1f73da0f0d1828e3e93cdba67e4b811a0ddab09e16e7ed4fd031706482d84bf3

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8548215da9bc3fa053e973155fb99462a65aea8b9ee8f6419a1d2c11ca0189f6.html
Size

564B
MD5

551e6e8316330ea362856c8f4fc249ed
SHA1

791ff927a99dff2ebae3c7b2fe90eac49e1721c5
SHA256

8548215da9bc3fa053e973155fb99462a65aea8b9ee8f6419a1d2c11ca0189f6
SHA512

eda2d472d73436940d33c4caaa75ccb160fdb001507ef1d481d4e98d3084160c4983409dee03538e16a0c77d7fc85f2ebd16b13bb408b44475a7ebea73f1eec4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000f0c85440e78213a462c757168813d59c4723f46a820d6e306c721dddff966c41000000000e8000000002000020000000363f1971ef17db16db7db0f06e90cbe0700e856736e25e5b79f06417f5ef987090000000e236705e5eae0a14de49b473fe3f91634d4201569c00845e476ed6045abf0521b7e4e8bfff74d16dac15d0751907f40cce536065f2604c5ec7ed77b01994d60c1c22739e7175ddb32905a6225e904f7379f36cc1c6401ce7c00dbb6595de6dccd707442a8cc86dff7a104790b9297cc1020dc9cc06091f9c67cbb3050b23c5cc1c9d23c7681431a85a313986c37a7a2040000000f5909d4adbbabcd605ef5547f5fa6247c234bf606b6dd3f9bb277e6d044d14e85675025803cb4a5fb622d1d5a185fe194ea7c64b49906ff6a33e46f27b5e19a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b000000000200000000001066000000010000200000008ff5c8fe1b5f57302133c53b814877e1ab368f4dd464dd5ce32a9a50ca46eb8a000000000e8000000002000020000000c8f0b829ccea817a81f2c051b9f749798ed41648c378ff92eebda7a3a2521346200000004231c7f44dc34d1febbd3d92e76c9b8820b8473a7abff009edcdd55c1ea3e1ba40000000a1ab226717f2ee832dff0502a4f6e83944bca92bffffdca12505aa1f2071fbd4ea4bae94a350a3b56fe63b3bf12ca593c24b3a19c80da1ad025334ed120abd65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F3E1BA1-67F6-11EE-B710-4249527DEDD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403163783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b9f56303fcd901	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
2372	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2372	iexplore.exe
2372	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 3060	2372	iexplore.exe	19
PID 2372 wrote to memory of 3060	2372	iexplore.exe	19
PID 2372 wrote to memory of 3060	2372	iexplore.exe	19
PID 2372 wrote to memory of 3060	2372	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8548215da9bc3fa053e973155fb99462a65aea8b9ee8f6419a1d2c11ca0189f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9560481aac01ade45ede64bcb6745ffa

SHA1
5e95990fd1002e6abd5896f884f27b33e7a23fe0

SHA256
d24f44488d604c7e2eb2ffda2aeed887c1e17a0f99e865a83379a17959369e0d

SHA512
c67e6f5f17bbca2a1f37a9bf9a4d56b2bbb266cf18e6c5112743b626e6ed2a590b06d2ed58a114ea1c2928474f6b87d8ffa3b9f01172977610791eee7e1fa485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
23059a07bba7d9ac522b69cda2e013fd

SHA1
e5e3ed3e7be89be5c6e875415af6385f4c91ec2b

SHA256
e1bec3511081a2e9e2edfe58ccb0415a377f76da4ba5f8ccbc469d4bba88cc25

SHA512
940bd88e1bb970cc6c4857aa638290ad8bfe6cb71f6e8a02fef82a238cb49d638b78d3adeb3481539e6e08558dbd53b4fec8e7eab159b28d079a3dc1a3b26891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e3f0f3017668bb7ed0b19b33e760ab9b

SHA1
83425631963a0e599d9c30d87a24b66eb0efaa65

SHA256
dc0587a95848e4b0f64ec1a0ed90d7cc75479a1736a6ab0ca29f08ae41abc759

SHA512
7b686d454e42302ab4f098d0f594370e6129f46b1c36f17ef029f8002740e2b6ff82fccd002028bd9f07b51d2aea3eefbcc18c3dde1700f0833e4e972d910523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b92265ca5bd18291951e030fffc1be00

SHA1
ae3eedb90e93bb6bc285a67af28ae75a50f46907

SHA256
d76856c1dec1bc82e1458297ad45b2627fa2bc263e1337e44ab55756f37e2466

SHA512
71008f259adbb678f6f4b9fe729f4feb85733ef8507681f8d0b8cab877994c6f3ecd64ea94c1df2ce76afe5e980df9eab6f6aa00e1b4833a60782b033817f193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4e0534152c2eada99e2fa45213b2363

SHA1
5c8b3327cacfb48b66c7e5238512c4dad241e375

SHA256
e0c732a48a4cbe8249252faca20e2dab971b30b04e3d81fd54803b919b62e601

SHA512
0a505c15e3db6c63d42017e7e073da624727734336e4ac7a925947eacad027552bfbfec3c9451b1b07225741c90b0276e5580cdd9194a2045dcc3a26f12167d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
54eb284ebd9375ba705945a00565a752

SHA1
5d2ed4ea310e67b4ce1355b545be8a67037f7673

SHA256
413ca0ec461febffdbd6919085a2eb378dfc3a975cf615297481ea7a08a82ad5

SHA512
aa5c43099621cfa441f347ba5be83b7eafb93da2fe75e30a28f9fd81c79c45db0572bb05468b962e61436ea77689ee2749962121f71898c85f91d13e9a57aad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f1b8922c7b4f84bcdf7671c1405d94c3

SHA1
e0d9eab6e8d3cc9a4c94709572e0eeeca7fed8ec

SHA256
0d1fbddf59948926e411e825b2207ceb160353aeceea6ce71444c8e63bff2561

SHA512
c8daa7e052f2543c5c289d1fba99fc317cf01718ea6974491e10dafeb8044fc6eb5dc9edcb6b9f8edac1c0a084effe6a18dd3efdef54a0d21dddf677a34f3738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
740c647823c192ec5f63365f18cc0837

SHA1
528ae3673a1edbad5173f5d8bc57c7271e769334

SHA256
5599dd5d55cbfa0cdf656f94fdf1cb7158d1538b592c81d937b7776f21e3a8db

SHA512
26527926832bb418f4c89f5f4713238ed348a58fb5e4de07e586940be9bf39235ff3bd6928a6c7f6a56b5802ba9cf74b7c0b410114bee47e1d2ed06b15c3db00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2ffd143bb5e17c9859436a9aa1a4409b

SHA1
16fb23e908001fd6dd5facb0996f8ae4bd625f9c

SHA256
f551ff6fb8c5f3caed678bc8ffcba6e64563f6ee0fdcd4dd88d525c2931a1d33

SHA512
645ed922867c5b8488918aeaf44d36a2c4f64da667c7b2ff563625ef914772e8ded263aa3d685daeb1bc6737f2be043ae255df2d68ad63817a358b55749f67db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
462d313cac67cdf93864d6815dd4d4d0

SHA1
6b826560aa9319267f1abb10c02fe79b84900804

SHA256
4a97b50d61f18a05fbb0df75d154b1a9a9163422ece5e9440c3ffb4ac16880c8

SHA512
97e701abd1b42ec9ebc86a73c56b88e8d0fa21e16a140b96fb02b29e416abb86af76224e954ec7e09efba313eb35396826a050abca14b5e11c1f0cd9f2816fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
61ad93c16a2da981dd8c9f0b9318d234

SHA1
b37e57c5e055a903dee49db9c4209adc9acbc06b

SHA256
0f72688562781ed9340d8b2df378ab16109af5eb6a920d82427311afe303831e

SHA512
714a24ddc3cec65ba03357402aeee87b5a9b09ce863de7d1619000abc734f99476670e9d582ffce210d778756a615b5780404711d382b5be9d19edb7b883b723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd9dde52c2563f0be10abf8f1d409099

SHA1
358e5b758f57abc279e3d737684102a503560a48

SHA256
74971ae59157bb80abdb9551d5b8f4603d71e58eb6fa2efece3e0c7217233bac

SHA512
b535646904cd9b6904c58d03f852a1ae297c0ae18524e063436b11083826875266a3122631f68062b78cd36c4a27905f25e9ca5f93beef47b5e8012264fcaab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6a4808f3695b5b23a91f5ea78e2e00f4

SHA1
a8556f37b95d0fb8a40b0935cc963690df1571cf

SHA256
f88660da561612c2c6c1414cb4f72221397e3caaacc22d95f1dc576c8a0e738c

SHA512
22bec937b22ea919d9fb5725d6cd8f8ef8132c1aab8076f40e499a212109f7434dc64fb08bdcb6017702bc0c75a80c048c7117bb3e41377be780dd7e6bb07e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA843.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA895.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit