1e8d9549c48831fa6cda54485e61338f92ed3d5058222602082d9517c31a83db

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

h.html
Size

2KB
MD5

69564e7c9c0633dcfe3d6e254f790751
SHA1

6751e0abbe1972dd094eec347fe6c3b3054888e0
SHA256

d6c9f2bc7661f6fa5b498b781519f5697ee114748a8806bb33741e5a2bc39abd
SHA512

1bef32f439d4f41e38dc6739e13897da03cccfd6863e15fee96ea2410e045b6a5e45346a1522a134d7dfa2dc7ecfa6e63e76677563f2efce0075e2038574e508

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000b812b2f032a2c49eb0780a9d44bc429ddbd0adf8ac324006a6517b7503917d94000000000e80000000020000200000001b3623fccc1ba4556ca0fcffbe2b928e52b233bf7aa1f30d9949d6e1cbb6544c20000000055bdbffe92d30f3f85b2bb8a4c6dd9c6bd8a1a90415412201c7ab56dd064b0340000000729a4e6ff36339a2bc0b1b2c310daf7fe5b2e7e86161e955853ebe7bdeb58bc79129b08bf2311828b94fee97cc4411af27aca86d08ab4a9033b173ac784e2baf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b39c14e3fcd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000d236f252b2b56535ac96e935d46652f2b076e717ab37dae6cf40bc9d74059811000000000e8000000002000020000000be63bd035906077377ad304de58928f51818776ccb5b937843cff6b61e1af2dc90000000c489276e103e83c18c899579f92b16766a2f423fcd9e07edc9c1ba39c337d9e17ea37b0284cc97257866212bbdfe26e6a7d36d23d7d0105e17f3e1a035b0ec9f67c04da103e05d6a8d95f4ea4d995753b352a380b827bd02cafd35ae61a74c74c1ad1d628b1010385a28a218c48657bceacf519dbefb2d85b1a5139dbab5d4e92dfb543586525b8135ca5f0374585f0a400000009f8ee816e13d09f86b0ed094ec90d93dbd6b4bbce6cf3f342601a5cdd4f8cfc53b85c8a4b20a10080e4bd67ad918f0fb7942f9c1bd19692be7be665d54ff5154	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403259857"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F9791E1-68D6-11EE-AA7F-F2498EDA0870} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1700	2088	iexplore.exe	28
PID 2088 wrote to memory of 1700	2088	iexplore.exe	28
PID 2088 wrote to memory of 1700	2088	iexplore.exe	28
PID 2088 wrote to memory of 1700	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\h.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c270cd692e8c06dd5ec5b0ae6a10112

SHA1
5dedf2a7ea8fc57fcd6116e959a88846c6920950

SHA256
dd38dceba5a81e308733445833aabfd9493eceb63248a838f1a8537cda387173

SHA512
d94650493d0212eddd6f59ac4521f20efaae5efa89d73a59fdcd91b5c199221c35d9af6d5ca6c128bf26040578d3d1792128b9b82bcfab52e111b8fa56c0f5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23580ef3bd98ec9d1f9bdc508fd27a7

SHA1
81db5c4f4b68942e6a45b7b8033b232b3f068e0a

SHA256
ed0ddad3d1ad6fcbf5aa058f3f0c858def888ebcd1e3a74834d6bd67b91df1c5

SHA512
d250541c0809ed90030be51d8cfb1155f8a7522a70dd6547013b0616df8b49631ec20141cff1acd04b4b11727e31f433e9685d0ab35e2efe40f32ab94b8a45ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7a00ee9fd1c83b924fb08a465f4a76

SHA1
14277008639dc836c5b042bf08b84c7ba7644972

SHA256
05f3415b979018c4c1dd729a1e24472eaa30d58108bfac45a75097b622c2bb24

SHA512
345a679853b425e952b3e767226e9225c6630381bf31118b4a3e23845d71c366dde393ed22d5341bf56e7ff7b67717380bff6642b72c913b0e1b787171073a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ba3380f58017b874417bb4affc37a5

SHA1
4ba159e338630f061bdc37d0d9207b0a82198763

SHA256
01711e8acfc66f6704b675feb4c56557f90f3cefafa657a33356170dcf0afc83

SHA512
9a36eaabc7d055c46fd20dc215ccd4a52e62fbafc4ca23ab607703004c8132ddf5a8897f59dffb38693257baa59511d7d067afb84fd5ad0afa5ef54d48d7ccee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da48f79fe0de4e7b2f6afbe7c0096835

SHA1
a92a5933b747db74e40726bb9f4d7bc2659abf50

SHA256
f728e2ada991b460478af45d130f448923e74737a3b72641a213d7fe0d975685

SHA512
bdbc313f908b049f1e7d49b09024a75677a0e00a6d8aa4f9e6e33bab650742ff0c73c73b4371989143f29e50763313d40ea095f5d40e9e604beb6a1c53e319c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc94496019053e388d9d0fea4442066

SHA1
c0cda3001477596bfdad5a8b6ed73016d43c8e99

SHA256
235fc51d527be195d1576d59f5636d1f3429823aa219b032d06d3e89a550705a

SHA512
79aff7cd5df43a03b615c739d1ae680d7c60acca506f328d241eef592cd6fa54f4abb646bcd93e5fc9bb66aae3bbd894c030d3d712f20d271c869fb5c496be52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29cf580e748e68fdde53ea628752ae4

SHA1
6ddf4c01283ff8390b4b492910c1e3ca7ed5784f

SHA256
7cb5e2f90626420807fe59fedd1b1579cb29cd57b993de4fa2770598ecb17a83

SHA512
1e551e0035e9278d852188d915342cfc87da6b4047be907c82f29f285cc02e9ebebeb6ed2bfc39626e783205490d5c428c65ffb4a63dfa58eee0391befe36a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc8d692590f591b5cfda18323911389

SHA1
c571bd74c39aa2c639608540ee7d38c8e364f263

SHA256
020cc62541012baa4be24d1d476f0a34c55893a9797db56508f0acba6ae89efc

SHA512
03fc0353b5214e70fb189a897709744d0d5a24da5889f4ffc5b68e78e89e4b17408e2f62d50560624912daf33cfd72592b5cb12063f0a4cb7b1fd8e1c2ff638b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4b4b91bf213d7ca04577887e00cec0

SHA1
e312962e3d00d79eefbb9c5793837405a4d5226f

SHA256
aaeac5b89b25257d877d730ff4a85d45eab44e11ffbbcfa645ee5c3a400e550f

SHA512
00bfb8390de5a67d4d4572c7df5e0ff5cb8ea53ef6954dc4849cb6283d06aba3cae39f7d4ce40fee1efa403e45eef13910bc7bf08ca5da0d6e351f69f7d803a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b43ea848cd3d40af8a2a7456ddafbc

SHA1
a53b7835e925f44eeefaf2c29376d04ea59ae350

SHA256
0aafc77d423b086c39189a7c7b3a5f0b4caf92921f024a9fdeccf3153abf2175

SHA512
bb4da35c36bb4880aca313c1df3b976acd9567f635538debbb00e34fbe08f661835654e7aeaeaff1b8b4df0f6066f9da54d5f0be172ba850f89f1a626cb90838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c2f0f19ff21d1219347b0e9bf90cad9

SHA1
1593c8211755aaaf2f6dee8cfdeddbb900673780

SHA256
5e34ffa724abd80bea5bd0814e06d37e6004b2e461ac51b7e80898e3ed9e8972

SHA512
6aa4840277f64e04ce81a0f3bc6728a74c3816561479d19047a54f8171ca5d9aa9eb26bfdcfb4e7a44ab508e68713ccc08666be89620474a9f2cfc173d843e3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee42bdd1c44f594babd5c133167e6a9c

SHA1
ce0f77fcb5d0493bfec71be2e94f722a69711627

SHA256
96be26685c4918a0a65cff8bacbbb3a5a7acb25bc5138441915f42e17bc05d91

SHA512
000a251788b35db8d5e59492268ec2200f6bed9255753432742b0e42aad3c9c5adc5a97d36a607c5f04e3efbdd3f4bd0d2308a1325be206a78d875e855c2d5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71b60403ebbca217f8368cfbc1e0559

SHA1
b5ea37c13a831f51e0006eb6f1faf1eeb627451e

SHA256
e8612918a2042c3a0873e8b9a169ea195b815fb439c7d7097eb8f40e0a343ff5

SHA512
351fb3cd3221540c73981273aec282fcc407a095ae72b48ad3684678f4f7d17a26410b32bacb251b2737619885f6f8ff6c16853841e16d139354f8fcb254b5d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52C4.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D86.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit