9f23df054570cf94a0fe1efe0fae1f6e7b2f66fdbd2700bb42c49c5e23214bbb

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

microsoft.html
Size

4KB
MD5

e7d7da7348886daf9848f9a903f3cdf5
SHA1

75f7a459cd2695a2c749af7c2cfe06648d30ffb2
SHA256

437682d7aed87913869e30288646cd56f35e10da37afd12612ad1322c3b4ad17
SHA512

cb46fbc812f49f44974da6a243c9c70b8908a5d1df6b3b17c660d01450e9aa488ae60834c3bc288a805e76a2531256e9cde57b1dd6c80dfbf1913acadf0402db
SSDEEP

96:DtlHily5pXyKAWlT4vrxhEg3ctxBBJhyDXqfGGDXojF7:vHilyzXyK1Urxt3mxRh43jd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2065309ee3fbd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403150137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9220BD1-67D6-11EE-AB7A-7EFDAE50F694} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000fbccfa9598c95cd80c7cae86bc422ed38af9630ca35228262efbbac866dfd4b5000000000e8000000002000020000000d7dc15d3cc722547ca831f5753c02e02e5a855fb5eeb4157e60090b69ca6004420000000acf26dab1ef5e4547673c64206de41127098f851433a14346b37e4d0039e92374000000045a933a143f4331d70a0b03c475d214daed50889a5671426fcc69a79ca1da863d1933ecbb1b27b7e1d127744ffc83e6b5d84d4ed9268a87a35fda7e1166b815b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000f4a0576e8c0f4c7cc826b39bc53f65269133c7dfac5a7099bbc575928922bdf2000000000e80000000020000200000004546c196523e09a97f2ee31accb9dec96f7ccf7afe02476137aaff8a725c1a5790000000f6219b274c7b90c5d274b88c4f2b529c78b59ffb2887976ddd3e4dad546aad531d6a617fba48c7fd80bff97f28a8c4502e213a0a636c8b525fc5da26fc5e6f1525ad36454f0de48cbf2d4249781271248caf15acde1d03a604526b9a065d91193932ee3db23de2b0dfba4fe91c40206f1b4d2a310c017a262c1afd2306cd364efdc39e1999487e574030df7fca2784d440000000a49c2492d73e6bb75be0569620fae551168a121389ffe75a943e3a53ae9684d99d24911011fb1b5f9995f99250247a37f6a94b97b9aceaf09c340456b70f27ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2748	2996	iexplore.exe	28
PID 2996 wrote to memory of 2748	2996	iexplore.exe	28
PID 2996 wrote to memory of 2748	2996	iexplore.exe	28
PID 2996 wrote to memory of 2748	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\microsoft.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
673850834d5e039bddf26392763b6805

SHA1
764b0da81ee9bae4d4c4a1f1fc6b0e6c14f37af0

SHA256
6299dd190cf39de04fc09ebc3893b1872b3522bb8e8ef5c785926e79d508f634

SHA512
e8fc5d4a779d3ab0876d6e786b4f1c5bdac008c0a3beee5ef2fc735dffa4ff988fa104990cde1090953f4a79084dea91a31ad8234ff756880f5ed989dad11367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
39708b34ca0e1693f7fdf0bb7363e2d4

SHA1
9e3ec91270fe3e1fd1bdaf0c0cfefcc52be50f35

SHA256
5ca32bee1b4a9e7a358d09079586140dbe5bdaa2378868a638cd8fba920662c6

SHA512
083cecf531c4ad04aa2fdcb619bc08d4134ade80acd6ad8d47327e8dd4fe051c7981116df115f19bdd075520921551b956b06ddd02203b11543537d1870849bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1a3385cb9b1b0102185f67fb764e9724

SHA1
2ec88a25c4d1c592b1017f302e86e6a20c62fa96

SHA256
fdb7d0e47bf86ea5714459e24ffb7994b2f88c640b006577a9c3a3d4eb327c41

SHA512
f53dcd61f273f73cfaae7258802fee71b3917c63c606dcc2bd7621ce48ffc75062b8acfbd93448733918b3f96d832eaa2eaa1d4e1013bb4d2d5401c3cda08ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb6fb82f2c9870c4aeb9a2cffa32d904

SHA1
ed9e0a587871a21a0e1b2d7731160f528cb0cc57

SHA256
91cedc9486d81a183ee075b8fe4dc89e54ecf43d783d6b84b0b41a0c2d5bef8f

SHA512
45520e6572a86c891e78733c44f38dd6512b9ff661e35fbc12558b3f2565ff2f7533d3c4bcb844e0530ca513e8a71b20ef29515b725ef4f566e311fcb792d831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
60f8eecdae5b111393dec3ee73999b58

SHA1
a29e3c3b563b21dbc1610e53d4a2c7ac0cbb2b01

SHA256
1b276e71e8d0ed7b94a9637896b113445ff28b16d8ba85d8327e6033421a3a24

SHA512
db66731a7c8b9cd998e563abdfadf181c70e04c1e76c8b586e28c8e527b14c604ae22985933c58985a2a6efcbbc2dd62721a4f4ca687e53e4c071644923d37bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d1d4982689f6dc2c57ef32c221d60dcd

SHA1
3e1882caf04aacd0ec7e0856d44bc4bec40aacb3

SHA256
77c46d735a4612ae2858c4ee69dcf1b90acabecfee14134c4af3cb2fde65617c

SHA512
96f1e2642f7ff7f14b8457d6c395be2e08888457033e5acd991c0b343377348282abe361fe2740efd0a222399b0c78234e4164eb6a9e300f54890fc96884684e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ca4c897de36aa78eba52018395192bf8

SHA1
cefb93484b6d9be0c1a84da7739ce372dff58e1e

SHA256
9f7b78a8fdb16c07601e069e0f94d60aa921dd986ae70bd1d685afe9fa424547

SHA512
e3cd0ed4a22a4a49e04faa99e5d92ac25c69129759ea3e953827ac2b8b2094cbfad71d29c8483b5af9cb7bb126692bedac14f10db069a47df9bbf9b2fccb2fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7733edbb0d8b578ccda1cad839c17b53

SHA1
30740ce8f6bbe04fbfe64ba2ad67ffb0d2192f7e

SHA256
ce0b9efc277f6b40379590c972e3e3a9e2202e7fc4fe72f6a3565f15b57b100c

SHA512
b0d03088f5d601e7cd44ecdeae902ea8bb454885244deb16aac421578b77135138b76f3f2a61ee662c8623c0a94787cd11e5a739e5c249bc0e98f203439604ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8402.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8453.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit