6a40b2e38148894b41356b97501cad0c327505cf9eeedbb810e2e784fcef2943

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload.html
Size

5KB
MD5

5b41bd8650ae820dc28099c6d2d77bd6
SHA1

e1552760785e9084c3cc7ee22d4cd0883c6f5eb5
SHA256

689985916bd793e7ee531a9abfc31d71960305809b09f3f4c0611eb6928d8eee
SHA512

aec31d8758ec756dd4f85466c7b11d6c9e48b3d8516d67e13fbb67e4fcca9abe1a65a101856dd34117473a6253a7f8a3b42583f9bc499533f337295f24654b51
SSDEEP

48:WlIZZNl9mN0pPr31BQ/pO+GU39f2lg6kUpEn2dwTkq1W4sCHa7Ve9E3666vHTTNM:WG5MNNRO+GUUlgOeeqc4scge9rM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402898474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b2b1b399f9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000015b118a7cd1e0878810aad3b6b624a9a217eb21629470ad64c6e31d2d0782fbf000000000e8000000002000020000000953be22c3ae1def8d86e46bbb2dde698ae5d4b3d0fca2d168b7e19822d48e5f2900000005dc893e0585b3628b7b9875c74bc8c7a9587f002c6e07afb698df24e22d88abe894a178ec63770e2b794e075b7a99301d70c922e138fb53cd2a870e42b0d8543f22223f22a9fb62758ad0052f9497e87eefd053a56e1b6002bb421e4b9aef34c848f643bde4fd19e387c43572faeb1ae25a6d59826e92a4e87412a24b4c59b2aefbe22a76080db73ace3435a0b0749104000000013ec595cae94945347090d40281c0e04e886344610c5d68615b6b4f1952b115e3609b9d6f1109fd70e5a66b622035ed880e5b76a8fb98ee4e24ad0e7c95e5b42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5C5FFF1-658C-11EE-B77D-5A71798CFAF9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000078dc088013e90c0ea1b6c8492210308a5ed6624881f719a0832babc93e3dff0e000000000e8000000002000020000000c4c500ef3004cddf1f1fd86c5807ea062d9b93a5134c8269555bba89a2afd8d720000000081f677f51bb0121ac1de84a2e6dd1ccb07033c8c57db64645e0007d6bd19f48400000003d37c2ca2cf0987984896d794b8948553f1d06b133506371913ea9141012f637840794d287e4c87f75a8f0352dbe4099a4c2c1f99b44f2ae9723bd22447121c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2708	2068	iexplore.exe	28
PID 2068 wrote to memory of 2708	2068	iexplore.exe	28
PID 2068 wrote to memory of 2708	2068	iexplore.exe	28
PID 2068 wrote to memory of 2708	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\upload.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cbd9435dd35bd88265c4320207ce9aa

SHA1
478a221cdb8869e5f1843a12c8e76e5ba0d4ddeb

SHA256
cb8d2c44ef3db849d1c107ccf469bb6287ac032f6460f6b5b7b307c9e43bd8ff

SHA512
e735cf1efa939f35582c4e458257d486a3b89b9aeaf2453eb5fcedc2fe819aea5ce8800cecee85173525da66abae2c31dcc4fd6063303d718a41266e8c236274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b6a28d6dc2d26a75d29530308b8f060

SHA1
c5b16bd449541e9625c0b43208e76575a9b79e81

SHA256
0eb9cada373c85eac08b2f328568c92295f90364d495b98d1744e539cd0c29f3

SHA512
bfd619dd1a72b25b5fca33c35c36c3ee7703c4f12b64b378ce168decfbdfdea06fad4a35a819532cc4f89399e1c8ab9d56861ebf4d62f047ce6b1144aac97cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb9bfee6e234dcfce1347c8e60c1faf1

SHA1
eaaade912bfbaa5d2d3d023a9887bcd131a829fb

SHA256
b59f555fce3761dcf33c7326e6acb2fbad06f0bfbc1213900fa83ce1d2d654ae

SHA512
23943a0463cca72c58a440dffa334ba692a2a93d6d5236af6c410062d28ad186d799b4dc19fc6c28991548b942441030e9ac53475c5b1a5e5beb941566feb3d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495d4608b254f142440a7af6dc34a0d8

SHA1
1edb70ff6b070c8657080ad358dc30de2e611a99

SHA256
d5ed249433dac0fc7137fbcf73450bd23be0d7f0368cc7b1785583413e65044b

SHA512
3d0617c9ce8ca9866a4848e44c64729738ab3ca1b233436123b476970275665b4afd00d8b61df890baeaeef253cb23d0cd0acd5f2729d23182fc74417d8dfbd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b8d7b905d48095187f2aac18c40666

SHA1
9d4f0d75083bd82a4594afcfb0880bb8e1ee17da

SHA256
a6e718f136b31506bffed4a3e4d3c33c8e9144a289f5cc72c0d5c2c439379240

SHA512
9b94febdffed1325cdecc7af42bee89a3576c16f72dede5d37bdd880648367f0265568c5c5b8e7b9d32e210685ce61eb97f2fa062ebe52a249ebbe65f4abf798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f205bf6bc79e9a7b853f256dcd59e937

SHA1
9423dcf3152383f2b9a65dd1f3f21c30ad4d5fb3

SHA256
7e5402955acbd9ed6943a5c073b23b004ecf098250552b8b04de4ff35abbf078

SHA512
5c77d1f7a3cfc31510bea69245b9162a405d62a22d2646da061b566a6745c54f8239ada0e653e00c2e7928b83c23145c0cc47c80b63071008b01c382f65b32a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f19d9223ae26c32bc233e7ac453f927

SHA1
d773c3bf4f525cf5f6a8ad7f7353fab8c66b16db

SHA256
ce5a82a50b593dcf099b7d6a31746c9fe908af1ee0b7c0fd891f5ab7a3e419fb

SHA512
69cdb2d568c3c7fcfa8ccf35dd926d49771f6b7af894ec000725e0be59f61793439c80bea8aad64cae78338b1903dd14d1e6b69f86551a8a2950ea9b28c8584d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d37af2c42db35512014a43e0c56962f9

SHA1
3fc0720a71deec38d7ad8e3691c0cebb52f7be4c

SHA256
3cec27d4061dca8642d1ba1004b1ecbec40ce3f6a9fbe9cc05af3ad3bee34a41

SHA512
0406cdaae5f74e83db7374c26eb003d0fb588ccf9550867a458927540cef924df0d3e6532a37cb0d8a5a6f092d6a0252c746d8d52d20c4a9bf442e50ef45b355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f28c5a6ac10779cb8c5478a9821a4e

SHA1
e55dd272c70af7eb670f31989322ce41fde1914e

SHA256
4ef1c15534feb476244d56196869f17eeb254847e23018018dc675f6f89598ca

SHA512
374db2c3e754cf108b01fad8d2650c517c962df269fdc6f382e7092aef79d9e0b344d4c4dd4efb0f00df32fb72d92a5fdc4d7de92371e243231c815d6c890ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba580b8cab498fa63d292831c1c8139

SHA1
1aadee745184debf87326bae5418c5014970b1ad

SHA256
f74049349205fb1cdfe9fb3b0dee7d221ae53e3d82a97ab9f913f1665dad2fd0

SHA512
dc8a2a89e3b70288304df3ee9e5418a4011ca85e2a0c26ddadcd87c1f38f0c8a521c6e8ae7f7853958caca8ba9eedd80433d6795447a140b10d71cba1afff7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9F3.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED23.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit