23cad65f6c95ac0c55b0b2ed28a59cf9b12b6322553acb60be208df88ec7e38f

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

licenses.html
Size

1.9MB
MD5

c1dd1a66d04038f327686ca1afda7d3e
SHA1

d53f343490c29c1baa7d1dccfc488a0ba9e200f0
SHA256

463557eee593d298b153d0f9c3d43b9dbb19fc26c0dd5256620242ac9a638335
SHA512

4f63482acd64786a7c52d4de19f531372bfd35c007901751cb783154ff903aa9799d19625b6bbf71b8e7ec758a33213ced6dcdae6b26e7f749aebca7c25bdfc4
SSDEEP

12288:g03V34k3P3D3A353/3q3w2w2FDS303w3e3w3a343H3S32323+3n393C38303J3lm:NJE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CC90491-67BA-11EE-8DA3-C6004B6B9118} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d09cf2c6fbd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000008c554e09d8bb40409e2f1353612bb15ab6f6cf5b909b714bc830bf039c374826000000000e8000000002000020000000c7d528455ba0c1ab869e8cdcec0d59372b4ca36aa5d4a4baed675eb0598b0ba5900000003fa86843f95b7513da16be9a801341a672615d7aa0d63a4931af47c143322c0675d3c0ebf12c0d86755dfd1e635217dd30f2d9e94b25ac0affa416327a7953dd6bf83c13d744a64fbdf3ddcaed74917e9cdde33d3e586f656e01ea0d9c6afa88e7844a920e981cf65be4ef3dbf594d5ee3ecf4c8256df28d34f65825827de1cd497a5dc06ce1bea1457340f81f27836c40000000475e319e8e94b32197d9d1d74a627f90d076ecaa540c29d37846a599c2511c6ab4a8e55edff956d4910e7e31059e6af7bef99ebd994e285c9c025c920f3aeee0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000001fb27a3187c19e2e81c265785cce24c43c9be50c4d1156ed3bf1565c5982163d000000000e80000000020000200000007eb489a1c5e32f55405eca4caba8534647d099a73bd3fddd12a4df4a1f78bb9720000000010c750acd84a2e1adc1750b753318847ceb23c6c98150eb7cbe4292d2bfbada400000009a56e01cf20ae6fffed69cb113264b67fea548ad6067aeb4fe6091925f1a43c6a94a4569e33ed1b55e075e40da4d5e29e85541fa4388cc0acdcecaabea1d7166	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403137823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2564	1916	iexplore.exe	28
PID 1916 wrote to memory of 2564	1916	iexplore.exe	28
PID 1916 wrote to memory of 2564	1916	iexplore.exe	28
PID 1916 wrote to memory of 2564	1916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\licenses.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f7b9d34700e6962bc649abee0fd9203

SHA1
74c28e06bc3427771d22eb19f4903001f814c015

SHA256
0264db66a7f6a553c456631a57552b51d71d24ede0852598264fddfe663d7420

SHA512
3fd2f8d2acd67e77b6ed639d16ad30d0b9dc9db899e12c0ab01a7168ee0fddf98d6f28e35b36e775935a4f493ce1a6914e2cadfd8ecbc950ea36efd330e38137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bea75eade3cffb753798f3abb47f6eb0

SHA1
ecbaf2b2c90f6933ba64fe77bfb53909d4737f7b

SHA256
890fc90ffb22d358234f9914d1d49b16d4cd90bc384d279c66d1b0b30a30a619

SHA512
6fa1058c34c523a2da916efbd6325529247069c3ab74ae947bacbba06edea5926b976a52575d81639faa1fe453e349d579aca0b73f0a065fd58ec99183424a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73d30c7eace0617d82895c1cf65380d

SHA1
02b81963be66bdcca74ac35505c90198fbe31e57

SHA256
57bc4dfbd3feca0af18d3e14590386b6704bfa29eb40ef5fa07bdd8cf0665a2d

SHA512
d967199c1f504292ede2ca2ba50569b8fe7570e1618062e865f4b8ffcd74ac863197a3b210d4ec6d8b99fdc6c954fb743a0662eaf021843886f97621556e7312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0e4971cfdb04e3679b5b885ff24e975

SHA1
abd29e544d59353310b9cccc504adbfef79dc353

SHA256
73634abed3208d582e116bc3df781b5fad80fdda36b596087e6436ca966e91d3

SHA512
f080da27de5fecfdc4e6bda42728ca18813611aeabae0d8000e3fa2d85fb18fec270d065f828d9b58209a76f4f58aacb1e42e4ddf7ef8109029fa2b6bd104549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783497341df9e2e58fcce626a25901e2

SHA1
8eba9a75d76b584dec00be0bf2f3b81a99636f81

SHA256
41fe59589806230eedc7ddcac6228e59674df804226aa2f6ddf19d8dd6904dfd

SHA512
0d64869764ddfcf69ec946551404074c21d90fc23965cdc93d696e9739c9cc592e9f1feea636684ea0b3692bcaf429840d89445c93c14fc08f0d120daece41cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83bfc0e241314d198b179b7e0af8ac8

SHA1
99c58a063d7e7523cc41522d7dc801fc91b05507

SHA256
9cdc415662983a47c8fc8700220cee6a5e91b390bdb2970ecb7d36d7c671549e

SHA512
09c4a4a8ce93a98f53c7af6d14ec370b139dbec22f05786c83bafb1125485dc515612c16cac38d856d2b2a112010d9900102228203552dd49018b09e74b47f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11ca35169d07a262a9bbd716e02e80a8

SHA1
4caf5e77680c13d90661cd5a9410e6e8d6ebcb29

SHA256
bd49ab5ca8aa8321e3f3997fba1a5821f4b5c7ad27ad409e697a31496099e787

SHA512
64796f19c8f06df3dc86552ff4597bb2c6dabe1bda84e7a049612a741f4567257f27928487abef30c934ddad0c0b84aff8e16b05c2113b16095cf60f8bce3ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f496d406b0f85fb5a8d9e0d9ef5ac5

SHA1
7ed77d33e68d0b079f2ac915c018c4eafee9c7f4

SHA256
90a986b5c8e4d2a0b756d3c1e411c9148b0ab8ebdaaabde9ae15fd974747ec7c

SHA512
2d1669a1e5e83c04dd3b1294691c2e6fae480eb5979fd2351a3b4d283e828c4c7f9baf7bc4ae5c21699cb3911e71305f6a3aad81ed3ea115540852e9d5be0002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634a789c2b4fdb684f49b45e3fc6b39b

SHA1
1ca8fd862c6d670d907f39ef8a9f18fb05c5bace

SHA256
028bdeec8a50ae758841948279c5ce5715768f1bdaa15b123bb16fdebd28a555

SHA512
00d9176b9a6fe1e26d22294354c009e67be94a1391b20f2ce4284cf7ef93aec04a400fe1362123bf2d3938e8176aa6519218639426d2c3edea4eeeff47e6e620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24809a83b6a2a35cc3db303a393c4c6c

SHA1
159fedee1b1073ea691930b0b89bf7c170815fda

SHA256
8898e99b8d246c268e38faef36d9ee302c2b29ac1dc70cee3049d1e33e3bc8da

SHA512
193334c9b4d98900329f2f431e25fbe40e0a8f68ac4e14c727e2beca7a4cc11ee99ba8b5833da3a92e73ba4b524edd47a420a1d017b05a7842b076d5338fa2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb3015ba3447ab5d9efe070b7a5edb3

SHA1
2509490e2965fc36d9f9f7c949b9c76b3de72a33

SHA256
e74ca2a652b098277f04b6f0bfa17c1e8bdede611685c99edbc220e86834a40b

SHA512
47b492f2f5d68198e0cc6d2a1810b4e3ae1a3caff027f08bce8f80ce38355387e40cccc79e30ddb2712837c98ae48188d37f384ac49af8b4d859d1dd5105daca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4047fa51744b992fe0e794f4f314db8

SHA1
1f6e903074481ab57be127cc5c0ae21d30b516dd

SHA256
0d1c735ad9a6bd435ed94d13c9cdbf3374f0c382d947af4f8f3c0a8100bf62cc

SHA512
35f53b93750d841dfb68536ee1cc32001e84a1c8a5fb707fe1088c510ea9b2cd88f473eee2fd02e8820c49edc2786c540a0efa4e75e05c6b281825d82b2ee014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9a296ce60c9f575a12cc0dce43c884

SHA1
3d262469b68235ec679e4ed0f9b5afc94dbdbb7b

SHA256
e442b78e48d19c2d15335f02d2493862c331c728beb13087da875e5a05bb15a5

SHA512
abcf7a27bde96e043bbbe75dfb295d8693b853c742be0800775fffab9ecc40709207f94295b9d3caf0ecc6629102d11bf5bc6485f3c8e37aa655d81a2db3e583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f3ce65124f4c63442570aa7a7535be

SHA1
e308799f605bd0d0731be3968bdf6ad9fb3d4be0

SHA256
f86136777174e97b789957a5861a510bf3c7d4acf7c03d0fa748415eb7733004

SHA512
ff632e615b6d58b092f9c863a9f7e4701582e4fde06380dafd1ad972e053bffa0c45afcb19be94174c34d6f5c3d13fc27886627373c609db5831ccf9bb9ecc7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3c7ede52edf3fde8bfdc780a8638c8

SHA1
8903680e967d33d39c93180c57d8321898ab54c1

SHA256
d313a8423a036e82b00a71ad4b372b50b8347b650eb0e71e5717ef7361f92822

SHA512
2333a7cb465b190924a68df8b4015b1c9aa40dcf923655ff3789bcf4d07c9a90d889b4f6a618d10db2e6abeab046d6b8bf6c63d34e3695ab5569c585498297db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29f265b3f2c063c54632bf662f33b3b4

SHA1
8df79ff03031f772943d2cb94e6327c22389639c

SHA256
48369474316b24801d4773ae5b7feed6321d73e5abe4d689f50b42ec9aa92df3

SHA512
50f9bcdea59c6abf9feb148c20f836bbed18dc0b16fe2ab449fa6b190e53eaa283b710b74cd742095a5df16944c2079148b1ba3dbafc00b8602ade882be738ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E09.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AA2.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit