8c9d7345935d46c1602936934b600bb55fa6127cbdefd343ad5ebf03114dbe45

Analysis

max time kernel
118s
max time network
167s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t-rex.html
Size

80KB
MD5

16911fcc170c8af1c5457940bd0bf055
SHA1

eb44540186285271130b056fa6099b1988319fc4
SHA256

dc72cfc1f1d2a5013bb9de34f8cacf5e26e542d7d713fcbe09b865b4aaca6ddf
SHA512

131a00b7895a40ea0fb355ecc5292b3cbbcd23b45dd59b07da1b8eb86501ff0ec698ab5446687cd7ff5fba03d97b7a0b6e47196dc284a51c677cf04dbe13e393
SSDEEP

1536:V5OdudTTa8udsB7g1BuqHkFT5VgYzMGgbJsMPz:Vq0y80I7OuikXm3bJsMPz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403204511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f000000000200000000001066000000010000200000008fa4876c6344a05a9be4ac68e1ebbfb07288ad30d3f3e25450a6859a9e79248f000000000e8000000002000020000000561af99b55e08a5903fe85afa2b4ca4a41a5c3c9e3b317deabf27895e8c2fd9620000000f38c00ec44ba4d743fad60efc14b86bbaf363e2e8788fc431835c77694463e2240000000f5826960dd84d68b7d9fb6918c95a0e37211385e28b7bb85cb23654a55254b6167f63410e91306befe7e68a3f4eb9972a5357131dbeefbd9969298ac9cb3230f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a046a03962fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B5D0621-6855-11EE-8B15-5AA0ABA81FFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000a083081a06d501ce13114de2a5c42a62db3322a8840a5bf7668b404fc12d969c000000000e80000000020000200000003ea49605ca84a75a3afa06d906c8e8b988e41de7d4cd225fc2ff8122663692a890000000f86fe02c3bf59e05695d5945b024e8ff580ad948043bb255c27f453b69fc3326579354afd785098c44b154782fb3803dac6d9a9d364d7cfa9a2a7b10478ce8847c04de347c4f3e3d14a7c5724706f32d1cc1122c186f5f1fce0177f6a8eac23c4b2bed40d8c7bab23adc8bb679c3f3cb6c4a97483767ea5572f59c0f210bc48e21c180775a73c38b82bf02cd162806fc40000000815b92abe1c4155d175cbe6a27d8f1fb14a2b893f02ad9630366dd0ec65a2cbbdd2c20897bb39db43c36d64d8ad7ff1cbed09d0eb7de4490d21df94f6c5a158d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1892	iexplore.exe
1892	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 1892 wrote to memory of 2384	1892	iexplore.exe	28
PID 1892 wrote to memory of 2384	1892	iexplore.exe	28
PID 1892 wrote to memory of 2384	1892	iexplore.exe	28
PID 1892 wrote to memory of 2384	1892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\t-rex.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808a01903fc273e544793c382a9c8553

SHA1
abb72ba4f98951e45e80234eb1e78ca46aeb45f9

SHA256
601487991263ba3508c11e70c2aa08421526edfc206e37ea6806f855ec336d23

SHA512
a9c6777f6ea9307c5479366665a67e65958752fa696695e83cac02a9bdddf7a1115487eb541ee448f3c1ce6c3ff811b3bc9d7fa512120580c1f7107f512e3237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d5f2347fab12315b4f07a4b4489212

SHA1
c7bbe027139cc35cb91244842e11a74612e9a84a

SHA256
908542221d14ebc259b218b10d52513a8952cdf5ffc5937b80ba1eeaa4409347

SHA512
6df58bc4498932713015517e347c5414945fc555883b689838568edf6e0b7725e311e428bbdaee4c0adc5ce35f44850e011ea9a9675d64aa86ea196bc137a69e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4161acdf07b2de28330427004a4080e

SHA1
767203edf04ab5e21c75f8d06c81513c1e0ba6e8

SHA256
1c09b8933da22bb14622ac60e871ad9ad769c3ad446d17cbc13e8649a4171895

SHA512
d4b8d8218c5198401f1715777d8f56d2490cb40e443f46c11ff8e2c5d9c247b4c40b25462d5e1997dcbf9c1d8420f4b92c0225b1643fba4ba635bf5f5780ad32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616b4735f37f0b4d5db533b00ffafb29

SHA1
9e62c36a3754d856c546c035a042ab46ae427505

SHA256
22f811b387c4839d844b99dd4c7d70e2411ffb1d3f66dc582c747be784e76371

SHA512
8a7944aa120c09501b28f6631c4c38f255320ab55c4b66413c8ea6afc26a6f8f7620e1ea212829cc0397b8c02d09d1d680de9a48f35ecab3281ba98546da4142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f996094975ec63f3848c4d503ace541

SHA1
24b49c3c1b81f8d04449fa22dc4db44ed1b82765

SHA256
8cf90fe9f3f2247d727b54f486764c3a10c08a157d724d83470bece7fade6d6f

SHA512
4ca292b811cd0dd4e9809d52c2cdbd63f793c18176464dc7c9b55e7cb65cf441781f55bfb899e3c0d0ab979498f40cc6bdebf4c45be401dd71ac22958f06933f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a4f34e568383969d0cd25d6baff118

SHA1
755e57dd6c7559c8d58cce119d38141b6cb7e3ca

SHA256
6b071dd4ab66c41fa5b46cfdff12cd5d6be87dbb983507d9b7df81f10242088f

SHA512
7e5f1f19b007832aebf76c7aa72976df9ccaa9b68a9b701c047a493677d096acec18a307dab690208b89f1e0eaf6cb320d02eef7f0d935fabd66dc2ceaf98782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d7069f19b439b404ff9c0a0a90173f

SHA1
313eafcf40329684ec941aad2492c9c5fb70ca3e

SHA256
9cde480c0f33f8e6443b41f636d3cef6c6ad45c93a1653d707cc9a02b336888e

SHA512
5891fbbbca236bba380b1ba7a897682593b09ab497f9576455eceb1b828cd1717057941f45e271e237d7c092fde15ac6eeefdcd03ef5ebafa3579959fd01490b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75881ad981d3850d4f69d3ccf55ae69

SHA1
53a755c667d1319abbbe58cabc9d07c763545fbc

SHA256
a0b007808639cd8e21fb6b3ada90c6409b76f67f6a41d97bf5df803dbe0c733a

SHA512
207a331f3dc2c89800ece3776bc6dbca2b166e6f7a9a6c499bd7437cfd51a0e57dbcbf9b5b0c7ae1025c3f799f1e4deadc5abe978244dd596816a35a6ed55cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b97d7800373197c84a7969bf0e4c75b4

SHA1
448cb64a116f4582cf51a7f5e7e9c9ac6c748c06

SHA256
f0f7c2ff20e795de21f471a5eb9c12385ee5dea687fad5cdf642e7758d4d2c43

SHA512
8d14396016a1cf0b24f20e5b5b98111d1c95b98c704db7f6c3163574006f40716a529120ea5393ce1b9de574ece482a308f896fe1693293dcc83b584acb360a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fbd36e2f8066c9d779149b4dc9a6f1b

SHA1
306dda9e6f43f3c3820921c2a218c6347cbd2c93

SHA256
08f89b81244f6e088b2fe7ae46e59d001f19e9f3c7ab87019656456b53bf3349

SHA512
8758d7884417e10e21f7a9ccf12cd625b5876f704b6f333924c212da1f065211dad49b018d66d8726f75374fa0e5a39dad355c9de75994b9b8032df85ebd65d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95bcb30bddca88358b9be34b80b5cd9c

SHA1
4ab588b97b83174713e989b5a2501ea1f318517f

SHA256
edaf0ad42f3ec170f2da25b70fd4392ef5b64aa4634ee4023d0980ed809c1295

SHA512
ea4871bdde4c3ec4d122eb131bf4d0f59c6f60c999e63314515ba12da7c9e2640243bb8bfeb63f01805d2417768d653d94990aa0e478193c8cac29b4bbbc0f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ea4a3d143586a764963049ad30f9736

SHA1
60ab1ab1060fc1da41ecc994abeb4741f83bfcde

SHA256
96ba76bfa35bc51d1cc0bf6973fc5f69bfd05e4bd6cf3a5b5c0e0a865c09c630

SHA512
1054ad1ed6184333c5a40ab73be86218678ae4f75a3f04b6d525f289494280027cd0069ff50965b3d01b5c02c56201acd6fe07fdd387c1a0338fd47e47f57219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd80dccb1165e6fdc01bc887c4394352

SHA1
fa3503ffd7729e5805fb0af34757922aff58006a

SHA256
dfaacc2088a87353507b41117149bc07f2862800e5ef66ea8ecb7c81835685b0

SHA512
eb5070892f52944e033a386cf546689ef06e74e0b50886b36461223a4be6ce01acd650b90932030325989a2ed20d1f48a8f6590ef45eef1e9e29cbca074d407c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
550de8d7df56d01b5ee42292cb946942

SHA1
ea2493a5aac4877df6695381e6f4f8076a9b3e50

SHA256
82cfc1c75e4dfaedf0427df5a1c829c09d68be0749f912eb803a1f9784ef1028

SHA512
76879137b76b27ea05f62cf2d7f4c29c0325769bb44e7ac0374611251748d9f035f47dd4f1b9ca965eee478fcadd1ad5b1ea960709ce29fa7cfb71aa98b52e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
170b92652e5acd2c6a457dad04dd266b

SHA1
880bb5f6fa6892f9bc7c97fee1228335dc187714

SHA256
def5a6daee77ebb4213266364f9267d7e3f18bf23410994225626ed939a1fe15

SHA512
fe45bc9aa769e176942843e2a009630abe43d1241d5a97137bd6e9abcb45c5477b3872586561eb870895f2f6dba40ece4bb0188d62f3cf89b570bccc1b42bc6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8BC.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9E8.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit