aa10915e72cf995bcd4d3601d50c90f15b66393377042544ddfea349c6192f25

Analysis

max time kernel
348s
max time network
423s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_111_665e1985893f9e0701f79dfb1f99a4d7.html
Size

18KB
MD5

665e1985893f9e0701f79dfb1f99a4d7
SHA1

b695b2c8f15852dd204edaad62254447606fa4f3
SHA256

50ffa995427d576ac7a4c1d564788a6a552a8bcb4b7cf393c7d132a443f48cbf
SHA512

00a4fdb70d80d0881d1498139b177821c6be70e910d93eb5b32a9cdc57f9eed121656e975f8e86bbecf6039943e0c7ec2579e5d8e23f1553d92d0fe6ece3aa81
SSDEEP

384:BE8X4bQkY3TYUnZwSrLGOJZn86JaichcJ:BE8iQkM0UnmSr0iJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9077A60-6578-11EE-A914-5AE3C8A3AD14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef0000000002000000000010660000000100002000000047416febf9e46759bf293c6b06505e48d60c36df77f32dd43106d05e518720a4000000000e80000000020000200000009b61fc194d00e891bbd80dfd540b71b79923bed9bdb08ff98c0ef7c018ec122090000000d454204bfa7ad302cf4bf820268eba1826d4380ac282f30fc925ef583ca588d6011c8fa9e3f2b1a5f7077a523df4bb1946e41229b007899d912dda2f75c575741d97989a885d5be63c2c487d4f8d2e5222e5768bc3fe0926909a3e335fef56dac223e24b6302a6d3fdf03c01eaab442d526a5fea9be3b310b47a385cd01eacdaa80fd15a06a5f12139c19f011a71f8264000000050dd22ddc3e0500806917f0845f4233f82a2bcc6f55164a8636bba842ffe53f51a0c40668582453959055c9893b4e3e27d6faaca277d98c5aaebb2f5bcddd20a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402889836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000a5d09a13bbe406774a9f18ebd0221a3b8f701cf16454ae7bcdfa9014f7880971000000000e80000000020000200000002464dd304535050aaef91238b367045640349b375391b31a649c8262e430a3c120000000e639b5b25ddff8b6fb292fa8b88e9bd73ce7c04cd8da68bf1987d7f5bb6b64444000000085b88c1a4deff03c243cbd8ed428ce8cc71719b08fd548b24fde650dd1afcdc5a9c0e38d7b38756cd959c738606c690ceb8155b659a8142906e7d57ce41c0a7d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0aab79185f9d901	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3012	2636	iexplore.exe	27
PID 2636 wrote to memory of 3012	2636	iexplore.exe	27
PID 2636 wrote to memory of 3012	2636	iexplore.exe	27
PID 2636 wrote to memory of 3012	2636	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_111_665e1985893f9e0701f79dfb1f99a4d7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a263c62e6fdc41ca701a90ecf66c3824

SHA1
278e9529382fe88b7ae228d38aad695ca5766bc4

SHA256
c9a4f8b8b9031c6ceb4fb20e49920aa1cd2eb26dc0d8de4eaff49c3a74164d98

SHA512
c6dd1fc7bdb605a8326ce296e58069bc4fa69298b3e2b029e54948a66746e836b25ff4052b6eca0054bff274e22e3385547083e0b352f18a6bdc9e7d951c4bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47163ec8b94e2192e23115de7b8e095

SHA1
649539c711bea2f39cfb7afd654612316e7477f1

SHA256
350f3658245066fa2373ee1cfa1c8fa6dcb28c53b56ef45120aaf18a596a3e34

SHA512
6eb103bb1e7308d1ef036ad325f63e5f0176ee0422f7a2944e1b8215e3a709eca0c8e7d41e7a76d7311349ed7d1e25a6113c284470f6cf9b8b787c42b383bead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6789ecc03c26f78d96a2e067f608c916

SHA1
bff1dbb274be44e8a501ee7fefc2fbbdefa75d13

SHA256
9845f22834d4510ac1973a65fd6c06dded81ede3a80c3efa7074aea5bb272dc1

SHA512
72f367cbaef07e5caecd61e4634b6762ec8ef5b7292268e710912eff4920b5bc8044d229da1c2b425ad30f0508c7f8f841b1048bec99b5804107a2df3c271cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98443cc395ac49daa65c758d1d550151

SHA1
9c788746bb6bb918b93a8bf1aa3ef11340a0ce40

SHA256
ffb22b527bd2d9cc933c01a2032cde59f0ae57ec0dfec2b6ec7031a85529e24a

SHA512
d364c55171039c9ead3a6f58b27ae992f0ea85b0e9e45cd580b67eb9a34d7c8fa075c4bc8e2010dd0295bda873a77fa27efa1a692ec49987567439734cdb3ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee5963bc4dbd104155fc1fe74b21b66

SHA1
8a49cbb94fbc33b30c8bc5b26da20a13660e7be5

SHA256
88c5c07c11834519a418913c3dbd18028a92bd99b979d34bf5c4514b0b11e189

SHA512
9d7863387979b40bfb11e5f4b0cef829c0058d5fbb3dd335bb97a7b7470ccee25bb8a75609afdc20a856dbc596cefe16377811fadba22c12588aadf47a1252b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f70c96298e76b53694d0bda5511662

SHA1
5ff8cb49568b710518eec4a9622e2b8b50bbb8b3

SHA256
e783b246bb5d517de4b42fb439261b5406b563d53b56d32dfd7742ac19b240c1

SHA512
01778f4af66e1cedf0a3b6a8320c17ef97f0e6145b985d7658180304a898d1ba56eb898faf4605cf6891c3c8407ff576205329be91aa9944e5639f346c3665c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ac76f7b9c5805096f4e82435bc9991

SHA1
a3d6afc3cee138df452ba77eba441699cc2a93c9

SHA256
e19514260dcc5381708351aaec6171b9129b512468feca717ebfbe5fbfad523b

SHA512
ecfdfccf9f5b65aa06a63542991f48ef4d26742cfd096da99953d3f2ad518aa882521587d8155a984dd32a91d54dfe1154cdd8466fa245bf8aae945eb2f0d971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eac84285d1e508eb721a837547307e9

SHA1
31af1954ba740ae8e9189e5e1cfa344ad5c5c8c5

SHA256
ca372f201b9afc97ed4ba394bcefee546dc1f30c59c7baf0db09211b4d165ae5

SHA512
02bcef64a0597ef817b3f12e39b0c80a5eb28b91a3b883eadff2291b69de0d7807c7d30e75ad22156ffa429f2de93915f05e96fd7b3dc2214109d4cf0776d821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0962dcf589033ed15c45d67e64b67a

SHA1
99d124715c09ef1d1d359b3ef7ba3d1ff42d76d2

SHA256
b06377c9ff4370899f5b5ab6c76ddc7f379376bb9e9897cc36fa28cc6568c804

SHA512
41635f76cf6887680c274ce0f46888ddab873d0e8a179896f9c59113469707b08ceeb32238e2327961b352de3c44ac759d4c37a0d7aa58f3a08b9dabe282d2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FAE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FC1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit