a4687be311c40c16353baba08daeb86d858f66ed9ecffa9925efd42c4a0b5aa2

Analysis

max time kernel
132s
max time network
260s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cover.html
Size

5KB
MD5

6dadb417a75921d99c0a1a38e02a4940
SHA1

54b70869d8e91575823e1d145d5ecf4714a74f6d
SHA256

ad9c860da0cf8f96cb35b47ff6363ca543e3b30187322fe6857151ddc6de3cfb
SHA512

4ce093ade96fdfb4d1ac149a7bc2d5297c15c61859f7d46f0c83bd162a4cc21c5599e842b5b7696083886f6c918faf92f4a4b3be1a884a8fd951f188c7aa7fcb
SSDEEP

48:tM+hWjkA/EE5p/3PDSIvW3uvAKfOQ7MD4Kq5b5zx/s/+/e5b5z1PT32sqA6yXaiv:iD1P83lKzzlalMsq9yKpEPvT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000000c181124ad716dc1dcfb2f2b89547b7fb05eea071af86ae7bfefb4547c99911d000000000e8000000002000020000000f44df2d4d9350e1ba9e388e8183316c134cccd30e74f919e66f25f933091862d20000000e7160852e20ddb72030080c4e07dd4522c6362d0410d92fcc48d0590e2865a8d400000001c9be58faa3f9e016feb6a499da9c85beee4611b7815fe2efdf3566c68fe24e58fdc72087abe46a646a344004c7ee21270b3ad08955bc3c1eca4c7883dcfe024	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402892366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000a6c8790576f5c3fa40400a6160db8c0b513b279d338773391962695245085237000000000e80000000020000200000006a8e5e9b7b5bfeda8d82917ecf6d3e9430ddfd3dba4cf42b357b4e3f91d8a98890000000dc3c1c8e6fa655c80d7124e7e7169917446d080fb55c21c1d02e543cd13033eb824f334c191a60f3c489d11ca0e78805747e3fa1be4c043b26744908c791affe8f2fc6e9558cd27373b107e5b1a27f49433cfec68cd7496bd4d1d3c093c647f0d5e5a821d69b6f56b895a0f25c72b7105acc31db68ba87a2a1be4f845befb1b1937969da837251dc1536b5b28175294a400000005f460ff186db8ed6f4a04ce32769872ac9ede8e6f2277459dd41b0471120e7ccd7a0fd39f630c0e90126bb37430fcacb72b7472b09784183502246e6496a884b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6047c1728bf9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D5DD101-657E-11EE-B812-C6004B6B9118} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2528 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2528 iexplore.exe
2528 iexplore.exe
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE
2524 IEXPLORE.EXE

pid	process
2528	iexplore.exe

pid	process
2528	iexplore.exe
2528	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2528 wrote to memory of 2524	2528	iexplore.exe	IEXPLORE.EXE
PID 2528 wrote to memory of 2524	2528	iexplore.exe	IEXPLORE.EXE
PID 2528 wrote to memory of 2524	2528	iexplore.exe	IEXPLORE.EXE
PID 2528 wrote to memory of 2524	2528	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cover.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37fdb1aad00644dfd4ea65edf372bd1e

SHA1
2d7add998755966f54cf0d728f1f519d26cec1f8

SHA256
64a100a06153a91870a165fc0503597a840b9d1ee06136de026eaed131e60ed7

SHA512
5df20770447cf707d417738f93f1f19013380df84fc271f27f04d08a62bff4b07dbff1e671d4a45c2fcda24558a8a4b626473bbe556bfe518e0dcf3d18c8fc9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6c7b66620f09194eec9fc0b078cddb

SHA1
d88e8fe613b8d7e368ea651819994d414a00b317

SHA256
9dee97236837844ed01fc13636c198b61c35aa3a7d2bacf29946eeaf203c130b

SHA512
787b89d3ac3d64fbb7dfe278f86d0045b832737e1e2d861b11b1d4be355a1b0b6e4b89fb784ac1ab89051b3e51eb91b85eec50d768138dce2b88713cd84ea60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92246b00d19e387039f5d5f2b3c3a63e

SHA1
3e04d1dcf25227a6ef013fb7c146e646f35f53b3

SHA256
75b3c8cfa8a4543a7ed4f0db54e137a51e68df86bff8fbb2e93e6f7073b52c9d

SHA512
871c1c7edffd5d80d34074f434bac2048684b366762eedd32a017c74095fb47daf1b5b9ad2ea6f31f4b9c3be89878be7af9bd75519537780303e33362aeb56a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3252731c61297c78d1d2fd5d906fec9

SHA1
a06a18629208d5114752dcb09ddb9566c8cf03d4

SHA256
2da355b4792c1ae7407439e3882de875ce1290b5fc1e9ff83b182582cca4cf11

SHA512
f9f6236c77604653720133f969ebd95e47b827bf2cbccce933811d3fc9784993137d79bfeb2b791f798f20a0a19c921d1c14cc407791786f624f2fabdf1b892f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
723e10b8a425110f841cb6f7dfd45783

SHA1
6488d5a7adb1306773eb550dc4ebf65d6c4d7074

SHA256
08bf1765464a2b9618a0998162e511809711515b45147e44ada107e41ec8928f

SHA512
11c101e852b750a2e3f47e1a45ce2aaad05e3e5495fef66a1fb7856a91031be1c33434f14009ec9c4a00a347bb578091817e6518b88254e193cc52db20f1fdd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3fb5849f0277d99e8d6891decf1e122

SHA1
d7bcbe532f974c34d5e3cdc3c8138506bbe25728

SHA256
aad7e575b1ff39619cc4adcd9287d77ba1e421475588a6f66d31918f3166e122

SHA512
5395cde07c1e5f02cac59e36ae10c76e362a2128c8828529a57963fe9312b39659c5c7ee66b6747c97b9cfc11174405b5172cb971d48d4390cb361b5b4c4f2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c5739e06fe8423b070139af58c7a4b

SHA1
9e8be99e8af9cb0d0c77c5c21904344a47ace857

SHA256
785965abda114675b04a2d3e0c938140b31f00f1abb1b79d1577134b5e34eb58

SHA512
b84a5691df097655b49165dc4a9aa51b867a125a732f7444ca15489e18514e1b8beccc27da3c8f5ede1392c5e13a8d5a4cbb7d058a459fedb666b0f36da80738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df11b71abf4927441cbd220acf1d1bb4

SHA1
8ab56793f11ccb5c28558593d327078e28527367

SHA256
2e1603ae780ae845db59d1ee8ad17029cbc23d77b65df0b0fdbbe75510884047

SHA512
81a1249d940828e52bc9ef25d3d12a8dc149d83786a9c91224328161d9be5dacc5cb57ae6e506a51060a5e4a70e15c47b7c2a3645ec14b826117f07580b94c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a8d2a0420736e94cc3ac1c88a27b35b

SHA1
e646c8e90d1da9fae6803d1635b1ad2f42bcd81b

SHA256
2bf108338e0316569e3deb763e609e5e0e978c9c4dd393ae6335afab82f645ce

SHA512
4d8642e5d2e73d79217d5973e0a2a96ee283774b1a230f1e2c1125572ff750491a9dd4e43b759ad661fed8610c4c6200d66612d5c008c09f9854903026a634b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db280685cf2c8be77711a59b245e93f

SHA1
db332017fa1249b01d82409e38b95b40c7c377f8

SHA256
b4faf826ec5580f37372d81cc9ed4f024d7874ef675679fe4d543d1920dd5f27

SHA512
23441ef7fb67adb42f17fddc211c212a07586766a002d6850c0cb9afa81f02478d8e455de06d211d44127e1d0d36fd6bf35e3b74c8f7182edc2137b7e284ec31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
440376ed20f94a655c8dbdcf89975ffd

SHA1
550fe625ee73655f78c77f67b87f43b7385e753a

SHA256
db84950e30761cfd655ea602aa4ee8499128c6fa559f42af53ae1d9508c0ebe0

SHA512
eaf200a6eb4a2a2ad693cfbf112b4fb2949f848b797e94fbe289442fe8de00c819890419b21988e3c01884e49b5d3b38f4a57eb874b5ba25e95ae7daa6514e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB261.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB283.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit