bad1cfd200f08fa76278dd11e6e7b28004402f58312f1771fbc124c257819285

Resubmissions

06-12-2023 18:03

231206-wne9cabd79 10

08-10-2023 00:01

231008-abc3kaba84 10

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www/home.html
Size

21KB
MD5

a13f0645233f0a96aeb364e3155b8a79
SHA1

8522ca6698b38cf11b90748f5400ce6f2adade4d
SHA256

3990f48c04fcf0fb202ec12dc0e168c02913f59a809c2d6d1d415cad8cce7f4c
SHA512

492fed484ffb15f3c31fc8118eaff1461ab70bed35c37e27d6880a47c9cb232abe6e590dc586a0c21636749ac9345dff7ce68dcedd3523047cb3a8ce791cb3ed
SSDEEP

384:HJYCqZs64NrboakPY4Cg2Iu9V440B76c/Y+mUNy:HJYk6CjkA4KIu440BRy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000009b928e7fb437baea82bef06ac7d80fdb97e84c672fc1152068d266ff9c64c3bc000000000e800000000200002000000033524ec519f6b7588b38520ca2c948f66fff19b4606d52463ab09bc04bcb327d900000001c45070593ad0f39ccaa243b5218a2699814b046c96da8cff0069c90a4b91a2bc1cb4f3202ce36fd72affa22a9cd505a2d5d0c951b0513e341ab24eb9090a392e024a2acb2c85a0ad88ca153e9f6470dc3b9dac4236475da8705f6474cc1efba264e1bb936e53d7cf9d28ac29112c31106f48fe569c0ba39444f5865564cf66c89b39c96dcf201b663e52a599b182252400000002745a2541c9b746e3fa87d15e16c44bbc3983305a8013a3b9737b6e264db83eddee70b251ca3ee0f0c6bf0ffd99d775b006e6cd9b9f4e7916ff28b2417b93588	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402900774"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000118fd3f0f0bdb2f5e539b904fe125526104fe729641e6ce49a3879ae87de6766000000000e800000000200002000000088476772c09b08336e3d821831fd6b901c1eea9a583a2ae6444448cb74ded52d20000000db60361b8f6e60c5a85259d80dcc4931accc38271de35987e8fc22ee17ba54244000000001bc302667b0bef1103dadebc6e429f6833e4a6e146f17c9fd5ee9e0a4cbc99eae9e3abc4e89ff77525ee490cc22ac102c8c81eb964abf6a852617175f55c724	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F8E65E1-6592-11EE-8E73-FA088ABC2EB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e39d059ff9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2152 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2152 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2152 iexplore.exe
2152 iexplore.exe
744 IEXPLORE.EXE
744 IEXPLORE.EXE
744 IEXPLORE.EXE
744 IEXPLORE.EXE

pid	process
2152	iexplore.exe

pid	process
2152	iexplore.exe

pid	process
2152	iexplore.exe
2152	iexplore.exe
744	IEXPLORE.EXE
744	IEXPLORE.EXE
744	IEXPLORE.EXE
744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2152 wrote to memory of 744	2152	iexplore.exe	IEXPLORE.EXE
PID 2152 wrote to memory of 744	2152	iexplore.exe	IEXPLORE.EXE
PID 2152 wrote to memory of 744	2152	iexplore.exe	IEXPLORE.EXE
PID 2152 wrote to memory of 744	2152	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\www\home.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a0a33b05741eda5396d7c4bb19243ec3

SHA1
1404a9082d4370887b9b2f1412f2afb91594a345

SHA256
1cfcce8f9f8451e872fe51bfa33e483b25dba665f8a7dfbe12f6aab5959c867e

SHA512
e4baff8f320ae4088bc0d663ee32b2589c4cebbfa3493e67188148ac9eb269c7d47433cf2151777553025f1fbc2264c44aa8626b0212b1208fd240b003fab656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
50ef205dc4a380f8352a36ed284eb9f0

SHA1
c2f79fe07f45530005d3fc93246cdb5ae9c97b5c

SHA256
5dc6c3f15f5fbc85aae4c64eaf4e3ac4d1c263031ffa13e814473d3658aa7344

SHA512
c43733fd01ce1a8b775bf164b9f0bc8a96f06c9a45e641746fbf4af18038671a8fb720ba1c035931cc557d1a09d19101a0fec7a9a9630eb64ef706e24d1f05e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1626f542487dac62f70d48e3c65852ae

SHA1
2ae7baa5671e9efc597c413c7f16c3ccb670cd65

SHA256
ba1f01924b4d1d43bc7963ffd3301c5fab8cd0ddc07be46131690a14c7e11b8e

SHA512
ab43c93a7e7fb7c4c7dba79559afd829269a94539f4b3b027cc12927d7fbe571cff2894cea344391a1574ae3df0b549ec2ebc1be4f26f7e30d2a099c0865aa65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a7f6bc59d2e7530ca53bb28aa1a6bc18

SHA1
dc2e68b65305a3499646fe692451b84e0e85fba9

SHA256
d90c844cb8a0e28f6d8697153d1c6773628abf0b0fe0fd5f7f68e4515d7ce3fd

SHA512
1c2347637da95220e990dc5a493568437038bb65fb0b8d7f2c49048fbe258eac3eff06e7a18f798f387905d42472285b9fd886c0dd0ff17eaf0476313fc55ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
930acdc7bab525435d8787aadc407640

SHA1
a36c8b402abb2261ec7fe4ef1b0102182e2b1113

SHA256
3184bc2e4c866692aece37d11567e24b24bfb099b600d0e47dd6d72968163e17

SHA512
cbcc743f4c17f98ce80a8ab3ca959c33995c7c88467d8cff708d338e382ffba618b6a39f79d331c1718186ad1fd54aeb9b4d4132c108d1147429c15ff6fc0691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
26ce326572b8ccb9cb32ceb6833f9a8b

SHA1
74f6556d9db07e586a5d507de6dda4bf754bb404

SHA256
4054c48220793a57c8eb3b54c38c189c2aeff7a5acbe191a0bb4d5e4e6751b90

SHA512
6f08cd8f4017528299ad8f865cd5801244ac3c50373c374919e602a8702d078aa2a85b91ca07b26c6cffd05d5f9aff24a847ed1c760abaee3ad91e8c28d38e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
28da818ccad84611b6d04b9294ac3901

SHA1
20fea5fee4dd79e4ca01c57e0ce5febc74d015be

SHA256
d93def35e202bec143f25995c5a6a807b43e35833e6b1805ea5a6bc5536e2d9a

SHA512
c81b912f1796f2394856b0c736d033eee82288b84a8706f675f46226e7b3cde270b1e67206e2d66c5d5e2d37e6963f65d81d1c90bcba1dc9c1b53e40c32f2380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c99727c15cca238e918a9ec1b8cee770

SHA1
1a10976e20d4750f0e8556034dc13968d55b04cf

SHA256
a4e33746e5e237b26e856eab14a4e4b2999f5914cc4279a7a1e87e6b58946e10

SHA512
fe1e7dd252be992504f6bd67d99de5a6467adacc12c7790ed83edbf4e92ac37d4e157735811ea073ac79f1e63e88fcedc8523e940a2c4ca13acd8926182b17a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5528fee1372a23e405c33c361e490565

SHA1
208dfdf809e9232f26714d14baca9c952bd98447

SHA256
8c44917bb3aef1fa5e8be3e4d460c58bc15378afd4c620377a5656a299f25e4d

SHA512
09e76d3f4d8d0f05b998e3fac75af1cf48174544762b10df2783684184b8527102a29afbc29884cb727c35e2a0e6c727239089772833dadeff71b0a5d1e18bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D1.tmp
Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD8E.tmp
Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit