4f25a05ca878bb55a683b3c3f14f4b3c1b183a74dd2c6c9054d880966293ee06

Analysis

max time kernel
209s
max time network
309s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t-rex.html
Size

80KB
MD5

16911fcc170c8af1c5457940bd0bf055
SHA1

eb44540186285271130b056fa6099b1988319fc4
SHA256

dc72cfc1f1d2a5013bb9de34f8cacf5e26e542d7d713fcbe09b865b4aaca6ddf
SHA512

131a00b7895a40ea0fb355ecc5292b3cbbcd23b45dd59b07da1b8eb86501ff0ec698ab5446687cd7ff5fba03d97b7a0b6e47196dc284a51c677cf04dbe13e393
SSDEEP

1536:V5OdudTTa8udsB7g1BuqHkFT5VgYzMGgbJsMPz:Vq0y80I7OuikXm3bJsMPz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403204322"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000ea00e773c519a58eb2f03653a5cc4fdffa73914f6d72f80a52c4c7bced64f2dc000000000e80000000020000200000000c91c85f49f03b5eaf08d9bae55d943bcbc52103543ba440e8004c13c99c52e1200000006d49abd367ecea5d2d3756969b480cb91c26fc7fa671eaf1039cd6313a806df040000000639b08d4cecfdd53bd2d59f5d00179a61f1190e2d8ece8c484a66441244bc0ccdde62e711d4a24451f75948b351c1365891b59e628c3466f61fba2f8ef42ba65	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02246c761fcd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2103CA0-6854-11EE-A15F-7AA063A69366} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000002763251adfbc3c0fd820a88b63305f3f47a43167752f51865c875120a9c2f5b8000000000e8000000002000020000000773da6edaa5500b091c7d39ab09ebaa16be254977dcc529fec39e435818694ae90000000557fa1e046a78d85ce9d2c8ea63f8b7c6523bf9e93342cd1436776dcd4f70df47aa91cb0de03494c0b850f105ebe91749eba1ae7c0a45fe0db1450665685b289d50c2a88398481e6b201ef95ee0633fcdbc4b4e4b269e3ccd1cf82ca2fb5adf5a06eed58abbbf1acab4bbf81e0077c2d572bec759088af99fbafc7e66dc5a0d21c01bfaa30f5ac4628a9b4234d3d2b8c40000000c0f35417d6b26086509bdcb53b15782dd89dedac7bf5385c58aef557e88b4ffb026dbe801296fe5373ba933e7542ab0e0759f268f40469048864125caf9590f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2756 wrote to memory of 2692	2756	iexplore.exe	28
PID 2756 wrote to memory of 2692	2756	iexplore.exe	28
PID 2756 wrote to memory of 2692	2756	iexplore.exe	28
PID 2756 wrote to memory of 2692	2756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\t-rex.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68f48d0c5ed18258fc846b62dbaf34e7

SHA1
3b403323d38209e0a7d22e14ce7b1540697f3ae5

SHA256
9d646982807d6523fab25d20c9a3f91198bd69c8d0451034a928ceb36c0ef124

SHA512
3e089d8d42b6d94d35687952f1a2880e059281e5e11eec8a3694e1bf36d99a9b2b7dc02eb8bfdfe11c317fdca91411a5b485cc3c7225da3e84a67b47c4c4aa61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
261c605551d54ad4ce352bb23a9272f5

SHA1
24e6c4ae27b9f7c3204f283314671db37a138afb

SHA256
9d32d39595f587d173e0e4136dd8de1771679c1d47beacaf33fa44c0e2e97864

SHA512
563543195a9260a39fe92a65a9fddff76c7280095246ced6518946257e8b6c6ff17b6b07214cc1aae42625fd139e0572153c2ccaee9b0cf00a53a50b8c666755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1834f5a0458aaea682f61f825573dc34

SHA1
044ef70fb4ec987b6be40f5b629df2724e9896b9

SHA256
2f0a867a0789b9a19fd2b72f2fd464f3d1c87e789d30938e9b7f46e0057108e9

SHA512
19bd4577290430c33fb6996210c360bd1b1ca1c61bab00d6feaf34782196b8c2f6606ef22fad852dd4028ca3792f7cf486d4d5d27cb7b7d81ebd5684303fcd70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37fb5708d4e5950289067f651f6046a3

SHA1
13a1d1a3559312dab8413924fbd91bb361a42822

SHA256
b9802622a10f37923180b00a5331d8b905251acd04b0ea86922b1645416f2664

SHA512
1ecfb0bfe4ce99b93d3e54758f142e17d11dc3bb6f9b97bcad549dd9f7ab99ba33660227357240b65b9d44958a62e5cccf5e4ad4808cab5ffba15b34efe8d394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75688afd97ac1fc32bf0217dc57800bb

SHA1
5b3519431104bed2b7ee59db85465dae452337b3

SHA256
43e6346ddd6c77d94f5d5905ab2fd8fc7e58d6cc24df0d7ceabe70de5bce41c3

SHA512
cfad790026f08f13b00bf4f40305e8075f6ccdefa7036675783d45b9a6ca15f18a38ec89a77a178e5d1227824af6a5e7ea9c1b47ae02b6fa3efe793b77b58c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a6d76dbcaa8107ed4ae7f3b5dd63ee

SHA1
277487a1414a5d3d1501c4726005413edbfad204

SHA256
20df354c116a9b23c406f38efe8c16434b8d07166c8f74fc521f9bc0d69c4536

SHA512
b82a38aa8ea1d2d38b15b92582f617632ca2917ae06f07af53cd2a3b428b8b30253ffbdcbe314d28204c75037ff365ae5f3e99936df89e964c995820ade0bb0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b706216ef72e7da969c36a46d3da54fb

SHA1
974b288c15869e3f3fa08b8a0375bfb8e0b4a414

SHA256
ecb53fda8e225d9708cc05786852943726e321fe6ab04b933827d39b900b5a12

SHA512
3889966db8b71bb3a559a721351bed9b8b8f40628ebd3fe50798943802f9a8b03924cb52b5aff8f87b5cafa602cd6554fd04982a51beabd0bce45c50379eac23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f14f3b471f55a54d38adb30354b07cd3

SHA1
f55cbf0f37c4ad939ea47c7afe3d200647dbdfac

SHA256
1af44c102e35fed444472171c2f06c1ce392e199967859711f42112c29db2892

SHA512
2f2ff20ad18ee30a7d8d6168257549c6ccd5ab6153ca437bb26d4c55b81c51120a5b625c084d36d6b9daebc25558dd3dbd5651a220f57f61ef3f78d77a0a0898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06afa78aca5e8c4fd5caa69455bc7d06

SHA1
d7ecb135a24798584a7401343b73c25c81f46b99

SHA256
c9a3412a0f0555ae7b60875f1ba403f418a76e310362b7d07d88b44a4693daa6

SHA512
8cf13e5b1ff989935b036599402dacc6776e646158119aa292e2172df899c563c9127d94cae8187fdbe8c7fbdf40aa7b7ea52fce35cf9e49a82fd23177890668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e6b89bb29a5ae7eb301033760ce1b1b

SHA1
8377ddf1215437845b378ff1259cedb10b13b482

SHA256
2b684ef084dcb9c1cdbce5db675601d63a1ea1fef6fc7d217676feada44abaa4

SHA512
35767b8b4a22c8aabe7c06426baa8a6f83a002eab33f888969e3e66add6cdede1e574fce6a928cf6c2b8f611de6f585dc634bc55ce14381556a5b39f1fc6e7ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a054033bcbeded273934e5a5d0e361b9

SHA1
d872ee88e6a071fb00ff2a94d002b7ff051969cb

SHA256
a5794a52bfc7673f7af75c86e92e50fc7a2faa3644a5a3088c35ab931b271c8a

SHA512
4477aa11a4d21b86b31f68c8850e2aefce0443806c557876dfdf72b8b2db66cfeff30c70bb9512a4533185f89657f4c5301c1fa2b101be8b1c61a2b4e3e51ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1806c4c8c0aea4b911dfe2a6bc9836f

SHA1
8565bc1d377c6aa89d827139e3e18a7aad6ea011

SHA256
a536dc66fc9f072d9ad0a5425033a7f9dc9b72ccbd68c66e2079853982436fcf

SHA512
2fac16d8eb573cf4a454b9e40bb39b7443e993aced6dd23539c953b7bec8477d10303f94ea5d1b184c16b02b20bbce2e1816be285fe06b18b6de700e77b46ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38905fb5fa13b4906a0d084309a06fef

SHA1
f20bbdc809102d716601c70c8759efb3e06024c9

SHA256
1c96cc41bafb5de4dd716dd90ac4db62dacd9cf20aeef42eda9dee58db14c795

SHA512
785d8e0bc3d377381925ae23a704c79be8f7fd5a8bf631e9e80a0a5cd8b1393d2f1b597030fea568abd9baa4bd6d65c4a7cbb8921b1b64c485518d94b677af0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3091623f4bbc3023b359c6e22cf7e3

SHA1
b43702d86be92db140d82364f99cfc8e8c537c36

SHA256
e03ceec2857e1a016362d3e0de384aff98d4025719493b8b31603a3f326a81c0

SHA512
29fe68905413e2ea35c535573fd454f27407cd210ee9097d64040f55502e1289b009202d2654dfb945a222d26acc12e733c68c44d593834c3445cbd822e8a7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f895453ed8798e04d7fee320825124b

SHA1
30013538bb505cb6ebfd6134a9109fd74e8ef01a

SHA256
64acca55a9f95cbdf79cc9478cea8bb018d049fcb839ac86eb514a855fad7c97

SHA512
2a67c416830d0e7be5c5e5eb8de8a11563a7714afa1a9363ba9c7b2a7450291536199ef6397c412952cd6a437aa390868cd70d8a03ce0dc0fe4d10308f1d0fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2efdd4ac8742b4ea8b58d7960811d768

SHA1
392e4e26e73a801f5499de748ef78946511fe497

SHA256
a7f6b55b82811bf8568dee63f044db6dc35d359622eb3f46ddbd8c610213944f

SHA512
5423585e38e321bfeb0934e59a272c42a4e43f26f7020c0888fcb86d1ca258509b56a12b19ff1c730ff7b21cbbb8844301c93759639b5f4f806bb9f18715d4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C59.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F31.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit