6a40b2e38148894b41356b97501cad0c327505cf9eeedbb810e2e784fcef2943

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

problems.html
Size

9KB
MD5

af00120a7efd2478596d4ecee2dd5e5a
SHA1

3f131b209e2e858e3009e2117ef36361cd996bc2
SHA256

7d09ddf251fb4007c37082221c322c0107ab0ea65780d945d860d1f044d6f6f1
SHA512

cc195d976cc52f8d5ce9f75c0c2151c305cb1dddccb6da8b1885ae8291c31b2d289e970fb36f20280d30940c5229120765e785cf2e53c2957ab7be3bd540eda6
SSDEEP

192:+oLQDrJt2uG5jA4iXD90GrDQojETl3Vkpcp0Ps6WcjYc6qtBcf7j8eUhDFZoU0:GDj2RAnD9HrD6aCNWBcjj8ekDFZod

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6942561-658C-11EE-8DC3-F254FBA86A04} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402898478"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a8a4b599f9d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf812000000000200000000001066000000010000200000002a0aaa2ed00dc2b79dab326ab711e884335193c3c7c1fe55f151df4e3fc679cb000000000e80000000020000200000007df6cc13761b82d7a3df683cdca841f7cc299ceee7e620c75ce5ed8f826af95190000000d3e8cc8ec2a771800dc1c808e593d8877724dce508400f4cb037f76521d2fde04d605807bb700ac7ee21ca2c9ad7cc4906231352251ce53787d9fb43759415d0f17bdb890e6f890771c1120af0ca2cff3d79e9e8a50caff2c73f4a1d855f35c65a444ef1588f26dc4727440a55b3ee46c6e3564b77de44bbd6b4fe4e407eedcad62c9fe63623660cfd9eb9d39e8a6e7d400000006dcfd4dfe1a6ae0b0c3b994c99afbc164ad802a4682bacddfc1fa45bcc55c47f919af727151d6eb26cc52a8800e8f31f6d59aac3b1b339d35fcce850b3e94555	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000f25c5200c5d093c01d40dd89785a7e7117567e87a4225dbf6e7bdef35d0b4185000000000e80000000020000200000004d803d220ebcbff005741d885a1d38903b625f6e61d9797fd5e1e60f8ff72794200000003a5f1546fbbfe48b63aa1773de43656d66f518817fbdf8e5c170346b78ca4e9f40000000b28cc2f35daee85542d228ef67ad6fc7cfce03d078a23b37ed24fccfae9229705f9b155198c4f837857f76fe93e73974e21bad2bba03f771559ad4ae5530379c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2988	1864	iexplore.exe	28
PID 1864 wrote to memory of 2988	1864	iexplore.exe	28
PID 1864 wrote to memory of 2988	1864	iexplore.exe	28
PID 1864 wrote to memory of 2988	1864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\problems.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775272a98dc8a8d231114ee3df589c82

SHA1
b8419dc4847b02b66b3d78c120388f72626be047

SHA256
d5d7607b8cab764635ad1ab246483a141f35b38f27988ddbb9e99d114907967d

SHA512
50374b8b16d1cacbd6b93fa40275109dddbbec6b0c22c6821aa812d23fedad088e7f9c23ffd39ed3a3c7e52637603335f325a269e280aaeb774c81cd82659c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaf50b8e44766a85966966e69c9d69ca

SHA1
0d473147de745f2f266fa81dd85ef1daa53ef525

SHA256
ecfceaa4882c769abc62c1e1e26fcffe3315e5646d9a44e85cb07f5c689304d9

SHA512
b91b31a5ff5cfe3998f96573d826abf25fa454e28a1ebde2efb7e9c6a49bcf6b20700c8101fd1382c64496a3af4824ed53eb411767aa925fe15190f9d24e6ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9e6acdddb394def235af5998997792

SHA1
b4f849649fc5ac9c94c64ec119c6e2dd6036defc

SHA256
8c7291ee1acc00c83d7add3693962baf4167e9f1a55b5fa5559c15b9c8599e0d

SHA512
a6da253ef988e5c5683f9cf9dbc108df1ff1f8b6b3c46bcc74e67c81aa4532ee0db68fda04df7ffba515c2f7cb9f45d92458a4624a139faccdb0265f0670f80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f570a6c92fd08d9748058c501d4120

SHA1
5cd63cab4b25808dcbea161975f0bfa137471e34

SHA256
ad8b62977b0f620cf11b4f9855e5fd8f0e5d8253dc67d204578e993c2fb76b02

SHA512
508799687d70b52605979f8935909770a6194d67bfef40a74f1f7f3b6db7098b3aaa6548f6bec26507581694412bbe880222cf2c14b34d8decca7c09a3db3cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f570a6c92fd08d9748058c501d4120

SHA1
5cd63cab4b25808dcbea161975f0bfa137471e34

SHA256
ad8b62977b0f620cf11b4f9855e5fd8f0e5d8253dc67d204578e993c2fb76b02

SHA512
508799687d70b52605979f8935909770a6194d67bfef40a74f1f7f3b6db7098b3aaa6548f6bec26507581694412bbe880222cf2c14b34d8decca7c09a3db3cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b44dc2ec71b06110dffb750a1baa694

SHA1
5d95663b656787618e3ac6e3e3e4c660d5bdf533

SHA256
550efa0ae0768dc53ba97b923218816b20819b6e42887b71580fecb2dda28c00

SHA512
51d0f5f7e9f566b3b2c7cb448a0b968d6d0bfa7c132ed55e552fc1dad8a7923add52fa87731cad0380b7f365aa1937e2eed52b334c22de0f8d9187f9f104ada8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2438a5f48cacfed9751c70836ea2a74

SHA1
c33b372ac39cee1c7aeeb4e6be3e16518230633b

SHA256
4f748056d8beea978ed7e2ab01f94e3828b2659f2f3e010de143d3270d4250e7

SHA512
0e5c0517e725bf4d228008d6db024eedcb6c472a423550b80be3ce36630176a77bb37e0f1494cd363ef03465079c653157c786d25a948ca458ea23be6eeb2ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6ecc76c34763475f6a981b61aedd17

SHA1
432f2e4058e8b3601d9cd0ce4211f63a3751d735

SHA256
49250bd972ceeed1e6602993b44ed0d54c982a764e7a9a0716d18a152a3c90eb

SHA512
8b55b7fadfc510fbc44aac01b0adfd7b87c2965438d37aa40aca7ec6338c385b535f2c894c5f51cf84773f718a1619846be6dbdf986123d3f09c9cc87695f998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5346d077bdafafd57254391198396e6c

SHA1
f0219941ee59ff6841b93912a71ed33d2add0bfe

SHA256
69c0409752d42e8ea4dbe022999445e1f0f53074c9a7ae967f764793bcfc90e4

SHA512
a766489f4e7120cdf2c60e91e30482e47bf4bb5d487a20f57da9cb7e5d953f377620f01f37d9f95649a629988885892738a18ac537b9a9b79d1dc49547752bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb029a22003fead13a6e3c3f8b0caea1

SHA1
538ef0cc861f66126fdb218ac367f5eda143cc54

SHA256
167f76615a9802badb32763c6e57ac7121e73a2213948d5fd19f6ccca6722459

SHA512
7c3c1c1fbc115b1339acbb514e4d954923a8bd87190b71bbbed1aa5baf2d586db1906d0dadb11f802191aa286cc92a39d2e4b953fbe6067695d185fd9524ff24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A1.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit