aa10915e72cf995bcd4d3601d50c90f15b66393377042544ddfea349c6192f25

Analysis

max time kernel
118s
max time network
160s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

_110_5ebcacb7f0e1422f0c3fa20bfaa29c3c.html
Size

12KB
MD5

5ebcacb7f0e1422f0c3fa20bfaa29c3c
SHA1

7fc7064e6e0bd5563078be36e1c3754991f9a865
SHA256

8ba72a16729211dae68bb3e093d43e54a29f99019cf9c612c5734d1e728503ef
SHA512

7a2e015d8af095f04a2c7460e652a9ff15babd699bcd27f22b44b8f16225d9630d2ef51cff47824cb4cf1e9ab37219ef5da5ee814ddfb00f0f0c53789c12a9c4
SSDEEP

192:BHe1a8XUVbQk10gVpfTY2di/nSWnG4obEz7qW:BT8X4bQk10gVpfTY2dsnZhoYn9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{614D39E1-6578-11EE-B489-56C242017446} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000607800e2f7afd7d5c235e55d33aef1077bf285e9c20c4393a2e28067cc596c9e000000000e8000000002000020000000250acac73cc754182d1805fae1c4c336f96d59e4117988c887e186da5d3e0074900000008877795cbfe71c07f09c301cc917f570820824e5a3961d9dfe6241c630ed256265916529b68b40be7396e8c4917b46994e006fea38e6335380dd5c11a7b64f1fcdda404e868d225b5a87c21e4087848d37368225ce7220b1f1a254609e5858de4275ee58315c09581698d63cd33e01ea87304733454f3e3135bd261176d7300ca3b76e09f669241f0ed6acffde18ce0b400000002ef3d129cb1983e55ec9ad90aba58c94015513d24ef07f740afaef2a0ac6415b30d706628ebe504bc5d1edf1c4d500e5289b3fb87a5e57b55d3776b10d1115d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402889688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f085463985f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000038ed1a24756abdd5aa31cb3cf7b27a3603999bb9b777b62492f58bf5c052ee4b000000000e8000000002000020000000a0ef9449f8a35c7517b00da0dda4ff724b8c116135c67ffebc50095915c033ea200000002c3b3c0b0f60444e0015bb1c3208ef0126a38fa0043a5c9077ea637c74124b754000000069857df06403ac73008ab39e6ed74633e289e0d32b5b32a453d90ec7baff8a62e909530411273ec1c9941c3c84167a45dfac6011b954ebbc773f91399ef45605	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2000	2144	iexplore.exe	29
PID 2144 wrote to memory of 2000	2144	iexplore.exe	29
PID 2144 wrote to memory of 2000	2144	iexplore.exe	29
PID 2144 wrote to memory of 2000	2144	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\_110_5ebcacb7f0e1422f0c3fa20bfaa29c3c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb19ad05781b5f96b5b2f6a136c3b48

SHA1
55e8c78a3a25ccfd377e8e2f56688305986f60a1

SHA256
435e1c829d66d76066582014730a99354a12ba70b31018176dfbbc3c9b67f8a1

SHA512
e6d2ee2b2db622bcf6049565552f185957866fe397b04b06059dbd461f01170496acc28fd5a19c1c95ceafc3d9b4848eb3d511f0b2a0df1f01bbdc33cd483a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b8d77c011dd79fa3ca986d7a9a42e1

SHA1
4af7c20d91757e65d527b6aaa703f9d0f6cb4293

SHA256
ce67240c4c8e109e8a18b5cb4ad2ccf56f2dea5eaa3fee65ddbcbd829fd0ba11

SHA512
381899c76175cd8293798987bb8193132f6e8a78ed7ae206faa45351fb8b86d26b82927c142e5f431746b939fd215a4b5ca38701f360684d81c64a1d4f89615a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f907c4a5b26dcbaf302c63168182378

SHA1
4647395c90b739d7b5325a9851df64f9682030ea

SHA256
1d92d1a2c7b63d18b88502496ed89718651f5b0b9e9c02de0b9e3b11f711a0f9

SHA512
2b6181da956ba64c9dc3083f87634ba27ed76c62da29a2f0ea55b22e2f0bacb4669b9e029d4a0008a55464c8c51ae91330e2da277152d6ba124afeecc4110ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c94192a441804e89eeeb1d65abae95e7

SHA1
3580ec7fc7bc4a92c4395801a5c64b2044a43e24

SHA256
efa8214d18b65c1f9e03727c5d7fdcf0f97ce39ec94fc769b7e4c70bd1c4dea8

SHA512
d00df74cf96ea3a52a86d2ef90b4250e054a9d8b20bcaef841610b0eddc9a0e611bbca73ff9aff8bfce15a6b57f190a2d831fcb027cfeb653a20cc417c0e9eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ad82c167d75bc8c1422a4c1529f4ff

SHA1
a794729ac382097b68acada86a40237125361727

SHA256
d6630527cb7afd61700c23003e82d3ce57144a6722f794dac776bf2156e2f1f2

SHA512
8d36eabf7010d03f23ace951ff4d4b55f81e0f63c6b6955c8b8d287dbe110530d4fd007f393cfc548c0f80f01614f19a584705c5c179937454e76664f7b490f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c8e707ca965206f6ae747e1e6de395

SHA1
4f0288d403a69d9041c79539b3c8ee4e55c1305a

SHA256
b048806fd0292fa5bd8294a61a45ff599f062216dafe5ec73c0f06209931cb76

SHA512
bad44e1a8d1ba980ea4f70f93ff3b5e1b390dffefbd841626e114a91512c9265539b1b793b4bf0ce032f9a0b77e4624eabdf0bc16e8008c4536294b3b1ec89aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edb89d7bf1a7c6fe00152da942a70b9d

SHA1
153ae92faa6d74a4d27b4a369a32ef2e25234e29

SHA256
ebf03cbeaa0e04b377de9eb76caf0d7a46e638310bc3890a2d8ce64d8cf13c8a

SHA512
80d7a10e2099352ba7899454b71ef26998f767f1dc64a0d05d6ae9ba47aad098f888ed71b1f68a643bfdf67bf3f15fd44f29a81d5a8ed58ce0bd442a677e23d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
433bfeb99c59a46cfb2202c521220da9

SHA1
6b71ae6a9067cd597b7cf8bc9868797259f2f5f1

SHA256
018951134af0714b2335e1d1a8f3198f6c74adb3c73a69d34da47004ac96b941

SHA512
ce97133085472470481200414ab9cd505944214912602a2f8b1f6219cf3c638bf44f7197842d6543002efe8e06bef9448b61c60d28e9ae0cf42ce73da780363b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968b4a4316f1b3672ebb7e5990169a5c

SHA1
a1eb154d71ea69ac22d012f0b0a4cff86c28ba29

SHA256
3d4f31227d6151d0f8cff98f883b929eaa9c65b0a91c36ca914578a5ab0f52ab

SHA512
26c4f0bea13d400ec455795d2a1004b210cbff54fd693fc338f0d4f03b87eff71fc0c6d1931110b82fa0ed3001c95dead9fa90de319c0bec04c19a89536cba19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0be69fe617ce30d9bbb4a8541651661

SHA1
22cf7001e9d2cdde9fec24adb7d57a3a2e315f9c

SHA256
4d6a0e1d73ce9e8dd7a3bf7743123e43d3b34004a7cdcf311b9ad08eb3126eda

SHA512
f52be57ef837b214b1ef1ecb9b20a68493c8ae74b5b32cb98e8867c3ba1393143b48b6d63efe9beed4508e69545d8dd225ab77a2a3fcd8cebcb88d62f5db4575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fac3b2008d99c419dfa5662f6f8f3c1

SHA1
563fef66dc9d5514292058aafef1215fe181334b

SHA256
194e230ba1d1678c68e118f6c9f5f2b5e7341d024fc2ec10f89b5c03b39f2f12

SHA512
370e89ef871432fa66dccfdc69b86c147a1e0724f83255b97fb73be9747f3292fc7535df917b5ec1268967b831c15666416a3066635a21f7840e634ade051a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f104256670bacffd15c1b2cc59f3501b

SHA1
611336ed334930aa6dbb8c8f17b02dafd2f39ec2

SHA256
1076d29cb54075b7a99655fc06bbd4cee5200bfc65c18e9b4e0f8f5c521aa84e

SHA512
d502a4faf2e3959eb60216b6a87c70d2af5767e7033b927dde1c61e93003ca4a657c8540223f342777651b12ead3321ba001944de76d85cff1207b5e20b9c863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1ca55accd83b1442deb0e6cb4b15ef

SHA1
8328aabdceaaa23acc4b894483ca73b0c20552aa

SHA256
3023789a8dba5b267c8bdb0f5f0b0d0ab6c680b9de6a78079bd95343b045568c

SHA512
018c79f72c319220426c433f4a66a53747e4fbf7e00f06d79aab56080a65dd5988e65ad5378cea19d31350836701ef23b539bc9d1e25d0c91e99b46eda2a16c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfa7788e448d231b6e81062f5edf066e

SHA1
8fd04519cd20e8be31f0ba2e0d44b748ed071e08

SHA256
0e3aa8ae122e88453470cb13b108f79e707e31819491c899d6736f0e8269e0a5

SHA512
731834033fe783c76f4ed83e20d3087babfaef0367a333aa03d983ee75e488e9fb59747d27dee1bc605ec141d62213658dc7d5795bf1e28122797b39df408bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8eefc56be5794427cef756fcd9293b4

SHA1
73d31ecc0ce8234fd2ceba73510c059c5a0e79b0

SHA256
87930ccacdfeb5ec4085b28b804ec20f11cc68682c9a02ef7bf4723afc03a4b3

SHA512
bc7a9202b9f92a2b7edcbc629b2f948b840699082c6a1f6152474674cb0af4bacc0581c4fc1188aac71af1fb02ee0a3c774d6a1666a7cb18ff153c096df769b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072063ccdc484b3aeceefaf095b8fc03

SHA1
3a361c8ffccc8658a3d337947c50f4cd0eae47c2

SHA256
e60f2bd22059302599317970f782e59903a8d871893a450526777d5d7ed5fa55

SHA512
a733ea70c608b49c14084a661ca757642c6e47b9489ea27a6b66d46b8157e2f13f568cce9ca76efe3313e3549babf9568bbc4f1dfc3d8efb252411836cede8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DDE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E3E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit