aa10915e72cf995bcd4d3601d50c90f15b66393377042544ddfea349c6192f25

Analysis

max time kernel
132s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_120_cd2ee54ef1b354ebb594683dac1df721.html
Size

23KB
MD5

cd2ee54ef1b354ebb594683dac1df721
SHA1

6630e2953186846971358a2c7fa41f4959a94149
SHA256

084ca6786e8da6e50df896f9a94738d7292371b385b08cf750252751c79e8262
SHA512

68c4419bc6594529650cb33b1bb323c3070697ed49a9dadaf47832bb031d967a0b7707f2e365b5fb2d7da284380d08e7b0646ab008b5decbcf615713f6805d42
SSDEEP

384:eg8T3Qo/sDxp3f9v7XtmLzzJDglR7EE3qTE1MzE9E32fbE3XVWE3GYE35ERE31TV:58H/s9pPVzIvClR7EE3qTE1MzE9E32fN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A13DDD0-6578-11EE-A967-7A253D57155B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402889600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c836ff84f9d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000019f9b0e78085099ded7c6dbb4133e18f606f1a2a8fa5f26f399b66ebdf75ee5c000000000e80000000020000200000008d6e33bc184ea43ebf0a1254f45064f84a35328607c5c89eb769ffa24f40eca590000000982e42743771c503e464dcc7d3b2fe6e8314b7e3eabad6ac0329b4f87e580c8f52012a9457020b2ce968fa2a49949e62b6ca26da23c9f40aebe2c032dd49cbdf5187343ed42adc4a13313e4c76b52859c8e0925a3c9abef3763705c5477eb01fce55e7273f96713d14cd338f225472552bdad97152400cf21af208eab079bf75f78de609b4c2240a865334e136567327400000001be91d8bcde5ff8b0644b2503da78876eafcc9fb02b9e24f8e416907d4c650c2b31a1cba285b43e66c5f401f3319a7a92943c261f5c2e96c299c385d93dc131e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000c5c8c42dc7570f19c9443f23a86e1d8850b5fd5e94402de17267f663dc3c2fe7000000000e80000000020000200000003472db29478cb208247641510c7b224e213201e04a3d91c29dab3a1361fc03162000000087d6e73efb973f0d5832c2ccbf2ec1bb52a0eadbbaf10c53e52292eda2577c6f40000000588013bf3f51a20810a3ff303f6fae78932c91d4adeeea363bc5dc112ea2a98da094c5393d8fda48ac0a11018e39c4be53f1a9515b39d95bbab84b246cdf7203	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2616	2388	iexplore.exe	30
PID 2388 wrote to memory of 2616	2388	iexplore.exe	30
PID 2388 wrote to memory of 2616	2388	iexplore.exe	30
PID 2388 wrote to memory of 2616	2388	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_120_cd2ee54ef1b354ebb594683dac1df721.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bbd97e8cbb15ecaf83cb9e86d8b9f9

SHA1
07a4a1fa87fd0bf0986b1bdb1952c01a46574029

SHA256
345245eae2af32ceaa137deaf4b5de0293fa30af3bf2491720a8ee0c46c6e0e1

SHA512
0a35af5835978e1f90967c79c22c48651bb788799bbc1daa3d1ea01f2400900ed9dc1755720ae2bc492a354eb43c25ace418511d2648df5b6d0082887c547050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad45e45c46610e799606ed1fdfe88795

SHA1
5b91673bcba8dba61a220e14a69efe96eb56f60a

SHA256
d11b12c3d28dda733c8b51b0f880e34470de86978a508f8fe0ba52220a5d5d2f

SHA512
1320282f251b3375d3c0fe7e3597dcae5b7658c7cc95981c481cff9bbc181c9737f52a7119d9f2a17857219625f88cffeba488a4c13e9f01463376e03614a21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91b8af17e904f5f9bdc9e39af101d48e

SHA1
480bc0436cff2a831124189c3662ca91e80e63b2

SHA256
e6bd82baa9361277b3cc9fae70ed773ad1a33c1c14dc12497619a3dd483cee17

SHA512
e5a51e51102186d308250bdeef58c50897d59512a3490a9e2d8e8995d57ddbc91ac9d6be64a10dd4c70072600d3f982f2dddae3b956db99cd9b207c8d309cb40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9e9ceda85243a0f2f781e7e45cf503

SHA1
aaf5b14c35962a5ff027d9f5312ce38368d442f5

SHA256
99d112aaf5fb2d632872366fcdf4427d1777b3a185f70080e83628c48b6218a7

SHA512
70799ae677a3764ac570882679487ffdfe9b238a6d047607ef8d21cbce8f14325da9fe647d10ebb2fbf5e961425dfb1ceeb443036e42d10779d64e923abb7962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a5105a08a8ae1ffc3e4bf137cc8cdf

SHA1
54c2c5fa3db91238154982940b509aebc36cd2db

SHA256
b1a8c473a85d6b9880724f74a3eeb8abadc814bceb63a89595489029f690af92

SHA512
60a803d75fc4b95118995200c807b69a50b8973f459453b0ce1c80cc33f5de022cb1f6d0e81e73f72420bc7c0c68c5abb56e1c9e6bd2bd78a2a747edb7d91ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ec23982d37079ed754fc26e2bec6dd

SHA1
7a2f5781b43cbc4cd1d16199bb27eb6f7c85e304

SHA256
d8afeb446e4728bec2e99640e9bb23b51a8e340374bcb9ee0d3e4ab30b66eed3

SHA512
f3c2a18fb3df7d2e3912748574f28c14307d12f4ca9f7ae8be6fc4793cefbeb5165b9ba916e98e7823cf1078982f479412bb5f2c83d8d89582d91551cff0432a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab6ace0c1c620fb3ae29f1868d342b2c

SHA1
bc0069ec98aa45f16361bb9b65e0aaa297449d79

SHA256
f19c94567bdea40833a7853fa96bf86dcf09de3b14ab09efd1311a423993b2eb

SHA512
79cd077d7c87d191f5089d5be13c564b84ec9ae946b478634523299ae8fe5f7e8660596889a06b709b303399e38f0c847f63c95f054498be4a0124fc44e4d841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6192133a8dd85181f8300e8a79a77928

SHA1
add4b3e802b08bb4894a4a14d8a13040a0ed88eb

SHA256
6f9ecdb72adfa3f0f9add2fc54693a464f5715cef7c082619f30b286f619768b

SHA512
b5f98494d58c444e1549031babb0e3fac47cb2d9dfada7a4e75199e4d23c59a11aeb679219ba31eeb145f03b556d63d903f28b94896197ffac5b67567e0c0569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce558aae27c611896d8c0a2096eb15d5

SHA1
6d02ca1c7c5d084323079b55acb397d52d974fa6

SHA256
1af19792ecd0a524b822daa0dc6873038a255d83bf7cc2a38f2d02083307b36c

SHA512
6f43c3d12169be5413d3239b895e6d354f4b19154f0480e17b12c64be7046cd4504a5860a3f198eb329a38f02ed6bff46afb28437b5bd0af0dd10a942f1eea30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79917d96a40b5d7c19fc3620392048ba

SHA1
df3b2549253cc6c6274a40e37d53dcf2ed23cf23

SHA256
1da90510ba8fc3f55cabca760096bc4fb92087b082cb66281e03793e8cf00e87

SHA512
c7b498432adedd29fdb99f9d765fbb7f934153c531eb7d3868f2e07d7df288c235f9012e39e07bb9d018bf2caf7cc64d99f75568d2faf88ee70929c622954515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a06749a399c8b341ccfeea8f441733b

SHA1
fd7a69f1da192dec696eea8250f6f9183ff645cf

SHA256
acad7e6fc98809455df041c7fc3357dc7fc2e15318b079ed6a9b5dc6c5467a77

SHA512
59bbba67f4f3689f1f4a51715f89ee6bbf265b81212cd211346ccaccfebb98634e1737465522ef9924c121a63eb23bd6df16fa1a6f08744c1238de917dd64093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe8af4e137a1b39879eeacfc15593e3

SHA1
ec08972e826c0d1b450925d3c422949a03d49064

SHA256
0bb3195dcd64c631bb50b638adde953a74a620cd80b5673f8c58193b48e9122c

SHA512
d2c4fa1034469640419bcdf48ab6966ea4e9d56260d2ef18157d342f5333dfc88bf93ddf86f06816fd734a2ee655538d8fd92cc970732f5c4cfe6b0afe740906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76cb9f97e617b3407bb6c2f5559bb86d

SHA1
98fa777d05c984809b671bc4ffff5bf39ff850bc

SHA256
bff206e0f2808b3a8aad0aec798f2b7bf0a3a5a1c6a9be90578898303b447dbf

SHA512
13a89bae2d34dae697b6fa2d353f4ee2a5062ccdf644060b4d8d816cbb2a75ed5ba34025c8fd6819b4e6566caad90115b0290f2a4d4d45fdd58a9c87a94913ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818b91300410dbc7884e85c05c5c851e

SHA1
c5fab2d2d1a239eeea8a4e8554fa15b27879f4e3

SHA256
c10a79832f67b9f46a25c4b22c26f3eff437c47017e519c92789efa7f829338f

SHA512
69ca51007583aada33d9f794ce37e349e7e91b147369840f254757cb0b51b97594bb250310a892d2d3a5ede8a478f9e950b6c964d3fc6164e1ed7c4cf34009e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc8e663643f3da2138a8398ce09cadd

SHA1
7a490a09c8bd1f9497adedf42ce0eeed5d117906

SHA256
bbb29fce5b7a980b8db735a2d71fa2709a354bff0704bb16900b8becc8e5258b

SHA512
fad2776323a55c9aaffbed8274368ba054b3c0ccf88242f9faf2d2266e0458104c30ae9c44927bedf68dae1b592362a2553d9a78284f208b188c5ae0b232a9f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB09B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBF7.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit