8cc8e6772ad7cbd5d2a9512a25dceb13cd053510feaf76e758a1e4e3db9958d0

Analysis

max time kernel
195s
max time network
252s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

car_question_wrong_answer.html
Size

22KB
MD5

0102d25a2b018390448d503f4cbd78b2
SHA1

64a0473cd04f30037ce6797f57e54501675734fe
SHA256

ed40e1ca3b5f68b415dcc3f6db081d8e55a40a2999113c55893d2fcf642d7c77
SHA512

f2f4ef24ad6762e3d1dc4bfdb075d5b9c796fc0b2c185b61e0bb9bb4a4721a91cf4d11378bf3dea908c365ea740e271cd5c9e8d70c050b7061f4bf2574df19fd
SSDEEP

192:GAGmx4994KU49O7c4yrttlbJ9O7c4yrtcH3bJ9O7c4yrtI994m994jq6eytBarBT:GzrhM9J+1S4gFK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C119641-6599-11EE-A478-F2498EDA0870} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bb6481a6f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402903963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000f252d74e833b8a9ab83d161f973f30e817f89914901d8ee3aa714b2ce46b12a1000000000e800000000200002000000032ebafe6f04593f4eab480f18610f5a400d98b3979058d0fac662e6e9658aa1b20000000bbd2995790c000274f3bc8dcd50e4137508a5d204370d9076d5202e3dc4dfaa94000000014edd7f6c3903a3a99d415912638e33be058c227fee7d1e69de608a6b6396e448eb3551240c20697648c4e80c828e0eee0317c8298e91ec740631efd38641b7b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000000ea26c8e5c4e7595a92581fbf14cba355e402e243c97ad51f1308186e73b30b1000000000e8000000002000020000000d50ba6ae79ad2a66aaecb3602979066ee6cef78c64e7c1e3e1dc9a91be728b419000000041b474760103149f4f46b53e82e930b68655fd9dcc1bc0ab56eb7ac99dd2350e22d5e96be9337ef97a6cf456917a1594e3b6adc9bf8bb9e0b6ada9954e3afb4028df467c9317e0f80f0e4f83e28f4a4971b6117e6e0a2533f74ab89feeea9551e0af41cb413bf7508ba548c70827d6698e039e0e0ecaca66f8e87438477e248d45739b8a94229fafc6ba15da55ce50be400000005b5f7143a41ec9243843294db7f15a463b696fd554be8dcc844f5cc0cd4044be5a8cae0d636b6161b940cadfd1358b53dffa3d171ec10d1f7c050578b788f78b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1780	2612	iexplore.exe	29
PID 2612 wrote to memory of 1780	2612	iexplore.exe	29
PID 2612 wrote to memory of 1780	2612	iexplore.exe	29
PID 2612 wrote to memory of 1780	2612	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\car_question_wrong_answer.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c04bd10f057a47a56e16f2b18b0b8b76

SHA1
9f6d19ea9038d49b0ecc6cca4a3dd6d8dc1a2627

SHA256
6c2777e4ea934f6f61c5d5b38427dace2a18f8671e48f7b006baa9106b748075

SHA512
0dede580d9837f744d7a5e0ea43540c148d8d5b9c7d5052717e5143c275fd1548592682611226b009b58e3021dc1ae942f2aa688e0aea480756efb516c2b2e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c5681b4be3b552b28c1b6eb6e8616f

SHA1
0426929ae35f3ac45d6c0061dc4b42f32885a435

SHA256
cecdaf7264a2b3c167f92b49e41dca1b376bda1ea7f6e4266283f201766e1c5a

SHA512
f9c012b347d3534574ce6173363499312c3815c20ac377a41e07864421c232720c20536b91d1a20b2d4d39c0fd43bb1e68c000dc4aa0d03c4f7838070659cc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebac837cb1a5530873aa40e9548b07e5

SHA1
5365ca31ba86d4d392111a40c839ab6a0b417918

SHA256
40cc30a20f5b8023520c13f9a7608ddf628fc8ca753cd265c661404490d15c2e

SHA512
7514dbd16b70660bbf643c2f1f05a52bc239641def6b868b8e76f1690394f9b894670e2fbf79088d2c037e8c8c2c95152ea43e7a14849aa0e53393c3eece23af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c84f4992dd3dcd20db62da29ae9d94f8

SHA1
e17faf9805f2ec057b0b815afa623ee9f5223f2d

SHA256
20d1832e3e95eae7b1c47f85ec49539b7239b77e4c3a68d70f1191e57fe2f0ad

SHA512
70f2784c3ee72537acc8017d198d2ecf4e5e195acb6162ede7e1d9726d115d9cf2d843a63721f1ae6cf702874b59a289cedc96254c1fa6ce9b0ab4ab4b221ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b31bad04423337c453ebf4eadec204e

SHA1
acfcee319268571d47ac30242cecf62f9a04e4e9

SHA256
94120b9a4214bb7da19a680735cc9f1f5c1ed4eebdc8eee036f593a92ccac114

SHA512
9cd5a96922888a00d7572ea453232f30174456bd8ab72fb80a1ce5bf9452a78057c9a98955f0098ea4429d7a614bbdadb758ab8a0000015a79bfb3f306233829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab9e9c3491f9d3e3d3e7622c4b33607

SHA1
2b461937cec3f72afa307f5cd659c60d199a26bb

SHA256
d1e0a6eeb0c8af5ebfce798de99340c963879d4b88c3e95fa2123c3a5ad361bc

SHA512
b8dfeb91276a2f6b01fac9cfad08eea47a2e8f3ede74088b13df8fdb9fec1a5845ee5c5f9a9da037e0ce003e9f4860a768c19309bf93140dace68bfe4f346755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f61781c5a15c0382489b21529b593c

SHA1
6eb2a9e62f928193e39c31ddb2c90cf6a2d87e89

SHA256
b952b3c0954b78474c24d441b97c4953fc84e09ac5c3ad3d681da2795cd57f75

SHA512
baa7b90de96f0b721f89e8a54014ebcd64fbc12bc2ada1bde648a9d9de382f0e657f1505d3cbfcb40c3d903af1bc7bd08aca0f9d0b892573b170c96058b91eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a1e2c6495ca43f814a1cda36a33527

SHA1
48e5efa13db9cdc36956ab89360a1de2ab6eb746

SHA256
18a26e77eafd41fff5bc8741a39225e4cb96231b4de6114751c8a2669e297e85

SHA512
ec2668c442574ce1ea89c168c288b4906143da48bbb4fbe2d704d66f74ba8959895664fb191a75ba7627488d57947b673119fabeaf8017f182916f60babd126a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69942059a49b71a90360be32b71c6585

SHA1
c8aa1b1dab61dbb362ce9d9840b4241431dda0a9

SHA256
aa34670520a72563d23ddae320b12d4e1ee28bdd45f3b9ceaf8393bff1590b3e

SHA512
aa0b7c08349b9f3f29f3ffb9a3285d0c7938ed317874c27a79a86c7c8e7f5cea84cc6f1dd21d2f6d66872a4aa16095c872b839111c08ecaad948bc1f44290817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
394575a9e2b3dc3dea7aee6339eb5ed9

SHA1
712b4f2a249f6e517ff510f43711200b23f3bc23

SHA256
a9f6fba312485abf334e0d4dd6b8cfd5f961bee14a4ab04528e9189cc227af21

SHA512
e38256e86c7798f6aa3bb4da345ad9058ad848259e949bab5c3710edec6cf5ed6e55a7cc2a205df4fb02676ec839ce06fc897cf10ff1132cd86d257bf7a2334e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
554e2d5be7e6bffcc8fd6edee25e9e83

SHA1
bca8fb592e940bb5c3206087ff5d2c43f7f7b12e

SHA256
55ff38c6f63e398957b4debcebc8a5d517302011fec9bc0bbe4fffdc970d3b19

SHA512
59ce6e7f20fa1f554d6062dcc5d368b15d5feb9b68e08d32d75a035724e9f8f0a1d50680451b8aacdb82efb16df5d5875daae84fe0dd1f739fee310f8f0f45ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c3b997a9da498792a4f8f775af6325

SHA1
26255f07c76f0050bb4064b580496ff5963a7adc

SHA256
cc694dc0a8415229059855dee30c25e632ea8c4d9009a615a81c19c9db611702

SHA512
e65d57c19e5336af9bd3ec4aaab3661e64d023a59143ceb35ac8a9a75b5f0757e8d8f92f4ec359f0a6a6794d103e6cb78d6ed3e9d9e695464135141ff6076561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a452ee349882193d502a841d8202da7

SHA1
0becae858ddb44243d24b8f30431cb61b8faaec4

SHA256
1c1795cea71e4903d98aea598d002411bfcde5367379db828f37848909bab90c

SHA512
da1084ee62568a6940d3770e3e01b03343d4f50251162372a9b87fe78c34148263a71ed4621761feb5e3610d64649fc7ad2d38fc2f47d82168b4b4c07dfab4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9529e9f15e1025a9e4d6d2083ead6601

SHA1
a01d700d290a4bf785d3cea0b6782a50433b01e3

SHA256
7d8f46901f9c5cdd16c9aa921636b134add5b3d94a6ecc7a7092682f681840d1

SHA512
a87a4f6b2d47e12fad75723cf9c4326882c30772f74e5cb9775df57c42d04ea3f856aa914024d726fff1e8f8f18ad7d6a545567a24c4a1fadf8a1f0341b7ced0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19558ef04c53bc421d1fcd0cde0034ef

SHA1
58313041099a5c4d7a78cf4c6c726000cd70ad2e

SHA256
753d05cd2b079be26d64884702d5ef301b6f40172c062fe097a1d154be7ffa8a

SHA512
fdd3913841d21cb4cdac58aee8b275fa9c62e933c47112c96af8dafc38887e9e368d2f5f9f039ed8bf89f41ed3ae12b7d16713721d7eb17748270f77aed54c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
396056df1c0ad2249733ee5884aba858

SHA1
ecd37b3d6e209a04d94380bdc83478847f474c3f

SHA256
d249935e828a9286a852059e1d1c453f239f03aaa5f7064455ccf3f824be9747

SHA512
96fb47d739619405de5615f776479105b6ca03b3c72638c5ee180ed926ec36679c94f72e9790fd1dcc3768b091c0861ea901f5926aa22ba641e39b9ae6533b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77095a91f712c4148eacff0424360f1a

SHA1
b034c061adaab9c59b337e3abad8e29d5c8dab13

SHA256
bcbdf79def16205489a1aa7c49a4d956eac867b87ed93e7159ef2ef31395e984

SHA512
526a22be66feadf2faf3f8127120a775c5eacd6ead8d339b8f9694c5cce01ac255a11af119ce981b4ab435e60d4862a4cddded041bb3098206f97cd76928d5dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE320.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3B1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit