81FFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
784	IEXPLORE.EXE
784	IEXPLORE.EXE
784	IEXPLORE.EXE
784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 784	2920	iexplore.exe	28
PID 2920 wrote to memory of 784	2920	iexplore.exe	28
PID 2920 wrote to memory of 784	2920	iexplore.exe	28
PID 2920 wrote to memory of 784	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\editor.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7bbe1e20639a77ac9ad36a46591bdbd

SHA1
72b6b72462cb915b822237f93b966291c2851696

SHA256
f5b3b9e07b0a189d51f1c896f7377ed1509526c9433823a7f9be3d443f41628d

SHA512
e4707bdf1a67c78f54c652d1181e8f7fe2492fb06ca8a7f4cbd102718b001369e27e1ed5826a1d1702cff250da632c2e17c2fa0b45d5fe99f55d9456f42cb883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7224b4aa5b61b46884e9812b8a9a21de

SHA1
e5d171eba7a2c4886d185a2e7f7ab321fe862f2e

SHA256
68846a6dfd2c6a808c5452690c1e555e0bd1ddeab9086e4a1efaf2fbd51888ae

SHA512
5ccdcfda510eb7421f19e11be7ce4b179ccb9ce22958298b6f7643b5e2bee14b16e2c70158b7f86636eac3dfdd42616e52de5e45750ba7c4aebf885780f9bd8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bef33d67ae42b606ff860841323a09f

SHA1
b0dd76c223797aa7ddb47619afaa69cf13d9868a

SHA256
69915cbca021628e6a8822458cd05463a9b7348424a3bbf750ff09b3b7e87ffc

SHA512
bf79f70d4d0c8049e66de48ce06f2a5b6d281e5c4b24016471ba7594131ddab624f8249412db70c6e6ed68f69e87b7e9653898187b14fb3f99079161d9e2bebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03bece24246982a88b8904dd12163347

SHA1
735a43851d4ce66263b3df647a1339326e7788ce

SHA256
4b0dbb05889aacecc16ec3e2f021b30f041540cda0987f9533d9d05502d12767

SHA512
56969d08135b207e9c619826d7cd3f15c27a4de6ea267eafcd945bc5233b90bc8fd32b7f8dab58a6b1bfa6592c189d43e7384e78b41dcf5d266300145cd93e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20fe97799dde01078e4aafce3ec1080e

SHA1
154e6fd5bc9641390ea17d70691bed9b6e503dcc

SHA256
be1bd1261cc484b0d944b31807173c28f019b818e271101490110c9ffb82cc09

SHA512
77d3d9ecac249e7a1b3c377fe93de886520c8f9e91ef57f38c3586c4e6baa2579b7ff594c357cc9493601124422d843ac0f92dba0b9ab8887761dc393dde3925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d551cd6b630f447db616ff895d2d964f

SHA1
bebc96e412e311cef47656b0835c6c96c82dcf1e

SHA256
399beed5cac1c3842d6a5cca3fcc62b6bbb12464387fc1446d3b72b004e8b62f

SHA512
f8e3106e2af16092de9f07e2965c6f587e098db35618d76158dfc5883759532f92a5fec1f56d27f94efd2ac5bb2a4b6069a0b03b671014cfe085b8d952dcce01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
108822d872e4e6c18b619fd2df700c12

SHA1
8a3d7f18d289c92ebe4aca6f7c69a63b50ff18a7

SHA256
3b07a76edb06b1063919b86c7bf565641e089c431f207d4989378338ac9d987e

SHA512
39e28e7099c39cc0d694db29661a79ae35d58c91e41b0edfa332b166aadd60dad9b4d9e9232b5c16c16d9ab70b6dfb8b86f9346346bcd0292d5b86258be92522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf3c878e23a287e2587984b7d991435b

SHA1
16153c02ff5c5fe0ef9d818ba7cd4be8ce918876

SHA256
3a689b465bcd7c2bd2517236a7251cc65ddce12a3d77d8cceeba049151ba5c64

SHA512
83b75bff1cdf3d1c333800d0cf6ffa80e840e06edcebec3b8d2a878c923e457f80b927d4c5b262552d281e111081d5fe6bfea15a53dffc121ed1a2092293ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C1E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit