1f73da0f0d1828e3e93cdba67e4b811a0ddab09e16e7ed4fd031706482d84bf3

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f.html
Size

564B
MD5

5da4c1420f84ec727d1b6bdd0d46e62e
SHA1

280d08d142f7386283f420444ec48e1cdbfd61bb
SHA256

3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f
SHA512

7c51a628831d0236e8d314c71732b8a62e06334431d10f7c293c49b23665b2a6a1ddbc4772009010955b5228ea4a5cd97fb93581ce391ee1792e8a198b76111a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000f13b8c13e1272b1ceedc6bc8b30a243ba42ae6362c091efbd4b8b14c66eae3b6000000000e8000000002000020000000657741e990055873826282ecc03c7d964da613eceb2ab9ef26bfbea2a632833290000000938e64bd9844a1b1a47bf5fc8093347d99996727950ef4e573c3709c58c165b55aa48f8740bae64cdbfdbfb31776d1834feefc3945108b14f44b0ef1322a08ff3fb4951093dfd8d245f0d12add0d5520445001cb979c9f9c81544981a38f76ead313dfa97a73955b5e9e392b39a37a225b3a73563707d365c75b538cf7e409a671c465c908ddd3273210448cda1286d840000000a3f8398f7f38c23699518e9d34167f2e87d901f97ce3e536c884f896ff4dc91907d4dabd3832cb5298a451dd9e33619100fbbec49200a4fb60f8774af61d2e5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403163782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c80a6403fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000520e68edba45a4ebaf161ad8fff042b60e709c5828154c9fb4e4b6f381217666000000000e800000000200002000000031fc6a046509726d315ba09b5e8a310760c6b64a130503c7a36f8ebbfbef269820000000a745e2580d916ffd010582a1a1123e1955d3922339cfa563af41060c2e34508e40000000cbdd296797d5449286352a32954202b6f4bf00182632dc902f92eb7253d2a429c85638a45453e6965d73fd7bd433e23a0410cd0acdb96780e884de2ceacfc967	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EC64BC1-67F6-11EE-AFAD-C6004B6B9118} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2692 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2692 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2692 iexplore.exe
2692 iexplore.exe
2544 IEXPLORE.EXE
2544 IEXPLORE.EXE
2544 IEXPLORE.EXE
2544 IEXPLORE.EXE

pid	process
2692	iexplore.exe

pid	process
2692	iexplore.exe

pid	process
2692	iexplore.exe
2692	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2692 wrote to memory of 2544	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 2544	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 2544	2692	iexplore.exe	IEXPLORE.EXE
PID 2692 wrote to memory of 2544	2692	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
051fdac9f156a3a9034856baf0756b71

SHA1
b2ca0fe9364357ef619adb151003cd2847fcabd3

SHA256
8e5c22b1ab637b26d777c56d5ad74b352bd0ab0335933690f48abb9db0c032f2

SHA512
175fa7c4b36387787874251ee9c1c48c328b734a7c27d505e6aef1d965bad4f11e70c58361020c1a6cc7f5c1dc6e3004bcf2870b474edbd81e7ceddcc0eeca61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed3a5080a113f7361d2948afb428e99f

SHA1
230157840100de88919db0b17ad3e724cfb84f2f

SHA256
97164d12a3165f62fde082caa0a59a00090b9f0942d2a9ede42531a68e69ff62

SHA512
7941608f873228892db08f66e5b04dcf4794c83a8f08c39af77108c0d791f88a1e437dbf2f7549fe334faa3b4b4615e2f616eeaad1b8da64ee40d9fd404e74c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eeed971a10058da4afd5296de8663b07

SHA1
a37d14244f58f0b571692136a620d6b3e8b148bf

SHA256
1dd5baec992d88c668f401b510951ac89c1443cb95dd9c31d09bef0aec8ee76d

SHA512
b52488dcda0303b6bcb8938d87dfad91a74587816ee83dc1ec3f1c1712097adac2c3bfc825324b67484740e2709992c2d4069e47ffe40fd941410e4397c5b5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7df9348c2f00515004b89189b3025ac3

SHA1
b6ed75e51847cfed4263794aeaaab184863967d8

SHA256
9cd0602d2ddca0d386d15f6f0b964288a414e62738a736a02d8a9a65f0130f1d

SHA512
c593671017b080800273f892ce5865d534597b90362db6dd7f75b8aff6a8377df6e0c1439ca3c7ab294f06c5be41a0503e7452ac9bdf30c5ffee609378f8a099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5b21594137872d878c393f7b39c63991

SHA1
d7ba82534b5ea24e99288cce024e4607f03a359a

SHA256
8c3a38840367fccaa217968e012fb7f74ba06e3435e6a0ff8fb1427825a36457

SHA512
671d17f0f9e0c89b3a397bf108aeca60a49a4afd70a91950da70917eb3107897a9a628867afea2f6533712f0c03783a47b34e4dece58c74f39265a016306eed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d4f47c2cfa93799a45308670e03027b4

SHA1
5de76c6502e7fd5cd59118e346e587a805d17ef9

SHA256
d8b6a7674787a4ad338cfa54973f9653e186cfeeff77cbe5a48ae8ad8b57d407

SHA512
9309ce03aa26a75257f885ef253b2a8c3d4f229460726b02c617212e9194abf1d55fa0a296892fe94d6d8f230d792e0f892605a85496b5109aaa1eca7e7ac1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a46f6021aa91f1b9caef587c125043c6

SHA1
ffd8def2e05983eca1ef8a2c071e7e076a0e14d2

SHA256
0e267ef777a383712f18ed004772128bb7d16bb1816144e27fea0312440d5b9a

SHA512
d60bb367e2f85aa2ee399155d248465dde480665283d04509de035903e5d6a9bd64e302ef0a053404ce93ee4824a687000ce675587fcc304b5c3a08b51a58463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e8c76ad28a5781211292df810f08577

SHA1
707580e4f012f2f67827f06cf159e5f7138a2e59

SHA256
815f32a3aa15bc1d0caebd66d8ba07aedcd05f35628607bd1923bf2825d87094

SHA512
def899a867c4318fc2ce85e468752d793047f4ef3fb0d517fba8ab5690096570702f203eb1e20c8167c5cd8d94a5dc4faa58c6b937a91d933ec762197f786b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
62399bcc3fd65039ca6c2194e782372c

SHA1
45451eee708930b3f60526cb6c24490057f6b9a4

SHA256
39aa409d9ae00dad49adb89e3ded1d38f58a999cd20975884cb3fd2382aabe1d

SHA512
5b2c33605197ab5c3b636ce8c180310b71e9b48be1e3abe1ddef741095779cbecf4a9ad6d1fa82f580d581180926fff129f254372dfebbddc3801e4a7d81d74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7b9c887f0403d276f961b0de56e59360

SHA1
6d03db47ec35f2044c10df5fbff92323e7acaceb

SHA256
b0fc4a6310ea21b08b3aa0f57ef9dc3f03c59e20bc72e0e362c0c52875801ddb

SHA512
a705e991c8e628cef81c09a1d4121a1bc5d36a1d7e7dd69ba57cd86fa9231cd0d7039e16f766a0ee8f3685fabc089645a91633f4373ed61c9253e5ff589e02c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de253e245307b0181c59fbfe4de2b6cb

SHA1
0f190e724ce48c1a75d747c68df01096a5a7f8a3

SHA256
b617a2badfe628b9d90159b9a144ee05856690af8b08dc1879203960ed47b3eb

SHA512
5a46d1788913997633e7b576ac264cc27d2fddb0b585815dd61bbc554b046db181dc2a7a78990b832bdbd924788a90d284acca16ace897502232d9edfed59a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
614668acde245fe128399886871768cd

SHA1
adf0042848a965344780bee6dc1ccce3c2b9394e

SHA256
97c92c6454148b1e7a9514e107160fff0101df56979a91f5aacfc0c58efb4872

SHA512
5c6cebd1597ca50920f14d23a1bcf7881c6f516f52949c577d3d8622108a1273d135272a8fe9f0f0eed3e3b7b27222c08dbe838db94baa50c5e22b06a15150c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fb9b6cae49f8f8ce995ed9d492c8c228

SHA1
2ba3f478b2f9c094e5fa7dd7c7e8b7b89c9dd238

SHA256
4460eb2005c0118376f0f8781f34da45603853d8f541881227bdbf809d215de8

SHA512
91e0d63c1eaa19bcff484178f0cde6893316e5bad48d9aae60203d4a6312f9e389024c7ba220980004c1af51758afec423dffc084fa8a52a77338e9572d5f392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e2c4d47b0166d5e4a4b584f5252c5295

SHA1
5440802aec72fd503318af68a6abf0a75479ad14

SHA256
1d94ef042a7cc807a9c0e2b1d2b095f9697130e464f28dee42f4445c73f06739

SHA512
ae907b7f7e917d028cf44542afdc73f355b1934d1e9e03d99cb47eed96d9d9134b74f4befd1382a87c772a321804ca23ec12cea9789a4a7d3c3ff8870b5d4e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b3696ec51b17ec41ac1f51bb16aada30

SHA1
3837d820612553f9194be917d0bb39528f1037f2

SHA256
4d883c8818d340e8398bad9afc88aab1f3f40ebbe43248a0b27693a2c67b0180

SHA512
4aff50fa1ef1d23846534a54c1cf899fccd5d11cf52b244dceca51272c8392a7941b27b2df812442c90e139aa4ad4c930953f8b514c49d4aef2705f001ac02fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab957E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95C0.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit