aa10915e72cf995bcd4d3601d50c90f15b66393377042544ddfea349c6192f25

Analysis

max time kernel
197s
max time network
258s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

_119_28353436fc2a08ffd172e8e001c34dbc.html
Size

18KB
MD5

28353436fc2a08ffd172e8e001c34dbc
SHA1

0056e197d3eacd5f87e1e09e72272da52e9ab279
SHA256

89ba48259ba1592389266c0c083d4a9410bfb33d5a1bb42cd7db9130cfc597bb
SHA512

80efcf97e82863dad32af717516a9b4347720530d9689429b669dd9c368b7065a2ec13e6d34a1c68c571caf01d66a0a74bd956e44b0e34eda37f215253979050
SSDEEP

384:+g8T3Qo/nfz5Dx63w9v7itRLYzWRglRTRE31oROJ8E1u2QEjE3Ct0EGhexH3sdr2:Z8H/n7596AVubk1lRTRE31oROJ8E1u29

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000a649dab6325c62950cb456f362ae3124cfb97b990f6b956ab07bb850ed1c6a1d000000000e800000000200002000000042e2fa937671015db60546d499c8029c59ef0c2f037fba43af97b9dfe6b0058620000000da1a01fe46af0db14deb791f743dc6cfc659ea52130f1357402617adc4719be940000000e61c69a3f72dc683e86b870e5731bf01f37abc0b6680dff26ba468e4a54330f74afb170eb888919eb28d872669edf8458b513ae19d22ba4db6b5b37ab10ca6bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40C62B51-6578-11EE-8A1C-F6205DB39F9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d2ff1a85f9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000002c3c274edeebbafd95d833c0f8b58e398d93e07ca41397939c3f0cef62f49def000000000e800000000200002000000037246351887979480c10491b3ef0fcb23dac1a496292c709c98f00dcc7b34488900000004c848a63739281981fe0f4b6793e8f115eb2ea7a9a1cb9b37ad9e01da749259b7f5ab36b08749eef521215ea21f170bbdd62d034e7d43a787b82a388d3fb74a61baac47bb1cdc171ceae7c8d9a1d6feff51e67df8c76bc18feb1c3a7d5c42b2032a0b38bfe24de2abecf07842f2e5f9aa9feeb932b80dbe70e97b91ef5a0e09837eae14fa9265f79054d08ec9efd50a540000000a33cf9968a17f720d2615a91f695c4e7265e636e778713b735976416439dd8449699125adb0002c355823e65ad8845db05f6a12eadf6fca4a199ae505d0db1ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402889642"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2812	2036	iexplore.exe	28
PID 2036 wrote to memory of 2812	2036	iexplore.exe	28
PID 2036 wrote to memory of 2812	2036	iexplore.exe	28
PID 2036 wrote to memory of 2812	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_119_28353436fc2a08ffd172e8e001c34dbc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0cca92064399a8677ef9367905c0c0

SHA1
e52007fd494ab57f674f745a8166e334066b9d9d

SHA256
4c330991b0ef8132e61a1ce655313523e427c556e628a3bb97cf4f3601e9575d

SHA512
9cee4adeb5c653377c5c09d21b44f479e7982b1b516dae5b306bc9dd35a24bf18175fb8086ce82142901e16b53846b91f0acf74907d613ccb8a148fa8e01db89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce871fd5b3a28eb33e645d38c5f7cb31

SHA1
3d3ea2928d89aa580accdbfbac50ce5185df3fd7

SHA256
d317aad2b2d44b3021dd220703ec365a238159512ef2d7410f65d79bdf54cda7

SHA512
6ca52b6358a42a956b591cda2127b240c8a7aea6b1fe07ebdafa78cc636c893fc521845a8d880d3f2a27e9493f5fa038773f181e07dcf9bcc02921030ea8768e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
135d1219bd0bf0465e5cc467acd4b7a6

SHA1
eb7aab4f5c48dddeb80a182db962c54ffd25c6f5

SHA256
4bd0eee407076211b772bfd01ec697d4cec33729feb2d63fb0d2075da4eff891

SHA512
f18470b69d54a4261b5728cfbcd782fe4f99d038f10745820f44cb9405581323e6f5989e89db2a209701c88c4629dc0f519f93a51fd39a6637384547ae5f1db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d346617732c3c976ba008d00f8cc50

SHA1
b6a6997d53cd9d224cb532f75cb849257653d2d1

SHA256
195e23098de638d08b264d3fcf29670c7e71993ae3193fa752df95b85e4f923e

SHA512
7472736ff804b15beebdc569a8c552cb68ea70f800abecd4df25f250f62595bfc0bec339e5959d0114e7cd15d1b97bdccb0f73416c6e6255255b25b94773889b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fc18c15ee620300a09721b3d5b5305c

SHA1
13618f612b802ba5088a713f390f3292de6b1b20

SHA256
f859612776a76315a55971a80586a6bf1fc5f274a52e5a24db6591f71c8010ab

SHA512
851fffb7c855bdc75cce7126b9e2dab05d22f401a61ff674d932c81fb772f6f5aeaa2f7c7e6ad311e7aad8f03810c13740131368e5425be6ebc995624e3c51dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e766bebb66b467d0e605e93f9d83456

SHA1
8b773f918ba9c22f2d690b8b3cdeeed25d579244

SHA256
0168fc5d44e236278f067a256ea1158661f0eea60c6798f2e5cafd5541cbac51

SHA512
48472d486176161d50b6b1899320ae3b6fd56913ff773ad458af255e51ffa0c3b870400b40c8fe969b8881e02334352a8355788504ae5d1edb7687e363a4f5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5025485d3c92d5f31b9c77ba2ce43ca7

SHA1
6d64e4ab7a2c62ebd8f159525d7de918f698a01e

SHA256
094e79d7fc941cf9d9203d42897cb3dca6d1d6632e0d7afc3596f5c2a425f032

SHA512
9bf8530e41bfe39c325d23ffe6efe9827931fc75116cfe826560a9da66531cec524ea6dd77ff1f0c18f15c2802a5fac5e7ddb14dabfc0d621342fa3ad6097899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2170d74a44c0cd79828e4bb163ab32ee

SHA1
7330443f1a37f72287731793ac631f27ce069b40

SHA256
bed18a08475c29311747969e7246f50c013b9f6b78f84f1f8c85b13dcfa56fef

SHA512
75558e9b7e313c3d4c9f2c4235347e6891f501ed1c0c8c12362378806695ddc338c426056b97db7ca7b8eccb27a9cd67cf306eefd5549993f24ed1d431419073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a425d14de0adce6810937eaf8ff6148

SHA1
26775633672716061595606bece31e71c0d947d7

SHA256
9646b81cacd5f69c8e708ad0c56d7159ef30c8e01c8c77c01289433fba7d1871

SHA512
912ad74a65f634ceaabc399962d80f00aae2c8271b07f2d1efb70e2e398b4566449a496cf70d454702b58d4110c92be75d1d2a0682ac3551ff974ff1ddc3b71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d431a187f2b0b1288bca231f682df91

SHA1
a20a9ed2ffc71c16c1f51cda3532023d22addadb

SHA256
4574551a8135eac7dd3d118156df4c2a73a9abd26bfb06343555605b0f32686b

SHA512
eebc5568070722243e17e4c44016dddf0a72ea067b10222945c389e634887e79ea88b80973bb2c1a266e8cc14dd3c8a7a87f1677698ed9a586c26c67f59ff9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA24B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA28C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit