6028204948844879c686051f2f1c5bedd2fce6ee75fa08a00af281816171922e

Analysis

max time kernel
134s
max time network
157s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

airplane_mode_set_state.html
Size

975B
MD5

3839616aac7138cbffbb574a8a029c44
SHA1

d6b7ea09aa34104b9d7dfcd1bc31c15b300d6b6e
SHA256

5201f04f74596aac7cbc91bc2a9737138fa23b565401aacd2bb11ceedca2d9f7
SHA512

4867a7caa78f6a1a965153e5b497a413d6336f39684c93cff39c4040704f78b67418da3635dab8f9d2fd7080d2166e58fd59f68954dffb83ad497ea9c2b62ed2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C52F2F51-657C-11EE-8877-7200988DF339} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40255f9b89f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000001a4816e3b5caed2a0ebe330986d77f2b7acebb49c5f90bdaeca5f3bb154f1e86000000000e80000000020000200000004404c0b8ddc6e542feea37bc7533585c05b34f305b8c21a935a9912899ffcc762000000088a6658290f2c19dd71e56af0a7135d1ce6d3ecdbb2c40d6022a1c0229c1430440000000bc3a1d4cff46e74c5fdfdad310f5bff18f90864775fc9b6cc7116094839f853eeecf2b1181c393cd1d2b3e6ab712857f39558b8f483b9a0156b3e0d00ad053ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402891574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000126dea2d4b1b5c5922d6fff3e84b4ffb17c8927df5271e2b1d22d74f2fc3b5ab000000000e800000000200002000000009c4418026f45de573968d719896cbb413bc6474ec2a5ddfa778064982c6139d90000000bf3309d32ccffbe24cb55f9b2259099f5102cc674bd9c408d1487131c73022cc794ca9cac58ed7115ddcb2cda814614ef668ace8a06141cc9031da72225b25eab932f4ffb3fe4bb28b8f3172370762575effe5f632e809b92653df87f1b377e8bd73c8b6cbc7939be576ca9505560842e1182712526371ae2467f353493b26e6467ac58bc75ee36c396eff0a0bd75118400000008c743cf9bbed29f0e1f6247bab0a07d8b969b27aa64909a32b4e9a8c16cd7198990c4ff5fcee3c2ff7d7d738ee1a3664cbe685206e5fb119d9935ee68fb9d20b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2656	2940	iexplore.exe	28
PID 2940 wrote to memory of 2656	2940	iexplore.exe	28
PID 2940 wrote to memory of 2656	2940	iexplore.exe	28
PID 2940 wrote to memory of 2656	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\airplane_mode_set_state.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f576c43653cede73d07062b539f781ac

SHA1
92455a41bb4fb6c3b73adf233179f101ceda5834

SHA256
185eb9a6331f3406bed2c70d5812eeeea2c0b96e77f5958af85bfdb21cbad882

SHA512
8c7ce8e76155d784f2e25896fd942a9b3a159983430ba8d0696334515353fe5dcee330cdfe690cd72cdcac596ba8c2408720f6a03be67420ac63da1ba90d6a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
860d107d7f207bbc525d6cea55a30c55

SHA1
e6ff4d095cc0d5b5c700d007d164dcbc99ba23f3

SHA256
85034fea910f74fd0d16483a17e7c28a76d3da988ca6a759bcaf001b1294cb56

SHA512
b52ae9fa4c79c1f2be4687d21a446676bc2ec0561cdb5f730c093d1b420080d055e0628e22e21b0d7bb0fe2ffb2a24a903a77106a7c99978837d4ab0b3a03690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e95a795f828b3d6fe7d8acf83e173d26

SHA1
0b2321e7e2cbab340620408597211cad7a9b0e35

SHA256
2d51e405a4a4ce603d5da2437b4da68d0d59ca1b44b3e222fd0959aa12593fe2

SHA512
d3c0342b5c7405cadcb7723c87925812532ef56e7a5fc0179c07411b2f6130dc9335666bec3a970364a0373d91bd818edf0eb08d8607b9c7235823d8c1e73604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c924afcebd047a0601646f1a270cb2f3

SHA1
107c2e3c519fe54a5b46a249217b9fe0c6f982e1

SHA256
a99d3b220f3199995eeb7f1f571f82c42caf120d9f5726d10498f7a421a1ddb2

SHA512
5fa1171c6cc3bec3c8afbd48e961e3fc8f32c5300d8550c2f27cfd1fd42334ef1204e5dd274050543a3c061651586db0a305bd71d45e472239954fad9675b116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc96a25e8e09c6af193b859536065d13

SHA1
9856e7e3e42eb5c9631781bee984d1b90858ba2b

SHA256
b8c4852b27c62d654379caae1e1dc2e8b540a026202f6b2ea6e036b6e969d874

SHA512
982575bc8311f77511ee4f34c5d22b8a503486febdcc54568b0d7d8b8e91fa29ee125ea5e9951174a774c9d360d3a615b454c8df4e42bd9431d0d6259d85978d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec60c451c2dde23fce3e7366dbc4434

SHA1
efdb3b9fc013d9e48dc810fcb8277686cc460622

SHA256
421d6aeafb86e311fbcb7dc072b7a6574d0e24858a850c01427cd5e7d615919d

SHA512
b6cd55fe2b9f25dc578482274054e85c909856c0490df99d4ae3ffbf964d1c1be84fa135415da377298783c008edd94e7b9ccb3c1ee2537e908117e49f411952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bacd232e0cf266f97fabbb26d7045354

SHA1
4c9f18ca1158ca7fe116947597495c91d275234f

SHA256
546a150b8951e310a88267648b1b3350ee05d9e56d5a06e534414cc9180d64db

SHA512
61afc990a2491f1acd6fab7eef13328a9f251a82f36037aea8eaaeeea97e0d2b9bc2421cac70fa2f6206c7922ad618a796a087b50434d44c2ade68b2b6f094d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b137f612fff9f220e839a8d4bbaf53ec

SHA1
651f0f686a559ae2dd1d80b041816d9f03032027

SHA256
c0be37c9a6cb669679a18c7c907bdbbc89edd3f4cb0d1f83acaed8dae035f065

SHA512
e10e9154a4e398464c8816e02b13a981b713823e7b4f54dc1836c235d0d4a4e9f5644ad5c0212c68f515563d5b4bffe545ed0a9235805a1d838c4829fdd997a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f07069327b6528a312acf377b5c03bba

SHA1
1d893f67eb47f555193042d15b7c86098ead5f64

SHA256
ccc023e08622adf4eceb5da96c25b0e40400aabd72cabee8fe9875a49584f289

SHA512
c995d4e0ccac57bf733db8d3d6228de98fad8b889e626808aa50a1443fa7045a02c632d29156071d8d52d0b69ae639b719be52db8899f641897c21d14494178f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbc23bf58b52a0cd775f059100f2771c

SHA1
87788ecc3bba1a8921f4db726dced156fb7867f1

SHA256
583281f154993e184c912985eb169d789f7720d142e36e355568f13787938545

SHA512
c2fce628b0a7998c3a30c5cd3684740867d86533eaa3d906aec893b2835b4bc1f0821102bfdcb4f3c604d67a6b09077eef736fefa06e43e6a18114048bed6ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b20ef240091849a8f52505bc52ede625

SHA1
f7d6d388ab21a740500fba6dba2f0685a6c706bb

SHA256
4c3f33c97c854fe5f5ee5cad9dfe31d8fc7c662c1193b4fa9036972052be042c

SHA512
2af76a26235bdf5d91ebd033227dd6dacd968240a3e885949f8f9d6b6f1ad92d7b75e509c20a3e132c38c55cdb2dcc6c9ba0325233ae1212bdb3b92c0b1f2ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d2fc548f91b79c8c84269417a2be67

SHA1
54b28dbdee18f15b45ab5eecff42e796d3da039f

SHA256
4b76130bf854bf50642cf6cd254fe8afe851b5a9c969568918e567c9b8633bfa

SHA512
765f9295cc194818b2983e0177ed40d520e71247dd10453b11c7a7d086a32898a1894742b61d70239c0338d1f39bac4e7c811429c84c62a8eb87a4d059f099e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058cea0346f65b0a7ce90d6a439c35de

SHA1
32a03e0e0da618bcb7976870b734d675958c58a9

SHA256
646cbec4ee7bb81e141374885f7a02a469abc8364165da0501fa5d71366b0f29

SHA512
b76b7aeed2ec9e6ce808961a34104e78797e39c04bc8d865450c3574c0fed49a1bcca27b5e4ebbc5f80da47e6d74c5f74624dff19fee5f65aa26992a864dfd3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac70a03f406e385fd03f38e59b48a96c

SHA1
2ae34bc072e25f2caa8f4ece23fc6886694bc7fb

SHA256
7f97f7fc28e6a24498ecbb31214615c8d7534b8f006e6517324b0c676967b72f

SHA512
4424587b2261b182d13948f9bbf1bf21eb3f25f7f23ca4ca5d440e4b2bffab8a5fe684dc5ad7ffc849104d623cb15f91c3f20601861632c3c91ed77a492b3fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07cca1db1165495c6ac6cb48b78ca61c

SHA1
cb722e1f31c35f4fb85193bb8858db22a218ff9b

SHA256
977da1126ce438e1b254a24fdbf5b229044f8bdc064a7d84298a5384f31a3484

SHA512
8630d5e91ac9255b74e4f3e16041d24ef19bd6cfc00f03ccf3659e268dfc031ff09acec790f313f90f008919c42c26d996fe269f8697db1f0082758508f29570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b01aee39222a69bf7ec577917c6dd1ec

SHA1
a2c21edb673347c7bbf8c6b6de9f7397b49c0abe

SHA256
08d3f410ee5565ed33ea311d33fd670e3498b49c4dd12724a6622d21fdeaa04c

SHA512
a1380129be3252f7415f46e437c04ff516247d4d9a8518598e0218e8d30c76dec64797ddabefae7bb23b2e42c5597206731bb39c5e33e1c7cce73f61f280226a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2494b0b12a7e4396ebc329a69f001ac0

SHA1
5e586580494731e8f6cfdfc0ce6ad36067356fa1

SHA256
ca874ee725807e60cc8925a7724b021f43326e1e88c97f52cd010ae74d5a2b6b

SHA512
b2f11f8b7bc63ea16cdc51d9e04370957dd2683737e8722f125d648b28f89232fc805d509c654f6fe6ed001e7ff0f19c9c2ad58c7a688942a4bbe4539c920734

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB618.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6F6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit