6a40b2e38148894b41356b97501cad0c327505cf9eeedbb810e2e784fcef2943

Analysis

max time kernel
121s
max time network
210s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fail.html
Size

1KB
MD5

aada3edd21602f628a2063dc84d27bea
SHA1

233d0e13ea2c39a6780d866229857ea955abbca9
SHA256

638b62d066f52d3c5a764ad4421f1063d0f1cd519c319079699c161c7ed0a69d
SHA512

dc198d0cf6940fc7332decac3da2acaf0fc45097f698559415bfe03f19bc0cf90ea6010056e9172e6f9de28923b7b66e7087231a77f19693095fe844f71fc160

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9068a9cb99f9d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402898546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000f1d27454d41da8debbfdb69c1eee2bafdff28622152517155ab365b38b6d0e6e000000000e800000000200002000000019c8788f14cf2ba17c75d8562a0e1a2b3df5e4564bf73da6d3729d711b52e0f1900000003dce24f54268c47c7fab33e765ddefe351444ae254949a4d135a35dddfeccc21b0831705c79e21858a66251192a03f77930abe91033eede4263feb8ef9e1593fd4616b48ceefd06b10fadcefdcfc0eca3107e436541b7c8ae0174e93dd4ce93d1c2c7d2c0a1784da4a4e5da73be4484387d51cac7dcdd29b76f1e0104ce0114b1a51c6f176600a58adc25cc8c8e87fb3400000008bc80ef41cc5a53de2d102ff6454e48e0901503e91041c94fca9f837686a22db5afe70fc6ed1dae5ab3953e3e11692bb588658179a54e10d3ad5f4fcf8cc68c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3A3A901-658C-11EE-8434-DE7401637261} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000a18392fa572a8742f93da1011556cdf63c57ecfb3037fd6944c5f771665ce9de000000000e8000000002000020000000496905f22cae2d15275912d794ad266bfa78353a4b648fce4f1cb79a3fa5cc92200000001f8856140d97f9d92108ef04f0d0273120b04683d4f7aa713415d516edeb86c340000000e763483419e1dc55a38837333bbbd4e69771c87ac05232164da7ea1ae4e8e78c4b35060b4ab087b51757f01536a4405cc394c0dbb915e16537b49a8738e93de1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2704	2852	iexplore.exe	30
PID 2852 wrote to memory of 2704	2852	iexplore.exe	30
PID 2852 wrote to memory of 2704	2852	iexplore.exe	30
PID 2852 wrote to memory of 2704	2852	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fail.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b3341d0e5cae47f5369e098b446a26

SHA1
740a8cb43e45599eeb8e2b4d66e1f6ec77b46b8e

SHA256
95e93d7de966dd12fef451ea8df4c29074f5b19c033afbf5dcccb450e33c8338

SHA512
3f67a01b2b38d670a0397b0587dbf12d43906f0683c19ba7d9412d83a43dade1a2311fc12291fe26a58674c4ca7e140ef3084d96c7686415fd59631e35503c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5652692828a794cacae9700e8d99fb50

SHA1
0162d5fff24cc2fe7367684245bfeb78259d7ad1

SHA256
f7f2538fe85395da0da7635f5b7a2d1490a071d78a4c439572e4fb72ae9e7414

SHA512
f1babed9d0a848dc401c6e547d6df0bdc650952ad1cce1bb58ed36cb20506348966d91055a2929afbd74703910030071df8aec39e8b8f81c2b8ec844a45dcb4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f9e88b8349b8b655f02cab108821103

SHA1
df3c30250d9c8ff2104da464e3b452a52896eb83

SHA256
b2cffe6915a47e628c219cf4765a9adfe1d1e78e1eed31c03f14c828a9f3ddc9

SHA512
38fdf358c9adea782aff1fb6374ed4e1d709b3c86267242d37a525ab9e53c339a4c36f5fd26956e577c7a8ac4226fc5b269206b71364630c46d280a2608833c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fee54802f6bbab48d4e6388f54cd54d

SHA1
19d3090c4b777311227deb73aea5bb7e04ea232b

SHA256
91c067d2abed4e95b99480e4ed4cf3e175b6b57f504571df60cd4ba7bb0fab9e

SHA512
51a3cbd3049e645c4decd2df69e59ad17f61619c146b9ded523efebf1c39b96757b1317582fbc4f9dbaf11deb3fefd55f00be071d79275f5bb02a362c2e6ec24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae732565ddc5ee533347f76c039324fd

SHA1
6d467e6ca316b5e2c45f8c01f3044915ce00922d

SHA256
a92fde5f8e274f1b2dce1256c2450f6396b039c56ee1b7b4f4e049c16b31f6da

SHA512
505f3d511b4b11b8b9d19c3348258db9ba6fabe3bfceb10e487bdd7820a6cb59e71655ae2d18f5d9403a1cbd24de6ff8d7e0a301501444abc3ed48f521da800a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed5d1fb93e37209ee01823357ecc2a48

SHA1
3e14389a2577ef27aa2ce87f98fd776df6c4ebdf

SHA256
0fbb0773214c18bfcff9dbc5a70b9610199c9a12049b238e58baa77ba9074a8d

SHA512
5fd2c59333d01072edd20fc6b85b507a83c15300baef91b8aba4582ec6e3c88421c5eeea34ad9f1b0b4107ea06774a37863cce93fae3fa0f6c593104aa25b15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09de32d0110197f31265b52cee977fdd

SHA1
2732b56563ff41e245ceec8815c5fe6ac7745ecd

SHA256
753646c791771e280e0c711016a49508351f0731aa780329c112cdd36663c863

SHA512
2972ca3baad5cc615dd3f7ef515897b706873b8df073d5870d3b97968541353941fb78fa8d77d24a9ad5787907fe71c888d25482b45e22e68fa8290a36cb7c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35af4e707600834da285023cf99dd514

SHA1
83e1b78355dae89dfc44164ab39a7a0ca54f0e51

SHA256
fc4b7434f3e0b8654ab75add01fa7ad070169d2b4bf7004028e09779a79ecac4

SHA512
4f10afca09dba9c9662238eed8380ece6c1450e2a17b95ed35d02fbf0e4d73308694f30fa55e2d864a169b74fe89b8d6a6774bdb3c952a47763211b759d777ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01815c5cc09a556f266e5a631a82074e

SHA1
6726468ddd4f573277ea5d8fb4a0e4390864716e

SHA256
1f36a899970879a0c22b47c6289b24855ec2f8574949d115b9d2080c4eb9a05f

SHA512
9abaf44c9d1a082acc9b10619379a5fade3961bc99ed1119d66516a17f171ce38cb648a3b3b0ce904680914956156a4d16fdf22b2fcda9929407ba7147e04b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68A5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69D1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit