507bbe7c4fedb13cb1960a050928fe381db7827e5d09527d8a28dc28b4d351ca

Analysis

max time kernel
132s
max time network
190s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

privacy_policy_ext_keyword_defined.html
Size

6KB
MD5

2ea039dbafa97e47758e2ca92042c785
SHA1

0234db0e4e1f66dcaf4253fa3a04532bcc601da8
SHA256

e6e5be197e3c2bc1a1fb719f1eed4bc29b9f76d2a1ba9102bc6ef8051198863d
SHA512

ad8809291d734a532e29c42a19e3a61d7ebefa81d401ef64dbbb939a31a0ca7fb8d7518968d458d239da6b197b13da17bb444d7ade831449d6cf90e55fd7ff4d
SSDEEP

96:ybuJLyTJmfh5mUSwQVqA/jkvF3ACQ8+QINb/dpQThmOIFKPF2M0wInRyzYM:yyyNmffmvIjt+pQThmOIcPFwRVM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{277763F1-659E-11EE-80BE-462CFFDA645F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1023a0fcaaf9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000838d3b29bb184c308bb4938dab54868469e2dfa7504d3ea4ee9a4cd9c8f10338000000000e8000000002000020000000562e476c8b26ef8b5c7164e5a0b10f697354c3b5421465d9a2419262b434948a2000000018235286bc84a7909465db1c4c5cb943615f651cf8c094c27e0d96c87d3eb92d40000000dcd5919765589ffba9a8ac234f7bbe379a11462fb9cacdbaca1ec1f4b2dfc1214402858cc7e53d2265279109f0ffa117b2bde7a274b4274e43fd6c445132eede	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000c78e36d26b22a4fb8300532b1a9b5cf346fe60a561be8568721e9be37afc0276000000000e8000000002000020000000a05befea19701df04f22dff1ddf0a846fdf560e77d5cd74aba0c1223e691cd3890000000ba88fcd4cf56a75f0fd14dc279133090e3df955c78dd7cb11e7c0add035b4276ba1acd21ed38a8db2e8d9f29155b96de545d201a202b929fea47f77415dc81ce0317cf5390a98f1b766a7406e860d8bd7479b73f2bbf53bff7a4efd8af0629964bb01a0d76916cbf40956295a1e4d5a6c7ce31ffd63ae514d84605b1e42ef014c1279c81b9e8ac10df7a863e4961773240000000917a147c76cb3c002b6d397e3e0434fec78e5522ca2d1e6623594cfa55d833bf71b0b750794d3f40f60572414a38f7c22b9f6b222bdf554e4991f5c5bac2caae	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402905913"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2924	2180	iexplore.exe	30
PID 2180 wrote to memory of 2924	2180	iexplore.exe	30
PID 2180 wrote to memory of 2924	2180	iexplore.exe	30
PID 2180 wrote to memory of 2924	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\privacy_policy_ext_keyword_defined.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b004531a4f58d78d89ecf58de18007e4

SHA1
91c95d6034baa4eceb0c185c501e3271320a553e

SHA256
3054f861fd611a9001e993e3f8deaa662552ec712413527e824f3c5d1829f88d

SHA512
0f7dcade74ea817265baff13a8215c77b5d4c112e3a9ca405a472630e2b3a371f6a175cdd32d062dcb9c755d4763ba9c1227505cba75a5151b3a229cb4841bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89393656026d0b9025ee7c8130cb118

SHA1
6cb6c28d1c6a018af96334adcc99cb1189193043

SHA256
d88ac3f60bd327d0b85cec89e17f8f0c55cbd8a9f728d193889a7076f011094d

SHA512
fabf3c6c6feed1597c402c268e5c123c732aecc5204fb14f5bf2e89e1aba5aab4c9f141d6731d0c94a893883753ab10b03e573cbfd4ae216b73f20814d85fa24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2573b2bce3816e95286a086e126dc560

SHA1
9c0853535bb3445178a7fe20bd042bab5736ea7d

SHA256
bf6f5d1f60d9b68ca594c5f61f454fba7422d72384f3f073045906ceb4c244de

SHA512
9971566125367c29618f2130b029c90ea72dfd99d7be74e2c6204e033b2e47dbad970c5fea4f5bdebffca6d97f04e48f1c0a6fd08dd37790ccb957f6035eecde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d47e1e323744896bc5a8632dec928f3

SHA1
0a708284a01840a25b003e37aacf1bb0e496c561

SHA256
936fa920956cd7d33714874e57c3dd6d6eecfb502010bb5a09d93d11c35152fc

SHA512
8bec4ad7d3b3b123217b7bfdd9fb352a85e7062da59146ec6714c6e56decfc845ff295ab0af1feecadf096efdc49ad1dc101fbb298f7c5e31700dfc15a0442ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855eb65674e795fe1cbd591b0efbd2f3

SHA1
a820466225a5dcc3434d16d9ce55c67a3e63a150

SHA256
c1eb3d1b1f09456ea1bf082a5f28c6ed6e12488deeb3348e4763019f9c50bd59

SHA512
b782cc109ff368140f550abd00500eb147c159704043b96a8d5ca7650b3375e43510c2a62eeee534c898a253b136f204df784848d2b6bd223322c8ff10ab1e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b66b721f9b94f42620b56694f7e08936

SHA1
4dd02863532543e8d00fc08422f3836f08ab1873

SHA256
9662cf944e44279374ef96a3191e709267601c6040af7ba2f5b529f3a1e5dc05

SHA512
5cc7dabae655b846a97dbd5e4196a24415e356b494ceb6c0fae41bc3030184d0907192f36e069efc9ba60ca8b5cbce59cbcaeecd679e2dd3102a61c9e0e5a564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27a23a7c7af9e556eb9895b6d02b3f98

SHA1
7ae6e7860c020bc64d13416a453a738772a08d64

SHA256
57c9a295b06087b3171a34a62863abad3c449ae55d21395fbe8f28b84aa11c57

SHA512
549435ff26b47189f79ce5af63f5da90eb8754ac492d2a8e331460c34dd715375ec14ca7d50c8c753b3603e3f18e8631cad2743e7af772e1afd658bb9fe16368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb4d98e6f65f999301784653e423bdd9

SHA1
1d15297dc431f9e0b1a61fda2811b753985a9fcd

SHA256
5f043ef37de5fc15e455b76868c50ff8ac13dc4d10e1036591a5b4e4dc028464

SHA512
bc09ede6ebfaf38da642edda60490d82799cfa696290e4f370443904a63de1b5cdf7842661dd03b741bca676fd44f677a82d6d01c2dbe544f597a3694d9e6704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e94e302c5bb8b5f1ff2939b25737441

SHA1
76030d61207153e05043d92254bcb0ff6a0679d3

SHA256
a86bf46d78aaff0e7dfdb8d995e795a2e121481de8afefba4a7399ebea2000c4

SHA512
f9cf5fc0e5d35090fb05998670884ce72b2d25a064b7a8b4fff8676e491ef0d90546a275f54436a035b0fdf73878d50da15e1c3737374718a2e1cc7fad5203e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
492a234a9243a4a0fe17ddfba6f1a22c

SHA1
bffa7494aa075067f6be55d02026eb693971d002

SHA256
1b408c43f805de3344095d028544d5d89fd981ea581341c95b9ec58c758a9250

SHA512
22fc79046f214e9c38b50a9004c272ce3f2d626b30e3efc4c923bc39faa9a378ca2a462097cd18e706d27a5115c8749db03e75331ccfafdc4628e6465de6ab31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa4c8ae8a6e535caddce63f2155fcbd

SHA1
51e31579d4647b35d29894d1b929112a3a2c3c7e

SHA256
552dd50d94ab78d72e30b9772bc240de8bdbd5377a0f30acf37c49b65120c430

SHA512
67f83778f4e06b1872946bf110284c9c613dda273f8a10401e675626a8dd3bdc8651226a19dd89b77cf1ef542669e5b94de636e89ce99f009cdd4421b0c45da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a3d7434d944b3acbd8edba9ff67ffdc

SHA1
a5548063425083222ec8ca8d6a2a9f3a0db2d288

SHA256
b92ef1709ce315aa2af528364c32c1b04d2e7dd66ff898909d7c8947b8baae2d

SHA512
cf900116a67ff9fa8e763e747b2c7861a98eb8ee044cd2914a04e5325c7562c3fe0e2d4d6445f1b060627c869b3e456efcbdff20737eb825821bb258fa391cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4c87e498fe4970fd095f6069411f058

SHA1
ce9d6d040e405b0acbe8b52489b25e5a354fc1af

SHA256
00aeeed1ac9a2a268f635f5aca3b612ef4eb908d72b0fedf68268ccfd07931e1

SHA512
a32403e4951002391f58f9768e062181f85155994e574e61e077d62500dcb64674b7ed4f9add73ea4c538f921490c307d0610b2ae5c1876890c88676fcdd0188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9668e3e704a7db61f211e6702be24872

SHA1
2fb926a3833cc7eed3a10327f7e62330d36b8ba3

SHA256
71821739071bccc25ba9bf854b687d771758418aa247372534773dc7142e827b

SHA512
8bc8ca63914948f80bdb1482de61d6714284cde2edeff5f57cf228f86486c18f654835b47889623b41644d80688b22f1c289d3603956e32d7d92511af8c03553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00faec90d640d9973dd7bd28f640267d

SHA1
f4be444594d2c015f3ef64ab0ce5f52af22b33ec

SHA256
9eff01aba382ea115685d5e4304ab0d0874c7d78d151db2010c95f210c3ff656

SHA512
2e592a34d1bea4888a63e233a5b87e15b51f7b976aac00aa3ec5990f7da52df0184291b955b0627b5ab78219a0c7561ecba083105852a31c43ec77385d36ce93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1431ca2dbf8ac0cfe6b0fb3cc35100d3

SHA1
ebb4d7f3099d9c9cc31e19999c276c890e44b3e0

SHA256
9b0c4a254f2267f1b63fa204aed0e35b0fb76b804d309d556777ea9c3dd115e8

SHA512
381a11556e9eca096728a4bd635bdf5367a49339aadeeb898550c5224702ace42b961d79099c29a3b45a6d0ce936d4e74439718573cbe68371a2c5c9f1cb4205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aea67457ef3024d7055df742bebe05b

SHA1
92e406b303c670b75c68f268583b3235848aba27

SHA256
e0b9b2af9e60eea4e84d156d8bf191b56861eaea90043d7e375a9bc20ba17f2e

SHA512
fe74ab4acaa00a6e3257684462534e768418975dee3ef4413f3b30b819f951aff32e097f12da59b0b1754fbbd0a719538b288912cbc627a7df5c8c0c6a1013bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EE5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7EE6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit