6a40b2e38148894b41356b97501cad0c327505cf9eeedbb810e2e784fcef2943

Analysis

max time kernel
154s
max time network
183s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

imageView.html
Size

12KB
MD5

51a583997fe25da709773c00bdc0dc78
SHA1

d17784ff5821986ef90eccb2fdb5182e1a248ad7
SHA256

d46e1855834dc14c7fdb8d961cad10a7e6041e06dd0fc093459da016e26c1db5
SHA512

ba29ac1c87f6795629c180082bbf53c20836b09890d335c5283225e3644ca9bc6415efbd446200c6739891224408d3635bb527dd3c649c2c1fe1773cd1bcc3dc
SSDEEP

192:0yJQ62zhU3uw7Bq8yh5gmkS2g/I4ET7uzdnUamuWvihCNwIMcTyRp3ohsLKbwUGA:l8ZzdXw4ET7WnWmLpUoI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07bc2c599f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000ffea7232346f131f645d1808ef5bc1487b77a2592e57d8cf3f9a7e5b87c69b76000000000e8000000002000020000000636d1877a1b922576b1048d99d4ae5c7d665d319adff8d1fced663f38fd175c820000000740b31c5dccda4eefc69127ac7bb43661347bfd62977f91f632d4989f8f78aca4000000053c974c991171f8b4a3910df998550b3e6c9850e0ee0e41e5abe4207da09786f8e31197a28f06690b2b12a3e37ef5b3edae11723a8d1f3f7edc7f696e274fa44	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000006b15fd35b699a41c2204fcbd9601cd1e246c20958010ff113445a3c4c3cece18000000000e8000000002000020000000a4765a26ed4520050d0d6682ef374fc140c1a1febbd408ead3b0b56e25815fa590000000537194e732b5545dd4e25c251d7663b5706bf204feb239113098414228b71c601d9473ce1b89149477aa8f985b0da7c1d751a5a1998bdda8c39451face3dd63530339d3615fd17204129b724de07f73fb3efdec51813c4041123bb4db5ff94227ac6d55d8c3a23c2ab85c011f3bc4651622483584284fab42dd6b2f5d9408336043233c638cbcca52147baeef59e001d400000003adf52827d689156cc87f6856e82a56bf0fb79d27d38a25a938fa522b36722edb74a67eeae5f346fedc46fe3d4724aff48d4b848cf0bdcd80a4849bdaef694f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEB88141-658C-11EE-8672-FA088ABC2EB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402898516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2760	2728	iexplore.exe	30
PID 2728 wrote to memory of 2760	2728	iexplore.exe	30
PID 2728 wrote to memory of 2760	2728	iexplore.exe	30
PID 2728 wrote to memory of 2760	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\imageView.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5a05d60ef99789f0f4d579ec8fe2c8

SHA1
8f1acf84de5af77532dcdc80b03d4d65e68d52b3

SHA256
5402901b40299711a542d939e2a9376ef745bb479b0e97b5372e381170dcb422

SHA512
abdc0072ad6b9f6abcc5189849da87c0c66a48dbc64966efe41e71f959329629885c29d31142d89126e8e7706ce29c94c1bd731ba77e3cd3abfb5b57e45279c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86e72c0be6a73fe56dccdd1ab72a640d

SHA1
9449fb3e60d92820c12da437b199716a244e89e9

SHA256
df48d0666753e3ddb2495339e9a9dfa9d9d5de1e56210379568f877ca585fbf8

SHA512
15c8cda9964db3a8b0955397561ba4af1498647c025bf0bb290fc78437d2f0d4493283f2001d210fa3fb0024fb41fb272cd7b8a17d483133c35a8563dd07cb64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518006fda2138fe864ea666935aa2a71

SHA1
32106612be59bf8914353247b982b244a7f2f08c

SHA256
a48a99e77011c38938759d4e18a378d312131d5c74fbb5abab06e4ba3add4baf

SHA512
03fdf5004c161533091da377daaa896c62098a8e70f2e30c13d18b304c560f91ed8520b711b74df35670d1f30a75f5abb05db8647a4ef03b8588e6005b0ba338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b36181010e7cc554b5163e2fc02266e

SHA1
3cef86e344b9d51b17aa331bea90d29282cc48ae

SHA256
17a9ad468fdf81f465b57651a39f8e58ff8700f94a816b7500c23af1e61620a5

SHA512
4626ad45766c44146e9fd91fe580a29f0271c968e5ee83d21afc0cf2266a4b8890c0334e7598936b2be581a9ca92b97ba4277e3966ea8d6b5355e9fe3f22a104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b5b5ed342f2fc3b81c192bc354a30d

SHA1
705221e06ce251333beb3bacb2161e2fc5d88f43

SHA256
9b7ae77c89b48e7b0353155da06b6d43e80239e1d57b4ddab4725ef06f3387d9

SHA512
8d4b7e6ce818b0eb6750b53bda8f34228fb2eacee4aa3ae5a4e9ef0b5a5a27e05170eb3c44aeb496318c47a843611ffe38c4e75136cff7f25433f76306c64c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2de86f27a4ceeb8f98dd9f478ecab44

SHA1
15a16bfc6ed08fc159770313924650b04917be32

SHA256
779042c7c3a51f6a89218795f277084567e6796f9d2d6cce5b15d5af8767506d

SHA512
ecb29da51bd0a0bdddba347ca6fe70bd11dbf1567f95b147bc0bc06733756c9385bc79c637a3889e8ca917dc86d2483d49e2fb164a6818a83906b22f68c3ad8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20b167b883dac37777cb21bfc21de4c0

SHA1
f392d4ca17fd2936a8e086dffadd76b3823bc801

SHA256
7d530cc2949b673e85fb5f13afe063301d7a119493d954adef3ecb999e7aea29

SHA512
e7380cad476f7cb2dddfce67feef70b006bd55d7b0030453c11c1d4c0b05db8fe260ced30b1e8e3140afe113bab85d488c56dabce8b5097a833b111efb5a6082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0620f24ab381c7d119beee63edb374b

SHA1
e6e9bce9a952daf1e8135ba30c24a39eb696dda5

SHA256
15641b31f84981fc10422cd0376daa318e84d85fa82b4a2dcd34c6abd3c6c723

SHA512
acc93ee085072322bd220c0d76705b8079ff8c5672969931583a5e086f8d1feaf5338eb2c388459ae3ecdf1f14afcca48a1a57150b4bee7bd96d4dc967ba1c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4750e238af9dddc744962b9bfef6111

SHA1
c8ac48c75ca553651b42b7527c6707f89b9b8d71

SHA256
8cfd0750da9d8e041c10c2b4ef677936e484aee8612bfb086b091ab6a9d375d7

SHA512
13c7c3c4916e7b72e44401c158ec5628a5498c0fbf5af917d15245965e1eeaaf5a5ca9c8d0853dcff4668a21fcf3733341ef215b4bd5ac7b56fe43547f4a4d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bce14c168e52666fca26afa82c35ea9

SHA1
832dccef0e02d333f361ff5440e439d65080629b

SHA256
bd663daa074fe6ac5b1c78b5f2a563b2c1b470693b8afb40905575841d108156

SHA512
fe3367fa793b68f42d4129270785076f34ded2ad3f337ac86cefd227396fa0ffd7a33e9b78ef161a7655ce6c3a2dbe2173699dc1b61e3318ae1ed62073076eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b8111455fdc33360ffd79a2979ea724

SHA1
7686e4131f4d40ac61f7932e592bb877e266e0fa

SHA256
93f5e020ad88141f2369863ab81d2421ab5d1276d5d708409fad55f0359b9081

SHA512
be96af5b9e664d67a80575fcc0373d694e786cfc068b89fe1328d00fece58078fae154be842527f6adac67a0c345e2e1a23a05fe5d7011329c27700705d1855c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ddebed0e7acecc1e4cb133d10514910

SHA1
56fb7af4f27b700d158d44ffd9b3acd3f7205a3c

SHA256
5a2a31708732085b3802b39cbbd0bf2599c52c5ba1819f5c6f7e5b61c14af1af

SHA512
c4f049dd34f02e6b33de2637344592cdad8248b4441597ab53664afd576f300e5b7f6fd0a36dc9031cb0fd5237de06798403fdac22b1cf05e538acdea68aecb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc6f2d229a3fd5403c1f7b20fe1f6bb

SHA1
e06d171dfa6617cc29c989984b9492b492f5f53f

SHA256
408892114b9cc56aa64ba3030d07fa2045795fbfd96ea18412ea7202147942cc

SHA512
6f34be63d9cbfaeb6da1ae7a8b40c1b6f5d78a139948ec88bf1e87cdb372eaf3e4e10e1eb33cc96a1bb28ab7c7396e77c3e5e00b280b0e267c7f4ae4054225e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a97db323496138767bf579ec1f36c220

SHA1
ba22c113b6102fc428c276fd7c7f4e60321ef348

SHA256
20579fe81bf0e16a57c06d546540cab6acabfe580383233e9d91c803fd0f0369

SHA512
e95f866d44754d8ed20d2f57273d5655d19c2344a9ec775dfd4407348add91d09600a84afaa37a442571f3dc826a3ec9934cf4bfb49d206d1f70f9fde789ea8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2671ec4c8cde660cad5a2455a881f7a3

SHA1
d4eff2f760dc9d9798bf6447fffff62322f90d61

SHA256
3b1b274dd4b0f1ba7d59a78808fc79f9284fc8936503ccce38261aad35948564

SHA512
190df615f0d3b4d825470055ce18cf88b78a56248e0abce7b60c62bd7d72c70147557201b189214103e054500f83efd2759d200b871fd3d5933879caaead100e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a716ad876396d0bbaf5cde742f698fc

SHA1
d7030a7ce7043a9ac9f9948d73b18d2e05cc87e1

SHA256
610648ba3a459e5b88b25d01b1ea2202e6878db0eedfdf7caa0e682b8cfa0eaf

SHA512
46f3e916768df11b521c6d912fba69fd5cf86189d921704cc9e47e7488b0351b44e67f920de3ead53a3b9195709b8ef97c1c6cfafabe0a23f66560c874a4abdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa55aeb473e2538127783c7ef8fbe684

SHA1
58a54ff54c1e937358f8b262c8ab01d27fdd82f5

SHA256
1aa852ed1fba62a935e1effb01e2edddb4b7475bb96f910dcdba12d5448c9147

SHA512
01e2c8bc3a911017b9ab07389277d11b0ca5b8a4051dd2ea6d4a4a5553fa97bda8d29bdea52a6bdefa1b54e342bc34738ca0ab603599cc06d9aea8fea5c930ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab198A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2294.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit