507bbe7c4fedb13cb1960a050928fe381db7827e5d09527d8a28dc28b4d351ca

Analysis

max time kernel
178s
max time network
219s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

news.html
Size

418B
MD5

c5e38dcd3aa07698cef374e83259c7a5
SHA1

f10ba93569f649e1208f17c79d7435772ca68fbf
SHA256

497c5dc5fa8339ba1a982eebc61c1b92c562c7d841763e4c0f11f0dac2f94800
SHA512

4fb0012f5cd6843236d3021ad8fe2ee635ec9a0e8933b2ad2ada09db3db0304ba7ed666d4d453dc397a300b69bbc972a827c9d14bb3c4a03d4487133c53ea8be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01765f5aaf9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000000a8d491cf762f9ea10aa8797ffac9ee9ae9bac8b591325df763d14fc25a152e000000000e8000000002000020000000257bd805acce93e1ec01f0f6c57a9ce0d6394eb21c12c152322766d45a5b4bb990000000920b48a117f95fc8e09b2fd0706240f9c9737862c270bbdce9e4e68da1fe0c3c4432041e7986e76fa10a5a87e2f2428c9ddf7c46253b00885cfea09fb475fb0d45a34b11dd4ea2d88b1c4985d0e0346e62c03a845fb6f545ef50d9f9ba9e3d6e00176009723b7757e37f4db441bca00050e9421451533843a841e1db5ab510f7e76a6aaa193be53c28bc6ba48ec0cd2e40000000be808226324648a2d83a9b1d415d7c15932d61cdb6a3bb6967963a105a96ca9e63eb38448360c1191d56216c8286070d6397b4e89b1aedfdd12cb98030a60054	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000069fe6da0dceb4dc0bc1088efd1efcb61b13c4b34841d3585b84c147cf8aee56d000000000e80000000020000200000005077f30ee512286afc4eb9ff4365b9b9a05064b0268da062e3173a6c1180130820000000b4caa69dbe49c61f984bedca20f707aaa7706a81aa3b1eec1defc1fc2e2ee4d7400000003bc7cb2a10cb2565f8bb1cfd52715a9ab852ad6c2b37cb87e7f0ab6bb035be03547bad8966d6fd17c9adf1d3f246360e08088571bc1c6612fe5f77b3295ee19b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402905876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{109914D1-659E-11EE-B489-56C242017446} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	iexplore.exe
2552	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2800	2552	iexplore.exe	30
PID 2552 wrote to memory of 2800	2552	iexplore.exe	30
PID 2552 wrote to memory of 2800	2552	iexplore.exe	30
PID 2552 wrote to memory of 2800	2552	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\news.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec27446435f5ec297709c327e29abed4

SHA1
8fc3bf64f78eac82246f51ca581981cbed18e9bf

SHA256
37b7acd1e64a1bafa1190d62d1a054cbb219389f03ef1a17562563f2dc5ad511

SHA512
369bc38fae2635774b37a94bdadeb2d78529274f4dc6989b52e87cf7b1eed32deed2106e401eaee695f9d44822406a5261928b4abfb21b2096f2acd48a1e6d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e49b0e2bd45f5d61944ea7afb341534

SHA1
5d6c832f2bf4353a7797e903a0baafe4c925c0fb

SHA256
77ef196712b190d2771c0282dd09348c8c6ee755ccf9a1d68ba90121952c2b5a

SHA512
357ebcf23ea9213e685c797eda4125154d8d7266bbacea2e8b6d15fbda8f05afc2a103951fd7c099056fec57e39336d3672ade942ec3e84de60c665662592fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
875f8390b7a00539508b926d79f30e9f

SHA1
193cb8e473317657a20e97131ec9f9ec19ec0516

SHA256
f00d4ba6ea9cb3d86070e842b967badd2525e7e64c9d1f1f64090ec62628b42a

SHA512
0090cc9789521a700ff4947bbffab4b855731257afc2f8e1b3ba74131969d2d3e4b4e7f238efc45a86d611def73817914372607cd262927f3edf40163736963e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa07bdf7571bee0b5a1a740d63011c11

SHA1
e7e92ebf555855850aa5520de985b3a193379610

SHA256
3fbd796a86d0bee44743ae95acbae26439373cda25403e95ab8d55756a7dafe0

SHA512
a3438284a6471218f2b51446f0aa5c07ac2e5a3dd52b83d22b73a21567c4f562131a03a0f2a7c4cb1247708889924dc2191dda2531c36ecdd44dadd9a6fb7ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e8d03a7c822c602d54b9bf18575e2a

SHA1
005c0e4f87cd762c84ecb41488187f3fde117227

SHA256
09b2e26c87dc36b96f15b2d722bd0cc7e8881bf66677fe9bb54a1e0c164b013f

SHA512
7f803973b23c4c3c729f222b767a70df61675cec6d67f856ec84dde9069b0d1a5580b3fd29749e15cba828618e8adaed7a18411204c91590f9ec597a81805666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98acd663f587ea5b669899e55c22adf7

SHA1
4768e2ad5546f6a53ccc273e5a6cc96d71849c8d

SHA256
a44649ed65bc4b69a0f267580417518f4a74a26429531469cda838fcfbd34660

SHA512
74cc9ba93bec72a59b2c94f1fe39ff8a37f0ef73ef51703a3ed336415d33686625a771fe36e48583693b913a4d123c96ea938b676aa386277ef4fdfdd7c98e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7025deb5eb3d46552d2306fde12dc383

SHA1
131fcb8e21bd870cf6d4f4798de1ad4f43bc4fba

SHA256
b25d7ba2c806ba5ecab7b81c4c7687e35438efa11d25c26ffb4d56652d0ec217

SHA512
9ef1960b319e14e21acd21ce85829c335c6dd8fced0eab1ba6f2e1cc265580d6a46c1e2a8376a07e164a54871996e1a7f6361435615fe929a32bf9198670fe91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ebdc8cad6432af33944840d7a314fea

SHA1
a25bd4396365247657d01b950dd074f3bbc360a9

SHA256
6dbdf808664df46183796c375d0f0c3f01ffc78412600ee96224c8a8aa612fb3

SHA512
123134ee71fe8af29371f69df0e38bda45d0237dc2a8fd56a27a50d7b7d544ec2b28dacde4f81364cd64e3c01050339486ee6bb0beab11def0cd60be0b3762d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f88620e837130a7325e84b68496ffd

SHA1
ecffd571a4ebf464760d39606f8468ed5b312478

SHA256
d73a5ecce873c75a11908d11b9438643b9480ee29d7487cd9c8d03c88c5a3544

SHA512
5e7723766fbf839443168af9cbd944f7cd65091e504d8bed92be04ae8318e2c7938bf081d379aef53f008c78027b20d5fc4373e63b42dca41d59c0078aa32f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c390cede1d24f3858858a9f8e9c95b

SHA1
27276e38b7e8ebca4e12f842bf19907cc94fe4db

SHA256
fd5abcc2384731553f8f4e8099da091baeaba691ae4e64cc355427a185cc8da9

SHA512
2cb3e75ea68f48b541feedf2f1c769ef629058b891957bafb2396bb4fc7fb2c596d6ce2926204a40a1b1de6d0cd794fc0b59bafeb732d8e7400c6669e00477b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0849987c8aaa892cc492eeae9a1cc349

SHA1
6afd2ce35a293ca2ddeea6ea8f68b580a2c271e0

SHA256
5bfb42064b7dfb34e8719979d590f0f11b1d6021b091265a8b7613980b7035f3

SHA512
970cd611d1151e6949c0dcd3013cc5f11cd27a773104147744df540d411468a3bc31d98b27334339907d0974fcc33279bd85829649592152f57269d0f0a2a55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92defdacd63d6269eb4242ff564a2906

SHA1
adde2910624ca1e1c8b945a9da1f8d19ea58f19f

SHA256
7527d51e370bc73b4a603112f7719045aece4e2cc789a339aefb2409436af6e8

SHA512
41c1cfe18e0cbb2a54a44f1b44207baa583d924e5d3b2def29e7d117cdd6479deb0288485af805e70c6e1d3551707d97d4e5082015a3f1a347ef3a1922472fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b46abde15f3b9785f078045b062096

SHA1
a60b72c654a771a94bda027ef2479fc227f4158e

SHA256
1cb4ee29dc8dc2a0a7ef149155d7f9171197cd15dc88ceee5468806eba61ff1d

SHA512
2d1f86c3cc1ddb3d990a6b89103322408bae838610ce7206a1d2b349d5dd5a144668619f893886f214434156f9b76de54366939e91c7d8d5e525e1de89ad465d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d114c7206991c0505cd64f4e080dc121

SHA1
a37add3925fe123765d59d0e0888c63342c5b806

SHA256
9cce1574590c466bc52234800ade41a54360dff12e9024cc0c4b4674be02f608

SHA512
3c5127034cdc202a9aa2cc42a86dac942ad5b038e365cb37aede08f7556700b6752f0ffd5151676c5387e072e1ee5dbe0e77af203726ef4ac08cfbbb11a9c93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae2e9e6dd2767050bef0dcb8d160ae1

SHA1
5203b99e2d264f12028896e4e8b6d7277c422f75

SHA256
8e28a88e165d40c98341e6665f18acac2faef0f8e92ccfdf41817dba8904b35f

SHA512
34d0871fb87419be9af5085765fef09c8a3713f911953a1392e01f7763eaaeceb2c7347eb166ec1f79ed57014c1dc1f3f3f07770cde16a54961a9f817b56209a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094eca4e89ed2f380ede18e684d06f88

SHA1
4cfc4717a09d383c982bd9a29723c3309c57f063

SHA256
80b3f5ac6d79f087f2c4a428928af16e1fceb333e92947b38881ccff5103721b

SHA512
ddad906b22dd34fc35a84ac831ca397269b61b19e0abd0ed4dbcfceb8543f24a70faac9d5ad375376fd628a8e53c40556bfb992fbdb41599c980b8e3aae9ff97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a65833e6439151d161afc45fcbd0044f

SHA1
240fe45329b801fafd327233944df0feef7563c2

SHA256
7d3e9f520b3e44f6e0df5a5b1968b602c2033c987843f20b7c50062177b1e64a

SHA512
43d873e0c7f678772f9933cb8cca6640e9e77635f94eb918eb1ba4b6e2ae8ee4dd291d0392c8c248a470cf423a5f66fd632c8691b4c1d708416c8c3d9abae74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab825B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DD4.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit