e1b6c74abdb4660b014b37b72464e53dbe86ac25ca3a20f2466a057d5201b972

Analysis

max time kernel
240s
max time network
285s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

es_privacy_content_en.html
Size

26KB
MD5

36aba766dd4371dad00c95896f1d27cd
SHA1

155e371a71ee35a766a365c9da18e4f9a3cc777c
SHA256

4daad217625b90dc4ba899f26821b76af5c87df3b9cba48ff40a0842ce834174
SHA512

82750f7526b50a0256f1181d7edab63c27c325dc74f14d29d8cb801923fbce9c85013b25ecd1b1e74ee3a18ddd5cc6a874d2cc0b1d994150b13f16039e748c87
SSDEEP

192:OvAYoh5hG83KnNG874lq/EBWbDoVav0xGLNxMF34Fhgvedsrapby+nuznlLzRtBB:rhG83ejDgvedsraphk+DhiFVIzu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402895927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E41599E1-6586-11EE-B3C5-5EF5C936A496} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bb9dbd93f9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000c10dcb2bfff19bc60103dec546c8421814c074361b28e21f92e7b20e8e890d1f000000000e8000000002000020000000a1efec118313e47667028985e42de76391d0ed25cd470384fcfe694ee2f60115900000000fab8a06e3118b73e2070c2b1bf429c32b9437239aedf65d1852f72c1210bd336c5ba9f3cd34791d03ccc0a7828df659276c36011905fbd822934518a835656ac4d6ac7fc5f0677df13e6b771547f6bd1503a14a97ba88cefe7ab760a9468dcab21cc58b0fc1892ab4c2b3781e48ec1235dc9440a61a9f0a424fd0e3ef309a13c3b3bc1b95822e2987a57ef371533e9140000000649ffc0d7e6601deba658d3f170979eb386b923d4228e03af6ff0063f68cb95a42b3325b418796b50e0e801411f8072c3f916e9c1d66dcded8359811913266c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000008cec61459f800950971c9aa098a9cc8c85b88b907699fe5056a037fcbfe7762c000000000e8000000002000020000000306ef53e927c6f1e69a401a2450f18788f06e3671fd2511695c45e3c67ebde4d200000007c91fc1cd493fe2d98d69408df15975264ca14fbceb2d23dbafddd170357c665400000000472487c6092d8f8905480c43ad26aa967ed28d3d207fa107a41d3715997769cb6d93519515f8b474b358a943d6f8142ec3801387b68875ee1845675297d965f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2660	2712	iexplore.exe	28
PID 2712 wrote to memory of 2660	2712	iexplore.exe	28
PID 2712 wrote to memory of 2660	2712	iexplore.exe	28
PID 2712 wrote to memory of 2660	2712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\es_privacy_content_en.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a57e8dd557b85287d2b9bcf1255e6b

SHA1
1fe6a7f33cbdadd4e9d2707af9fccea1919fd037

SHA256
a96892de7a67f6ea0d659a5ceed75924b7b8cb96b27f4f7373354d70483da85c

SHA512
e5e7f745a5c3a319354a1d43b8860303d525aa15d96769f39286c4255cdc2b8b82c56f8b73863383f55c1adcb77c3d3b8ecd4cf02bb97dcbba334f11e91334ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faaa04d629ed805eed04b7e234905f2c

SHA1
39e46a27fedd9effd4f4cbc0e95db5f78f486e2a

SHA256
16ab968f6900b13c0bc38ec65dba5a4a679fbc0056a081e2970e79e9d6c6e678

SHA512
ddaab9ff7660d3758b9b46baa8dbcd01282677ac5b07ba8375d7a434a2fe929c4ee8505dbed5a61d4846dfd48d90b039d47145f3e3817ae5a859141cf993daef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c742da75e562f71600fae57673f996d6

SHA1
3ab1c20e87061519cc83eb975282a3facd9f58ed

SHA256
c13b4fb9d5cb9739be63665e1724b10eeeea20cac08ea114b8a5bc8a981bcdcb

SHA512
ec0a3f84ad08def66e29365e4b10eccd85e5836f4a46b5831a5794aaa4034e44573b81673c5c29d2bc06c39a959821787dfdbb5d549a47616372f0dc7ae15876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2bcac3051bd29d8c8af1b7b7f8a595

SHA1
8d168bbdcd607bb312cb1de48ca6905c6355861d

SHA256
6384f3ab4647e017f3f813b63ed54612bd2dc2cf29ff478869b03656c5769cfc

SHA512
6bd3ca648c7927e85cd6c044ce51cdfca2ecbe5a0c5a3afafd7bebcbf5ec8badeb310b361103ff094e174a47b028d204a887aaa6b5ca6809fc73125b1ae99d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b34267fa08d7503dc9b066e4bb6dac52

SHA1
91d8fa210471d2630a3be4c78787cdc794d25e90

SHA256
2dcf03839e76f0bc61984987f2e62ed5c77a6c9443e018f7e277c1fb58747914

SHA512
c0b224ff2bf73a44becf06d640d3a92938e261cb4c5f1a99a77fa743a6a687a7cc785a401f4547d7d8b53cb51c1f1e3df8fdcc59de7f4f2034f8ad2da31666eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
534a48e16457f032eb0f4728365ed6ac

SHA1
1a07a10fa908ad4388bec19ed478f915176c1326

SHA256
1fa68e031b0b339f9658bf4c166fbbac571672d59051ea1d265734d8d48a63f6

SHA512
a098b0f8141c41570213402122e2fca0d1612d82d38b95dc0d762a65e0919d50d4e4ffc60a73d8846e8068daa0582029481ffcb0e0a59c1c380704ef7024843d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d50df1f417b602ae45b3d8c856e63d

SHA1
8f30291ae79916dc9b79154653f9c43d13c68ffc

SHA256
dc3cd5985b34cee861c3a420544091d7f088246206edcd2564b4139c16a2189d

SHA512
02a0a9dc12650c628115873e28f64c5d7ae1a463270d81831cb54d53e0c529810e196904acf07bdb685b502d588cfefd4f80a186a968c94c3813647b4198eaf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b4addcaf05399864c7bd4036a5d4d9f

SHA1
68a64e08d4e9b2288dcb7888b225af18daece1e1

SHA256
41438ed0449ec802fbd586f53123bb8f42a6436e714f4c99e1a08b2a332976e0

SHA512
7156662563a8f012772bbb835321ed2f78a059cc830841c8b6fead71d4923c1520d6309c2350f1ae03605f0c78f66502e462cdffa25a4c0b67f1b437c234c511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e84a5ab303c6678b0a95659321f26e0

SHA1
c225ae230a964a005b6428182407a38ecdf546ed

SHA256
047774d1e099318306517425f86e7429761d2e8bf3a60208bbf0063da6c9a558

SHA512
d953c709529ea2adac731baa43e44473daef56c89f37959d5e20f6b654e16da2d64df46c1cabe5c9280182bef09abf1c87c9f02005e7a11e6dcf9c2977b1f3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f4ca4ebc12223ddaf6e2b03375292e

SHA1
709ee87acd89e4013ce59d044aaf4bd66c4ab050

SHA256
c7bf92cde4fd97e85e6e2c24208af8448b78c932f2a13debcf68c011dcbd8ec6

SHA512
d59a2f8a652b06f5ae2e41d19ebd718b7dbf9b0a89c8164ff03a0bd6cfe3fc102d391f913ffdbfd42217bacc71be8ccf4de85102f625153cb7a8dafd71cb1c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543c3be5d712b73dbbe0ca7b7b408a32

SHA1
fc6f0605d0af7df841329f2009ebf2dde2534a1f

SHA256
ddcae07bb92df9c1c82bb7a8c32f3204f5e2bc46f61cad21380a39d4009a2fdb

SHA512
7c9f2a21102f9577a11c59e834f7b969bc65be83aa41b1e25bea0441823b59a58ef5c3a0475fcfb6eef1a4f07551d21766ae0e5669209b6c1b28f5ac77af8be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b19031ee28cd9560ea099fecdeecc077

SHA1
bee3b34b28f0b1ae3c28201af90bff75f0d4e921

SHA256
b2c032e79bfc1ed4b0142f8737c66be571172373c38cee3fde65d26bfbf877e0

SHA512
2b5d542b71eca84fb3afcd17833f443052f571a2f6da8a86bc1dcbe1a18a3f93f11546ff54306f1c88e161bc47eed2cd661ef7540ee372bcd55654ae84b89b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d2d9bb91f84ed5ac233d98715e33d8d

SHA1
acb6846694640afe730b098cac85902f8c0d420e

SHA256
16946c9a788416035864b6bad03365e1703dacde456630aea96a38fd043d9ff7

SHA512
e75bde9d6af73633b0489ec27ecfb73aa395987274aceffe3a1e1ae0069126ef73790e1c8989279005d9d359e0c51b2979c66ad61e859da14eb9dce3ec40dcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035561466233143792c089253fc2e3bd

SHA1
38b9a1cbb474bc8b54317ae075174f383a1d7484

SHA256
9117ac1aea320085dafd4df7cb0896d157f18b40621a9d61872ce5ab648556c7

SHA512
6d2d57db699a25830ee7755fbcf401545a555c73509680d953e7110257623bdd2d0e2d780e58991e6a0bac80b9ebe5b7c9eccf18eac8e5e4ef8ad6c297b4877a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEF5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0BD.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit