a4687be311c40c16353baba08daeb86d858f66ed9ecffa9925efd42c4a0b5aa2

Analysis

max time kernel
134s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

473B
MD5

b0758fc26c1dbe507d7c7b517a031d06
SHA1

ded38de36a9ea773178405a850bd071523499dd6
SHA256

5f640ee430e564869e94138a7a1ebaf1ce4430f52c1ea0eb3b3f39f27049da84
SHA512

aa22cf701f5d591fa14e354769a9ab7ee94f969ba8cd519f2090a772ff50731c06a094240756f4cdc8a56a374f3d0d0d5fbfe6d306edca2a9d3e190e81a6b19d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0414ee38af9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402892124"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000a96bdab1d8bf874cd13e1191b12996685aff294634e867447b61a8c3a40a3b9b000000000e8000000002000020000000c0ba3947c691ef4ac124fc7806e175241741b4c0a42cc9f1e2107e12049ba7c720000000b72a3eaf8354cdefbd959c152c5e481ff9a97d50fa3f88e06aade095d84466fd400000009dcb625219bcbe8d3b2805c42f6a0a988047972440fe77f6955e4a67fd6db8c1c27f11019f2fdb338dc0c77839675a6bd787c180907728f57431439a3dae4082	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000087f458bf98053ea85ae03c3a45f7454251ef1f4c91400c72b4ab7fda43b84828000000000e8000000002000020000000a8359450408b268afdc3c611e1c03912fc23a15cb89f7028a990e9c234ce10ca900000007bb3ef3221ae272e670cfcf299312b324f52d1f8633793d0fab67b6a71a8b829eb2a19bd13fa5215768ff09dc8f92c86388e3962731989f3a8827c18745f71eced17da7c1b074a65428152b99adfac5f56fda1680c98ea3ea5c9268527d330169d7006616e433c8dc6835fc4f5949d6a6a79147cfb4ae113bc051c4d30f1611dc7acf81439ab44664a0fbb5ce91ab481400000004fd38a94c47322c641b1b9abc2c186cc1801ba405e9e795de091fa7e35195405db1222545ce8a31abecf1d438e6e5151f2fe32e818ac30d9529124d3f918ef17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C797091-657E-11EE-AEF1-D2B3C10F014B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2196 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2196 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2196 iexplore.exe
2196 iexplore.exe
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE
2120 IEXPLORE.EXE

pid	process
2196	iexplore.exe

pid	process
2196	iexplore.exe

pid	process
2196	iexplore.exe
2196	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2196 wrote to memory of 2120	2196	iexplore.exe	IEXPLORE.EXE
PID 2196 wrote to memory of 2120	2196	iexplore.exe	IEXPLORE.EXE
PID 2196 wrote to memory of 2120	2196	iexplore.exe	IEXPLORE.EXE
PID 2196 wrote to memory of 2120	2196	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85fbfb707ce9ff8a59c7d941b629b059

SHA1
11cfc27c5344117e4a923c3fb04c39b1ddce9ce1

SHA256
46cd0ab9367037926f1ad5a5a4fce09226c290cb95b22b553ac2885805cf19bd

SHA512
d149be50df99616bc9c734e13b0e477bc9d658d44ef31e3dac58fd2a4f69a821e1d8ee0549bc93ec49afade78da53dd19aa9f093911f095e1926285d9ea7288b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc77a5222125840c0573f3ef2e969ad3

SHA1
a439356aa24b771f96f24e9aa5e0dd7c026caa4c

SHA256
7bdf21cf4677ef29d9fcf80df3894fe96de0a627cf7a1b38aab5b6ccbce93c06

SHA512
8bafff5e7df8a64d85d8a64b2816cfc58d748f87f53cf9cdeb9a6d1cce2389952a4c70dc0a44dfe983c89a7f196c7f79ee28b69f26c5cd6e3d1919ccc36c2fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaeba00e5e8669a13f7ea76e5627edc8

SHA1
93c34f53f708a82f367a9c6a67b427c6db45db8f

SHA256
770218f25fc6e77a7656eb30e53ed2e96115ea4dee2d16b1d350ab7a0cb767ad

SHA512
ddc028af4857abc7223164194184d429c0422de86c6be14a24c5e583933484b2dc457871c72506b0f9d8cda7757b4dafcb8bc36eef416ac2262f4e2ffa0b3e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cdb8317f3d976f99d90c617394272cc

SHA1
09752ceee1b0bb63234c6fad9170b93e1cb56975

SHA256
5c846540bd72ccab441d6bed99718c3a5129f92343c01baaf43eeb4306662bde

SHA512
319f6a98fd5197305f075ff1685bed517a2ab2ba5afb3683c37190912c6f17d57e265ba0bae7f5e7b58c7e20e6eaff319efccb0e466e790047118e9c8d222f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9b3be556c8a9b93042e4358c74639d

SHA1
786a2b558c1509a5cdeb395a920d5b994261374c

SHA256
63d68a9b7d7895288c898da4cb3b67be7b08581faedf7ccf501db5b6ab8c15b3

SHA512
52ef08129d539c3044f702b71a3d384f33544323c259f20720155e87ff7ead02d8d28eaa2340ec8c9f58ea5741f00c734d15b6c52dc3430158381ae007b9374b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84db244f280818159b9fb3ee7c09ed6d

SHA1
5150f4232cb7a20d8e828472b85cf7bbf408064d

SHA256
9952c372a8b3ac971eb5f5a463083abf2166aab12bc0ed32238bd903cbf9ecc6

SHA512
9fe6b884966d8ce68f68c276e18db328ced77ddd5e9f501bb4f9ed2675ba17eb1c9f27ed33072b2ddbe82e30fed4cbf0f5fe9f623110a087c6ceb6534beeb9ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b7712d4dc93d0227f869e1f26e12c6

SHA1
edf9dab4ddb07c421633c3dc6e53a62b2c4fc9f2

SHA256
7913e3d9297691f6607cadff3549f4a6398cf4a38a76c1dd63091ae89e48986e

SHA512
b5d9b8d2df0a0bc5b251cdf04b7e5ae228fb0eb60030cae16f21994d08061d15b1b6877198df48318fd50b9269c2da62a1ac0f9a800c515f1daf5c19e700ded0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63eee2c56b66e4bc22b49016909c9d4c

SHA1
15ef9d5b9d709b0a31d27e29d55dffa8061df557

SHA256
52131fe5a5d5b084b07eee3c84770614cbe06e1928eaf2749dc83bf1c108c911

SHA512
e24d51347c1d42a167e97309ecf05e279ba6d1e9c2c328e95ecdf4c6c931318f6488b83783a8c0a9e5168d2c43d2fafe9a5b847fd5871684779ae544288f66ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c24b671ed3791d7f3fe4bbc5be8145c

SHA1
88ddf302e6110dfa41b9c90e68764f323fc885e9

SHA256
209e7444b5fc8f146da499f8beb70e87a5736dceffdcc105e9011d3f08a66687

SHA512
c02343ce3c3474f8f91b97722374f5547603112406c0c594251dcea5247c698bb322a242e52ac24828a440ecbe9cea7001e1ef8d24211eca12abcb093a755c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5853f50234573d0055d758715ec537

SHA1
66d405f3896f6a72742c80c4093921ca4ea67a11

SHA256
35c23ffb4eacf8d33ad41c2ee529ee530193e75c98f0f7c600b64a6c2f4456be

SHA512
8488e76d10e9d29dde98776e8a5a826ae5db87169026ee99a39f7433a306e9033bc47b29189e6ed3357780c74d0b276bd0d6e91908bf1229f1bce432d7957c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab74B6.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75C2.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit