ab02e4cbe64c32b1ca18abd8a727c6e6e5f70d6ccb534da980df2f4210c23d6f

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
submitted
12/10/2023, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

license.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6091aa038affd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403551458"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000408cd0545dd69cdf4696ba79bd9ed31e2f05bbb5385550f41233ee94e6ddcd78000000000e8000000002000020000000584272ce7ae2a1d6ee3ff4dba93877f4e18128930375b403882ac83a9d9bf82f900000005fcdb62fa7bab4624fe68e2a8db660217414a9ddd6819f5c7909be016668bc26fc29f4c82da31d36a08108f3404e1bfcc4186b83b6b9b6d31c403b4c11f04e99a48d9abd73d4b7fb648f93c05827c816b6f6bf3672589865e9982f68dba595b1e48ee08488fe17590b2d88787204595c8e2f3d986db44966630d22678772bb9b3ddda7db618c1fdc2ba024b1a4ef17a2400000001e42e59a04700718f53f79f7d4126e70c2b46e7d9bc0ad1d05f26fd7d14c4df07a4f21fdd1623862d28f995a4f6c301089389ce35c1072758ec6decdf8751cc0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E65DE01-6B7D-11EE-A44F-D2B3C10F014B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b0000000002000000000010660000000100002000000009b56491ab58e64c1735a0ec1fa1cce4be3d0f7dcb49c99b90a7d552f6c1a13e000000000e8000000002000020000000c20be5e110e81c23cc28b5d0e6248635545563127bc2eae8804d9b0ccc4ed40a20000000f07f6bfaa642f5789269b62f84deead56d1f4fde2ea585de9df793d4842e56b340000000bbee47fb18e643b7955a05647cea28eba4af48723e7539ba972328e2826d27e015558a1ae61540cb2db2d1c639f7cdc8a5ab05a585b503faebf30fc43b662a4b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2872	1980	iexplore.exe	28
PID 1980 wrote to memory of 2872	1980	iexplore.exe	28
PID 1980 wrote to memory of 2872	1980	iexplore.exe	28
PID 1980 wrote to memory of 2872	1980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\license.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aff9e1989eeb88129c633882f7227217

SHA1
2d21ec4fd4648ea9e4e07b5fca095aadc9db6086

SHA256
54442991b5c1620a68fd92e98444609209a9924729b2eb6e532905445a27ea25

SHA512
a866b2c2a3c2930f670975c4cfcf294c4c16ebe16c4a53033bdfa9b826117b2118e8133a7ed121b4c0df3e3cd01a9cf4eb61e5e399cc960f702d47eb2126908d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
738ab1f63c3eeedf34130957007b5e39

SHA1
62faeb9cedc73c5bce271c6293574154694376a2

SHA256
f09a15f26993cc60b651685e2fcc7e684a06f68a06fb6ea12614b3fb00d590e5

SHA512
aa2b9e89a704f46f0dfe9e25ce96d7b0cfbc5f27f4e9422228ea4544ca41c866069e7d94f25d49ed06d6a28f5002520aedd8e2a30cf06e3ccd132366e2d59dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
695056de09c2b288caf101d9cecc3938

SHA1
67f3a962eaa15ab3972467d57bfadaf54d567388

SHA256
e4422b65e703fca0cfd07caebbfd93234b02d7df930cb6cfa6bd9d6a25a44521

SHA512
96dfc0e2e6784fdd3e8f6eed70d24bcac70600c47733cfbf5dc4c8c3737f03acc9f029e092efff5e48c9238460a03c8eaa463f87d531ca0c70cd08c54a0ca870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ac6e902a56dbee7e24953c26dd6a0c50

SHA1
842b547f78dbe5e482a508f582fd7e9cecd1545e

SHA256
824ccb761cd09c45d5001331a386cab7d01e0fc2ebcfc657eb83b534968ae249

SHA512
109e578118106977be76914fdd76e1e922023907e5ccbaa5a090aa4978c8bfa3dea4a8c61cabdaf017b7c541844fbab703a4c4810e35a0408e0a3a185e432836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d3cd475ed489afeeea362fbbb89e3359

SHA1
145abf3a4790d61a61ac33b997bc368f36fc212c

SHA256
668e76a29623e05d7f7c853229a2d3d43fe6a216d7040982f1d0bcf2da4eade4

SHA512
555ecc1c8542ff8f388852095395e122acada22efaf68f31fb4c49e64daa102eb9e4ddf3099f13390acac7b93d5a735612af49bb4668d9d50ea23636d4b45c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
776271cb0c94fde704f1a2d7aa07c3b3

SHA1
5be09950420846814dbefd8e601aa5f68722ff83

SHA256
c5b4af50321bf012bb349cc4207404ac22d3202893964388b284dca9c86bd2de

SHA512
7c6cc3ce04763bb986ffab5cea7c1f016fc4a638a0c860aee29eab297b0f37753c1be9281c55522bf77bbb20d6095e62716793c110a2d92602550fd4f80f3fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b3659f8d942d40ba3f4f7a398055c8bd

SHA1
54536249e30ad7b56ee4fca1d011b809a630151d

SHA256
a07c222aa7db20223e74dd1ef94d223b4a5d2c29372193df3aa59e45764b16ef

SHA512
7156589765b95e6234269f99099ddb69fa7552dc86d018a4656c5e2f7c3dd943f3ac2f079d8298a3fe4d4bc85618cfce9d33ef8d4493b9c2a43a96107cda477a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
daafb767c6bec4ceb135f40c5bc32816

SHA1
149ccf095de27a27be35d5d21a84c8b2d99a32b8

SHA256
ed26cbaf91066378ccd2e21ea4175d3986397fd95b49604d2d83805b660f3f0d

SHA512
1364f7237c752bed7c8ffb4cdffab95c1f9ac386e594c40e1805aa16b582f87aec96f64874fc63d3ba20ab0a33e6c5076ee6217e5f4c4a7cc229038ff187f6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
280be5d65029e45758ea9305de92b458

SHA1
3f5bda85b5fbe2da26ba15bc895eb773ab0b99b9

SHA256
8df06ff6541cb1499199f24f532c7e3c82716026b4debecbfa7ded94a6ed2fbd

SHA512
c19f00db7ae01844a068a82c93b638defefd3cb2dd87ecacc2c4fdfaaffc50b51645192250318be9cc182bf4c4a85c29bd680d1891569bed494974eba346c5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
35866875349ddb876bbd7405de313ad8

SHA1
cc5f26b7fe9fc34969764fb66407817a42db5dec

SHA256
51e59331f1d21281aa87365517a0c4784d30f3b4386771cf87c36ccd49ddb867

SHA512
aa2ca5076856d81123de0ee6894de5e4cb65abad31e47b614f3736479ba35c7233bebc792e58d32016439112c44d918ed0c3b392c566f88ee257b81ac1af73da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb71f286b9e45af060af5afb3f391d99

SHA1
2bf99a71a3b50b03c29d47d31641a2cafcc7ed01

SHA256
41be8e683fded656c17ddf55f3ac64ef8a6611bce267ed2da20d15967a87e2d4

SHA512
0de479545c344154cd1282716c7b3c3be3883af41dbfff13248f4c9667e499afab322c753f3d75209bb44095bd000d44f9fe970a13e8d448e5472d08f611608a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1cdc6c0cefd5e488b38307768446626b

SHA1
0c1de5475f4b1634faa0388b70f05ffb0fd7a809

SHA256
85673c2912d1472903c7a4e6d8064429412396c9d55e484c09582bb9d50ba507

SHA512
ba10ac848e3cbe343e8ca4fa6c4429ca3f770d1f7b9bba531c56c292ded072039dadeaf41401e36d38c21e2d410fee6db2f3865c8c5d5c52a36948c227e44fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ad5cc44843da4e5e83d119507d36ad70

SHA1
1d8f9197d2f26818c4c58b8f317550d7bbb3b3ae

SHA256
1625cf14e594ad9b7dac74634ad406b06568edb32d80bade650ce6255116d84d

SHA512
4a4410e01362353d3addedddb041d9dae2d39d3f955fdb6c15930212bc6ba4e2d737f0d6156b5af6ebf3cb3a0220f4529a9a007f83e17378bc4ac94a2a1c89ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f74ab930ba0883f39b852a150c764f1b

SHA1
9ce1a4797ffa5d66d5dbe70dd6fde2441f0aede1

SHA256
9ae76b4810bf58d4f94dfd72d81669ac5cab025f8b833326b5cac026a8117b65

SHA512
115e8f219106972cc3c2f313b285b1f5717b628fb58bf22a483dff43d8f49be89ed8d8876889216f43e588dd225756865505a852fc0dfbea9675dd3f537c8030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2aeaefdac500fe8cf017ad1b87c49abf

SHA1
4d78549285dabc66b0c3f47fac32914261250ba9

SHA256
017b40f06563f42704e2759299d8703a4d6c99acc84cdfaca44ddf1f1b164d8f

SHA512
5cc6297f49f1a8437151619337eb9ef97186f8ca9de114438a3cde0d9ac3b28ba28853a85a3b3e409ff73077b25fb48c62a72420abc7792b95c709d26002488b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DCF.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E22.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit