1f73da0f0d1828e3e93cdba67e4b811a0ddab09e16e7ed4fd031706482d84bf3

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9220be9cf7ec67ee50994e06d9af607d8973697e6c81d2db2e35379fd6562a7.html
Size

248B
MD5

df4941cd34eb63f21b231afff735b4b8
SHA1

eda88cfd7facd14b448fa4518b0a3f22f94966f4
SHA256

f9220be9cf7ec67ee50994e06d9af607d8973697e6c81d2db2e35379fd6562a7
SHA512

d84964006d41ccf4c54fc185cd99f4dd11ef6e835b92481320303355375d927abf417e78138959e8bc370b2f770798e91b6195d4f3499008d8370fd262e67e36

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b000000000200000000001066000000010000200000006c785310fd62806c85377e0dcd979f61816635e0466c8733aca4c15871e6ee3c000000000e8000000002000020000000c839f9bd3c16558432a8323a69e36b10b5a01e09ec3a0d8803848964884c322f9000000060e67260482bdae4b4cd9b288fd4f781c636e16f8e4ea92edf82aac74aa0cf2e16d06c08c807f67942b54248763cd113c157d23703eae57e69f634916c1af6fd2dfc72fa50a5ddfaaf5d0f060b2fa9f08315faf3e19e935bedcbf4c08cb3ff6984d59fac4eb7c1d7e691f6f4626894171407e0aa569141d731de1e743a6363a874a7d8da5b6475af240d4f4b08912cf8400000009aa29a5f7ff06a3721072e3986ff55a70ff66123911a8c9d7275478d1014b6d131fabeb09f2efca59a4b932a683eded18ea67f959c8cb6b5a5fe1673b06f4614	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403163796"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000196e515599c7e3a8fcdf77b706b812a86623843e2ddf001a68a8ee135f61a195000000000e8000000002000020000000a773ea93d98f8d0879758c3e0f9f1050cfe28d42d9e3940a1089c5dee81646db2000000050e4e084f67c2f81ac88b68f5a787115c0f14163cdf368544013b10f69723a1140000000b903a62d1dba9e007fa742e035483799b97b98d8f94c3ca4c33824b938ebdce7f4a7702711751f0ea19aafd1c8de72d177b379834e0268d18dc39fb69a11ada6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5050e16b03fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9732D211-67F6-11EE-AB7A-7EFDAE50F694} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2888 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2888 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2888 iexplore.exe
2888 iexplore.exe
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE
2752 IEXPLORE.EXE

pid	process
2888	iexplore.exe

pid	process
2888	iexplore.exe

pid	process
2888	iexplore.exe
2888	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2888 wrote to memory of 2752	2888	iexplore.exe	IEXPLORE.EXE
PID 2888 wrote to memory of 2752	2888	iexplore.exe	IEXPLORE.EXE
PID 2888 wrote to memory of 2752	2888	iexplore.exe	IEXPLORE.EXE
PID 2888 wrote to memory of 2752	2888	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9220be9cf7ec67ee50994e06d9af607d8973697e6c81d2db2e35379fd6562a7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1bcf5d479f89ed58e3cb0d5ba994ffe8

SHA1
603cf91ef55a4d8ed6c7092a22485299b6bb2f82

SHA256
87fefe04944efa46d8cb95505a243685054ec9ab57b74c9186a84c41a633fb23

SHA512
91aa3d691230544367f60632ce478acb5cb342c6ff46ab44c563808c2cc20507a7369bbd67ba5ddf2299e34a1995767f929d0a4a64570160e753677c9e54e0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
61205a260e562c33fcb296a9d9f65da8

SHA1
a639a1241124551e86cecf8a18ad17c135d1c168

SHA256
6ff872bad7ba6fa15d770ca6cad832dba81b900eafba558a7ead9fe41d3e7aac

SHA512
1e51681c1180813153a6d6f2a010e806a032f6f48cd01f20b5a7ebb4af1e2c9eac1a3033fdcf752f24cd4fc0f54fe3644e8a1f3e380b63f5bc33249eceb9bf6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4e01e42c1b1334ffdcb0780faf5561cf

SHA1
f16b2840632b5eb4cece11415d41aaca323b0ad3

SHA256
4332d452c0b87949ff02459962c066f4e54ec0e25a03de852913aad75a76435f

SHA512
0e9bb2977f16a9f77323df42bb2e6fc1207bdca46f25ab4e1f54f2b8de18edba5307e4257d6697d2cc53a7d13a73fce8ffaf6e96fd1ea5e3f10ec3844b1d7455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
60061d41533958a0f3aab5350dd550cf

SHA1
66ca55ed62cc4c7fbecae5be2b22e226198699fd

SHA256
448f7b0f6e890605e3f63e9d20168c0192a361e1acf56691305fae167c9d3dce

SHA512
19b53892e0bfc3ed08077f92fe91be8d9e33ab05597e34c982b6084fd0145ea1a56dc35a4a17f27ff04917a9bdc27f12c39a58aed20a5ba9c27ad0184af39495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
040976c4059eb2a094615cb9121c6002

SHA1
9db0ccfc0937c10602b806e3bd649529b90191d3

SHA256
8d0dc327b20c3cd1e63bce5facac1e9f246a956c107dee77051278b791bf05c4

SHA512
555cf51fbedc6dc3adb91d9c5f4e51b812a899e96a70cf02cd0ceb456ee2cb4406e1d2600946e103a69a7d960a4bc5de26a61612f793c363f84e357cabe40440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed592e7c126e9393b9776cf9f024801c

SHA1
8353455ce3a9a7e5a15a8339a490b8ca13ea5c1f

SHA256
0142514b7ca342f7aa1a622c1ef227c86d002ca2861124e49844d4d94c6fd366

SHA512
5fe8fd02aeeb550b77c5e34a271eb031f46cf2821592a16877e7d02efaf130034963f43b0a4256ae1acb723c1a3d6c2bc79bd70fc1b33f726f61bf6e52822327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4cc36ecb2be25b123b87d8cb228695bb

SHA1
9a9c40a837208516c204544a9ff312b278450be8

SHA256
3b043a4f3c3ea7f913f2105f5149765a5537926179667b7cbeb8a4483786dec4

SHA512
6fcbe3096da10cb5c26017c7ef5366c212e1d68f929a1a5f5d7ccbca9b11c90b172b85a37ab2544b3dd5c74324677abba6a236aa292dd70eb192ba8a5582af28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6443cee86f58cf97088b806501fe086

SHA1
442dd0426a38f5833ec7850599f8d0d7689bcd51

SHA256
414c67c32daf61854aacfacf59357f506c2f0deeddce04d4a122d4889e63b66a

SHA512
b1fdc31bb444943b88272e83a3ff5a4ba09b9f292a2aa7177ae6a1df6a6af32f343f1db4fe2175fb411aec5c07d30c80c7eadb1856ca0e8a6f9b57131ef0cbf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e88a5b10abc6d7cd0b0128c104e655b4

SHA1
2250581842d6c09a2573b8dc5519b0e58850342b

SHA256
d1f82d065fd40d1b465b9efffce88db949ae8e5f68f19f7cdc6871790ec9c88b

SHA512
569084c504f5b51658baf615185c0a153a5f678bc7026ec492f17edb96e97bcb260023e398fc76aca2c094e8c55ec5390e1f22fb5e192c9e64873d76c0e991ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fd20277097892c1ab042bd9b2b74909b

SHA1
47a17afc3ed8b1ffa2d7751404b245aff9f3d20b

SHA256
2995fe62953e879d76cd4c14e038196ee5e6b6b312b46699635ff687e8a61f29

SHA512
27a4413c6ba9cd85487d31271e286f2b1a05441ebd913cfb3b5c6256c4b4d845676654059624663409f6235c5b516b559f4e002dc720534c54ac1bcae95ba676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
722fd721ffdbc91f2db534c4f91d7b8d

SHA1
ec1d9f3c278bf3e78f60a516b4631c2d20983341

SHA256
c7ef3620ac46e8bc4ac9465fdcb3a15fc9cf36d03ea6505fcb8fb151f3a711ab

SHA512
ef612f9f58554dbe1a70bf02c2976448e7a358896c2df5051d349492f2f3a927c5b5ffb10ecf3f531b0402dd86855eae596ffb0f3a2e569e85d4a99f1df3474d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
712a6a98bf7f07f1242455bb07704edb

SHA1
35acb40b35abe11b3808d9b2dad94b2fddebdff9

SHA256
ab5a7ade723894f5c838126f264f25c7a1a651de5cf2bd809b4c27f1b63d35e6

SHA512
b1782566d8681141580cd3d8a2669dcf3b2f712b8c0358d4bc2ed1a5e42dfcaab23e34160a08864c9966b01fc8f37d3e60b6b4bf959f62ea6da39c66d9be497b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6238ad014b256e3168520dda138dc163

SHA1
13c2a5454b30316501b12f0f19e2ff8483f8ecd6

SHA256
2910114f50d1a58496bc10bbc84a6ff702263543b5f727925492807f0112682f

SHA512
e699094e938389a43e11716f1d9082e6877d93d421ddcd645127b5b96e913ca6c826f57e02c515aece0c4a50fbc6412e1f18c4dec9dc292a9e44f6c71eef9ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5f278202b6fb26e832de8da0ec79e48

SHA1
a1e3736f5047699d27f81f26071203139260983a

SHA256
e5ce370a9d90ebdb2b6d89980649c75601f4f14367d3818cc710e241c5dc2347

SHA512
aee929afb4741f297d9f641b3202783d609fc34abe11869d9effb19425ca40a0635cc7d83f211f021c72f4f5b6d5545fd6b20f36376979dfcfda31d9d7ffd70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BBE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C10.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit