f9a5fc335044e5200cb318b1af760d809aa01010235c8a7b0dcfd77ce0d2627b

Analysis

max time kernel
118s
max time network
199s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

1KB
MD5

5ca59d3aea3c0974a70fa422c6b3834d
SHA1

6c9eb1e7d43052194b11d9db8e850161602001fe
SHA256

af5120e463c1007205f96035d5ea5baff06c64b092fea1d7005aa074c6d516c0
SHA512

fc4d3187dc77d2053ae2ff40d7340db20995274b1c36131ccb8fe6f136faa395695d916ce4f32a45d517a063898f1d161cd1a7c68bb57c69def825460dd6ca47

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503ad53d6effd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef0000000002000000000010660000000100002000000094b106b6f844c670fc3ddbe92c461c846dd9e62735c4e9cce60ea4c8ac11be3d000000000e80000000020000200000008809892484ad70619cc840cf21a9ed889bd6818964f100a56efc98973a2ed7b090000000f780288a3fd30a5239f3374de7c652670b14a33487c9dc2e966af93991338023e4f112254306519aa57bbc64f72874010ebaeaa7e641c19c1a6f6a8b09ae61ae27617ac3d1fc10e7ba6a8e1dc304c4a9f5dc961ed2b917afa919d4a8907cd0e2bbb6306a93d12f652e8cc90f395afaf6bbefa84a767b261a55a17397488f1ffd39927d95b1a37b4a93c9478a3307d0ff40000000668b822fcea4090335b3271fe14bbc581d96f7226db9621f763426bc95a534757a2929123b0958efb431556f1358d7c234c7ed628cca7aa2337a81cf08ab0d5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000a706075c4d976edbdf73beae8adbae6d685d84e21dc5e48e89fd9e95bb6edb67000000000e8000000002000020000000158b990315a5494e4d9443a71eac5e93ae68f1f162cb118d3aa4297b4721599a20000000d367147deb3a415a483ed69ac08ac0beefca621f943f2eac82cff073bbfdd9dc4000000003e99ecc143b614666103bc3fb8f0aa5b1810fdc036caacbb2cc278070d378028c22a5ce84ff8c91a1632a22a2643b4dee399561d09b945851ce48bc3b5d55fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63746BF1-6B61-11EE-87C9-4249527DEDD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403539521"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2232 wrote to memory of 2712	2232	iexplore.exe	30
PID 2232 wrote to memory of 2712	2232	iexplore.exe	30
PID 2232 wrote to memory of 2712	2232	iexplore.exe	30
PID 2232 wrote to memory of 2712	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af752df4c64ea35f273db382db54e24

SHA1
562a1965c557c4cc230292f624606c2abda88b8a

SHA256
93ed3370bb1e844743bb170b9d86b4caa73225e717c2c3c1c8753c29339ef192

SHA512
09797f6207bfe5e7a08344a453edfd4884bc1b73174ff95e4bd4e52a26dd7f1ac64d2b5b27ac69b25adeb1d6591b42aa78c24d5ad95d7f5c7688ad4a8147c9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff99816a3a66c3312c791addf0b03b3f

SHA1
ac4f27cc4f62a2637393a02210262a22357ee988

SHA256
8ab4bb31234427e48af8f6faf785157e51b1ad3fe4a4bc8941e5f242688849b3

SHA512
63b68e1a058179fe169a4ff5c221a9e65ae66d408ecaa4e04809bbb09c676ae0d3b772f3d4a40a1d43f5b99e8da3c7bed4f7e04258d8ecbd5cca37739ecc24be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b0321a17ec985a939ae49eb2af44f5a

SHA1
b260ebeec8883cc08476d921077f0a87f059fba8

SHA256
daf042113105b601f5a5881fe29bba3950145e2677be775a2478c5b5a23e7b5c

SHA512
729f082b4daeb9cd08e8b1d20d626c60028e92e87102b429027e69a4277292c87dd60f9d8df9f42d997fb103bec5edad9e27cc9a915af56b94f15fb959e12a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffca58ea3db7756bb5bf15686766118c

SHA1
f37c723bc68cec300fd87dd1f18c518f8b1248a0

SHA256
df91880ce760f1d52ac3d413e656f46cd965423d23c0ba465030c566a6711e58

SHA512
936ab12178408acbb7f024361cbaeaeb4a274c19042c7a7949a60f88271047e53b0c8b0d3accda0ada93fc0df461eeba7daba39f5aa82023d92c9d9af6e725ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8185d7a216929c5e063c3a0bfd7e3c3d

SHA1
518544929bcf58bf5686a3537d3a1d08475c3947

SHA256
937473e100ac46c9089df260269921617c8da6b3cc4b5045c6fb05a6145d8e0f

SHA512
d388f06c4749fca56c205a4f7e5d08d710557d2288fcdbcbcbf5f7db0ef81da2f045a14368f659b27d86c26a0ff80b3c3bf11ea3ea65b627f1dc2a7cff2303b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a7c2d93e8837c94f515468cb7dfe1cd

SHA1
c1110f5dcf2d54f56b83603826c98a3f06a327c1

SHA256
bffb11059687dc92628bf15587b2bcd55acb1304342c60b63d221b4952833ec2

SHA512
824bbcd135ca5c085e841c9bfa8a34ad4e82c2c1506dd45c9b61e9156ac0d6bb93fdc4b7ad5f0982e09fedb9096fd8078ae12f4d6422b3142366d94b71b7a8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c2015ea1da2626697f463acba1228c

SHA1
aebe9a290be332852c1e4a6e1ff6853095717cd9

SHA256
46d34a4c715121bc1f0661eb8ae2394c1b934d2eea7c7aae21c241bdb8dfd4ab

SHA512
e4faa286f4fdd4c9a94172b6ba599d45a354b66b44e0fe2da6b79e06d7d977f6da3773115cb5b8be2e7b96d4edf8a35157cc36dc958bbec490efba553829fdce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
788acbb24ac62d13be18fa89459a64ce

SHA1
5bf254d1d74a8bdfd3be3f4d71ff07e94287877f

SHA256
4a0237fcac5eebb96a9de38be4af81b84e723dc8a8c2e09d60b27ceec4dc44bc

SHA512
e521e47693dbe5ffed65be7b722a240b6eb83eec2edeab4302a4e1d51f3cfa77c0ff9b83b8c1c4d34e967138e6f71cd41168a6be651477098dbc4e24e942ff56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C5D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CEC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit