1e8d9549c48831fa6cda54485e61338f92ed3d5058222602082d9517c31a83db

Analysis

max time kernel
149s
max time network
163s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

i.html
Size

2KB
MD5

218c5edf19a0e00e9a7e8b2c10c0f1c2
SHA1

126f6594906b57e35096fdf2bb8c9bef99fd3fba
SHA256

29e411c63b4d1e2f834366e02b8f4684226fcbac4cb1478ff4f8fd7fa0c655bb
SHA512

240eb2cfb08b103bdbb154b2d3f7bdd8a2f7a68cbf7d16cf74c9710392004ca2bb157fc16492cb049ee3a9c949f20d0326959b1b9775992b1399b87ee43236cd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C6499A1-68D6-11EE-86CB-C6004B6B9118} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403259860"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000028ff1e3e24957ef591ed6c3c7f46fa6349fa3a878db4376b651d2dd437d7fe49000000000e800000000200002000000036d4150708b4d6629a6493a315b27153d5e9054e412209b9a40edd8ac0f9d5019000000062e9a46d048bec2f9ea1dd3b53a34411e214697e923fec2eb95a60d2a400b7221e662e8ad2a76fabe9717ca3ccb8244e1d7b42486858e177a359b5720727acd80e03abd02d10af039e3b00a5edc3bbfbfa80f021045fa44ed8952284c4282698266329504027eed216c42f54b59de3e3b14c0f1ed962187e3cd246d3c7c6b5e1e3bcc17ce72dfeeaa62177f148046c1940000000ecbe623dc7964ae2ca89aed324b5dcd77a94d293b07de34da2fad03947b0c628e69873b2a6f76178e0be035490708f99dc856ab291dc36692a5e09ccdf199cdc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000015edd7cd5c2d9128330e4700f086a43fa4b5597a274cdd833a915ae7919cd94d000000000e80000000020000200000001d96d76727f72c00e5df0a4b762f865375e264f3e8355f97bfb5fabc5e1a9e0220000000116b200a95df67ecacc81845158850e7421cba52fa272acc3075453612260236400000008f16136e2c1c217accad745150cc8ab35de6eed34069647e3ea43bb5f59bbf3226cd642582267c92d2e2e0a93bc273129a6f0c94d63f3a8cac21112d55d7e792	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07dd02be3fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2744	2264	iexplore.exe	29
PID 2264 wrote to memory of 2744	2264	iexplore.exe	29
PID 2264 wrote to memory of 2744	2264	iexplore.exe	29
PID 2264 wrote to memory of 2744	2264	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\i.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0a294d610ca7999938616547b73fd7

SHA1
cfe32caffceb348cae227cfc60173e53030e3a96

SHA256
585d2e4ef7f20e97010267ce21db4301c3950eeb68e63f2ef183ff6ec17b22f3

SHA512
86b7d35111b2f0e8c12a3911824c2934b75b5fc2e3bc8d1b060990bccf2e0d962bd94639abab53e85f07708a0470bbce721863d96985c2a0aca12a41f172f13b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25a3461c29673c015961f30a2f86ea5

SHA1
df070fb3fb1f3b7e8752737715ca2ac53b2a99d8

SHA256
37b97f1b0ba011d0b46b67d7a454e39ca875587bf63d0c54a1cb8e8a10b9bb1a

SHA512
021fd4111d5078ad84017b1a6cd91091907eaf810e4f69645a9eb20d2219a1cea8708aa7355bceecfc56a19c6fbdce9f0b3ca92ad346f328b1370a4c36cb2c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e29c9a67b944f04ce97c7502a837d4

SHA1
a8a4aa6f8fd0532b6d993d40f030c0ec7e8fb9a1

SHA256
535738c9ce249b551a62c83658a2037db9210b675e5498c9d32ff95f5e122d31

SHA512
1e10054911baee91223dd5795d70f1113075c0309975436a23c2f604dc521ca2502cd84c37eead4ce46e571a70a1450036808bdcd1b0751a39931376c41803ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454666dc557f95ad7117723e12f4c7ac

SHA1
edb3bc4951bae9c5b85511a47870382547509137

SHA256
ab03a8e10f458667b3c7580f73e5c2c0a7178128271c2c1bfd46dc8374050c89

SHA512
16e3952d29ec20b09191ece095db54106e41fadc6f6b94c248d00b7a85d9d9ac60673c0adcd7ff601d66361a7e1a69f30e93f5c7919fd7a5516d34c0ee93b281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c59eab068ecbc573cd23251cce0521

SHA1
3ed1de6c8fe0934f58426a10f131f2eefccd9a53

SHA256
816906be63192f12996a6e6da71a37d144e94396a31cf9c8195235a0e2f3ae9d

SHA512
24bf7382ed940ca633f6c116b709c162feed738bf9b1b4ce8102c178a56b91e32fb8ccaa88fa3ed99ac3867345f6ebb284672556ad6f4e19906da3cb90e22bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6669d1bd435376beb42f612d6099341a

SHA1
82ee38069d808a5a7bf469a89df59d3610defe64

SHA256
46a1b0039cfd3d32cc090b0d994431605aa6cdcfc66fbd675363cf883448dcbb

SHA512
828a8376b65ebb4a9babaf4ebd4b92431ad77a2a21df5e15c8bf6ce440b2161d5927cd68117f3015082f9d8961903666fbf7b6fe9c5223bab80d43754f49f086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c433798d6d1070363b981649837729

SHA1
8ccc6286d7b0d6ae949ae8a9b42cacb948262b20

SHA256
70c48f4e3b6fcbd142f35e42942c78951797c9b23a06b9c582fb397a8e4ac00a

SHA512
6dc24a63f4f220ef5b33539d05249b52f415501730e67e68dfa7354e0ded48e05d4aace8e24fcce5bd5b736e31ef922fac4382f7f5c6b1f49f45ae2b73775a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75eb568488b33f1c91cfeae153d4cfd6

SHA1
028bd1f3b1da35d2fadc87b061f71178c9d7cf7f

SHA256
faa12582aa4f656da277929eeb9038c7354f38fc1692ddcdd8b78bf39a6b2aae

SHA512
ab6659ec405bbd6d752b7782327d99a511dc3d90e047564013fbaf47e451da9a5d33252e36c1e7b0cde0d542d7cfcce775ba033ab9c7b8e6d6b7124dcbd5eb3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
558e488b6b0f5263dedce03ba27f76c7

SHA1
7639f4c9f52aa2d5f58b7a4c420b83ae02f7b150

SHA256
1aeaa792bdaaa8296a74e1774f71161bf6aa70777f222cd195ffba1b098a134a

SHA512
bd22ac4d0304b8c00c6c99c69ab16227dbccfeacdce8a7ac53730ae92d0463ac1bcd387dafe2e35fd64d869563e1af9e694d31408a66b5dc00676b0e5babd062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab733.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar746.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit