bae99f263ec3d3d6a62194d49a412249b0c025ee5058db87115701cbe31940a9

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Milky.html
Size

62KB
MD5

bf6c36e298ebd3b56a1dc9af4f6b526f
SHA1

5210257643bc0b8649e2ced34e714e9cc5755a0a
SHA256

0be2b41b59667ef1c6e1d7af385e1b6be73b22146857ae447cff3c6db8c85dee
SHA512

7af16ad5f0cd3df4d9c674267565907a243c2fac9caa18b7e1c7931f9566c6b89474de2c24c7006e3a2d8cb0924871486044ed0ff05f79a8a3bf0f0b65c6a1b2
SSDEEP

1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++s:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8Qy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b000000000200000000001066000000010000200000000ae5ff113c20766c6b33dc477a14886d39942594e93926e18a6ea48f2a6386ec000000000e8000000002000020000000f002a78761d08b9b4393a15ea8517c210b315a803c0e01d1c7659f9fe72bca1290000000f3f67ffb79a127f886b902bbb28cffa763b987087fefae90c2c76136540122db366faa0fc398d0676fb9179efc2979b4c9fea4db56433c564b1b05a30e249cce5065a8abe11af9597b7bd4d186368a1da06dac3d8b9144bf8e03af6c58285dc2f77113e18cd0fef045fa62c53763a6fa9af76cae66a63b73908f163cc1a9397fc501b493157b66492cc111d0092bcf0d40000000ae875ecdf201c864db396912afe8ec97f7ab165f4cfb6b3675df3eb7cd34301093c7464e6ffe39d55648073d20df30f9eafbe9e9e184cb784540239f38158c1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D15F8C1-67AB-11EE-A617-EEDB236BE57B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131567"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b000000000200000000001066000000010000200000007b5738458748200c9e08032385c9bc0d5e444375da96a1a9bfd0e58f1d770717000000000e80000000020000200000002d244c7a471446d07ade6b628d605fd50839c2822fa86ca24abb3d4fc6f099fd200000008bb9348618c5e145977e2d0794cd8f2bdb6f4c17f94e15805ae1c0b4b12fb767400000004df2f329587ab7bcce7500839851056cc08fae7f155f5af3caa42759d1dd773334e115171ee30369fd625d3835976928d8702707e1f2649516ad761f0ac80093	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0da3362b8fbd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2740	2304	iexplore.exe	28
PID 2304 wrote to memory of 2740	2304	iexplore.exe	28
PID 2304 wrote to memory of 2740	2304	iexplore.exe	28
PID 2304 wrote to memory of 2740	2304	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Milky.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
75ef0ed0afca9d93198efe85cfc505eb

SHA1
046e98e98caab643f88f2d0b229bbf8d6386af42

SHA256
fd7242bd34290d1751148d99cf0310442ad6d36632a02df68448db74b6d25c4c

SHA512
f2de1dbe757b0e530063f5bb0fcefc1fb0b5156e414baa109f817fc24e48fa1ec1ce5c51d9943479c41853d7ec66ba3ee0cde2d7bcdbdb37962610c8c7bcc539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b20081d273ee1746923a2b0154b6fb1a

SHA1
cd1719faf9b3f603cdedca09678e1e22ec6e8bad

SHA256
cb7674e990673bcf9619fa34c55cbd539286f7adf6faa1d08bb5a3cba6767ed9

SHA512
fe07233b0693041bd1faef4aa469f5eee375cf77ec1fd107109f9d076d0152d978604686e07b4a8a849f5203570b5978905cd71a6ea8e30095086246b748f5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7dd67a3cb54eb0ddc9611ef30e10aff7

SHA1
36fdf781a8ef97949c6c6225b82c5739a097a96b

SHA256
96a958e1419d6aac9d645169bb1076219e5988f79a98c1c41eb9ebf79856a672

SHA512
37518ad5c06f635991509e325ef66299d2b59360d2c5101a3e00dec2cdc9496312eac2f43a5fb2dc7567541715288dd5fa4567f30a14f8e5088e06a276b187f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9336c9abc017c291c44717d0d956fd2d

SHA1
22a429f6787fb383897902c0194d67dcb166484d

SHA256
c582a5ffb2ad6868997f33f21f22b77468c64191f44bc8751782fc05e5911397

SHA512
21c4883db031c66250c727eb84c50f8ee1db8ab842f2c4755d545545a641471aec0207b546bdf77a741d4acf6b3ec59d906fabfe7acd662d227d11c2e70cdf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
601cc16b58962d3df3b26f39fb8bcfcc

SHA1
32c936305fa833bf19c47bf1fcd943f05ea9715e

SHA256
64d72078fe6131828ce196b60ecb4b7a7809609d519c6b400dc2e4a528913e52

SHA512
c6ee1cee8c9427d011952b6bff71d8db245d28d267ff9794db328945b46fc65d70f58f721541a24361b0270f89b2d321343ec681dd8e3f9bd2156e0e39123f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
79d0d470c56cd83d82296b4fc05d193b

SHA1
9f1e1ca31e9833b97a8470de02da14e1d2edd969

SHA256
e59e691e47a8deaa3293bff2bd95d8006d185543d786bd0e7571bfdb51826400

SHA512
276999fd78fb17e18d8731d069b75770d17e3376babbaf4b645b425965be918e8ab88ab60c0d1a54da0ecb7435467115d77a09369019e8b722cddd718dacc624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee617abf7c09a19699b3b9d3b19d0461

SHA1
d148e580180c1299181d06adacbbef1e311fc4aa

SHA256
ec0b26a5794936d718514954ea3b0a0109d7101462100d88df5f8f10c493ca30

SHA512
0b8fce699f764381e2712da1990d1b473d2f10bfc3743aac3b00cb4cf04efef656d34cdb2399216686a97b33f282aa1837aba6d9a4c329632f0164abf0b5ff5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
83bb9109ccbe11af3e65455895f24f1a

SHA1
3df0e01f574a895e23bcc980e0d2e09ba66b3265

SHA256
9e73fc60b174f0bc9c5f41001908de1017f5738a2f977d0ae305ab928596b18c

SHA512
39bac84c6a84032768a15b3ad0b798355e42dd5dfbb4a1e13f229fd34f48468b0fb4f6b11b0bbfb58abcece116adc0b1611ae724dd7cf272b6856fd6fa6aa348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fab6e7adb8417bae8cfd68591391be6d

SHA1
78f5bcb47587a58287abc898ca9b59a886fc150f

SHA256
766a22534a80fb8ddae589fdce4c1853f686d4ac5505a7f35d743a35127c26d9

SHA512
c9247c975ea3442cb6731640d085d2074c38a3ad3cad2be6dbb855628f5162f063d393955d34b3f083e1cf9181e9ee7f5a8e8baccedb775fab7dfc75070dcc6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
408ab2266acd748b9d6dcbeb2d2626d5

SHA1
de18ecc80273bfd2d2dea35e564a0360ba189934

SHA256
ebdcc48a4954b8dd8b70018d8c721e4fdf9276f66d066edf9e690c8e06037fdb

SHA512
3324a777a98582bfb4bd2005821a748cb8b8cf39400f27bc1919a0c61e6fb3e9a09508a418440e065f151fd712d82efbf906c40d8ede8fbc3b6cda5eb0deb2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
461430ea8a52f422758c55fc941d6838

SHA1
a8b8486ec72c814b2c20e949a2c38c103be64841

SHA256
f74abed0b098a982508482f4859754c73e127ca97ed44ef06220e2d5c6cfb599

SHA512
569dce413bb02910b8641ece4a34739122546db92369f3d8461e59ff9db81f669d4d68cf842399899047de65c3fdd2067c58a889b5f54f4abd9136363718ecf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
142ddfdcb9dba007b0b81f7eebbf81f0

SHA1
c7905fae0c171ef2aee518c07e7c9c336815596f

SHA256
ccec724caf9e4a1992184fb97ba776fce56e38d305915392a2b43e3165104499

SHA512
379acfcd11ff9c48171f448cdff5e82b2b27adb4e144114497483c1b6ce6baaa60669c172200afdaaff8b1d931187e19165dabde02827c4095c0292a54c3b384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ea6f34050d219a05bfb171bf70e29b10

SHA1
993d819919ea05e939ea30d282f56a1f85f93e93

SHA256
523773b21331d75c6b6ea05ab623195a4f60230c73249e88dd73fc9d20587cf5

SHA512
1d9fbf08171336efef57b817cdb5fa65f0d1ac4f3626076b3f14012fc1e4e2d8e24eecfa8a1250b3fa612acd3bd9b3e9927e184ddec98fac6e299b7fedba5aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bf386b9a1c0d039c38210851c6c305ec

SHA1
f116561bec0fd6e7e2d86d78baf0a91f6933d3c2

SHA256
610895f088f14f140e56d4275740fa0cef4671338f04dd69b7399757ee0ca235

SHA512
9c0a5f9204686e7fc88bf0c7cdb7aebdaee04983b3698b1ba92a23fc73ea7de49ba3c49e10016b093259434650a4c2cbb3b584ded18524ebc90ebd38d411d06e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
58d56fc4830b4bede38ed17d0e176b0e

SHA1
7d04f7e3d7d4c750f94b84f5f0c9939e6136bf08

SHA256
130884d37d1c3f118d92c87b213c5dd915df130c2c188620ef422ce844a37b27

SHA512
843a31b1a0d099ef00e9559158fad4332da4dd7b8bc85befe5484a95b8b9b46675891a2aa754c8816d4c416593d7aaf70d9ec7e114ae3c12a5fbeccd056bef29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e698c8b333b84866264d16f54d7d4f84

SHA1
7f2cc93476529345d870c12ee8755948cff49993

SHA256
b35e18fa8e7b2e5b0e74afa6f41c80f907731a89039629032a8705a4394781a9

SHA512
184cd2627ed7189837ac3cffad553b0cffd72ececcec421e60d7d481a850ccd48eef259b66aa1ac235b9aa896b2c0e40e3c70725bdb8c204540346eb2454f120

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB07.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB3A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit