e78bb0e4ff1131855c0c1bb5e94c961e4b9b10a15e6f4598c9d5322813456269

Resubmissions

23/07/2024, 15:33

240723-szhxtszena 10

13/10/2023, 22:12

231013-14qggaee57 10

Analysis

max time kernel
134s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

2KB
MD5

81ee641cd889b806ca2210d6ffa0393e
SHA1

92410cc86acf7ef6d7fb9c079db1503e7dc140fc
SHA256

b188afd15dadf6e2f0cdcf0548c7a2a4921d5efe1a0ee7dc0b1a86631e7552a3
SHA512

e752754cefbdb7826e519132df6600fbba39535c7c7633f56f8c374896a0d48e61c752a42b281592f648cd237f516bb74b08963cbd973488a3d53f65e0ac7906

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403437384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96227D11-6A73-11EE-A96A-6AEC76ABF58F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b000896b80fed901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000954c0c3f356b735670e0fca9535563df798d87e24d6de64e1e030c51a5008b3c000000000e80000000020000200000001a6935ca5752edbf6483180bc20bacbc6a437c1382282ece949903aee9a4da0d200000009a36f0cacf6c0d6bdb47b71c7831cb0b8c378cfa37f5a256eefd329379f6c8f7400000009457bc99a399ec0bdd182842b4a3ef3eaf705efb7fd028473ebd65247b57e2edf4a5f565781bc49f9ebaf4fe0e6cd8ce98422bb47eb03d64dcfc4ba98d251ed5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000007be8855e6ca3738edb45db648649df3cbc952c5d2787b88b8e70cfa67fcdd64e000000000e80000000020000200000009505d5acf978c115b80d3b75c0261d2f50c4090432ca8e92391b2930f55c986f900000009234b380dded5ee4f72f381b0d3da2f39b835c49262444a8be566aa244973858424cf28cd333cacbcf3cedad2b0d80334e1a544f41e078371c3facbd15a43831534b229d63c20556fbe4c2dbfabfb358d258789bcc2a61225cb90dff15c5aeab4b8eb221984de9df5c52fbf8018115a05fcbfe4f1ea2c7ee6b0b43ef04ea10e2dc962f9bce31f63b7145972ed3af3d6f40000000cff1dad52a742966a50d3f540b7283ba04ec1131df4f2b5d8f4565b28d73ddaaddfe69799cdba1d34790354dd5848d16ce5d6453e19d88e54527232219530b96	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2716	3028	iexplore.exe	28
PID 3028 wrote to memory of 2716	3028	iexplore.exe	28
PID 3028 wrote to memory of 2716	3028	iexplore.exe	28
PID 3028 wrote to memory of 2716	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc6c870c0247ff16736e4bd85bc1ac3

SHA1
1ca1bdbb484263ca2ac3dc9f70b82f8637147bc4

SHA256
338f4df81f004d706fd45d76150c8577135f8d7d5cbb8e5fd5a8c628a4084306

SHA512
dc01ac469dcd7a773f86ccc891604d59ac40a95c536ab7bdf93a3c15ff953aa50d1579e966e2b0f16d1b6b0ad380d41344d1b761fd599e0c4dfd0e02af9c9dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7038b8ca46981d93185aca2e1dd45d7

SHA1
649cf26780de7d58e21ec48fdd9a92a7550c058a

SHA256
7a0deab677900ffcf2f83a8408fe30525015ef1ae7be4f0c78af3e38428036a4

SHA512
bc975cab3eac56d03a196d37810ea490218eb558bcac9518bba034b461853fe190910528eda084c1d4d9c23dcf58efd4bccad11a195b8a271562499552cb7962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b140a6641f2444e1b416cc5ca6147eb

SHA1
0408affd13de68c7c1941d30066a70c7552594c8

SHA256
873b328f90ca8c0d559b2f8da6f38e75780a15c8d9627f35414eb5ef6d4d115e

SHA512
2185ed49f90d57019645b25654a062a2705c23b1d2de1e193c57d6960ac82f3da9825cfdf6feb738b3a1c160e25b0dbac52a22ffc1a450975199b28e59e224ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3cb93257afc579d0aaf1aaea10b66bc

SHA1
2483db68c329bce4795b90dd3d4ccbc569870c22

SHA256
7da07eb966b14661fcb93bb498f0d30d457d9bd86694deaa59093eb9a8622fb9

SHA512
b8fd289758e968879aedae13b36dbfc4d33d9d5e367bf5d9e746fe56afe611f2174c219f49b2f3fbacef27a99713a8cc54ecbd3941fda091226bf38599b8151a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d30c60b51412955ab1657577655c18

SHA1
ddc24e363cfdd05be561845b39cd4746174eb31d

SHA256
9413d72139a644458bfeefbba17be0010df915a233e78090a692e54932646116

SHA512
0bd7d8877e0a218d7f43b0f007ceadfecb0ba27bc47c67327084bdf33f74c6b60c769be4d1f9471e31e97f325a50bc4286f56f4a299c90f5c121ed4bc1db9645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ff80cce0243931dfd1b5498cd8af9f9

SHA1
6d2e7907c0e782070d7be0c609758c8ad693dd5f

SHA256
bc2e834b172e187dace5690e331759bc6f775c81f8d2c30493f09160e50355ba

SHA512
18c7a3f4ef5eb20a20876ba6243b0ace8003da0cb4f438d4dd46ad799152464bd64b5d7946baf8ad87af3e65ebe0dd13b073341f156ae746b6e13594fe5bb279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8274177280fe668bd750c8d2723ba4e3

SHA1
a0780f2a4b32c7484f69c80fd8b3a54c3a31d42e

SHA256
7febb79289fe729b7c2ee8cfb80d7533722baf8da8d1da303f7240a7f793df4f

SHA512
47f9fc9c4b823fa18d6efba78e2ea83334641cdfccdc10d7fd7bb29f210496bf05eca6c3b1dea74cceafd80d35cf7c4fa984876a8743dc5f2d79adec1c048c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07269439035b6694248447fdf90ea6dc

SHA1
32e85437ec6b21a6256098a66c23535b4b1f86fd

SHA256
c3f839c97dadb601f38e27916f91d6798830cd777d375c52ed89f81393b0b673

SHA512
410e5b38cf2d1063676fb7161139720898302e197fa17ab67c95c1e63191503ea52bd9a76deff7bd4c45e18d176e172b1c917e8e465c9de6d86d14d6ddb97212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201136444c959a3519372e3d5628f977

SHA1
629d40afc6cd18c998271fc05ce6444de5f1bdf3

SHA256
7f9aecd2f113aeb26e138c9c35fa4cf315e974d2b6e16eae6ffbf8304bec4ce4

SHA512
c65191838ed95d445331e71508d8e34963ead4b9eb3f81e3472e33a99e2a5bf744792129372fbd80103fdca458429e9110cbcd3055b67282e6ad918bd29063e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d32997e3b914a3c68bbd82284f49333

SHA1
3e423c5d95da2883083a92bae25f0484000ac088

SHA256
a1c75c20afaf8dc69eb261841854e792d5be994034a8efd7e54d02e489e3bfaf

SHA512
d1b91e4dd330331f18d5a920423a761f44e0a797d0b7c4835d7e31d100437b69c24b178481634bbf90eff0e2fe7f89b43da7792725dcf635caa35a2062b1ecff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2469176fb61138e3020bf0ab0e3ad0ff

SHA1
2f525660b2af7d139fdd9ae101b4fe3152790b94

SHA256
751d32110bffb15d94b116a9dc23e7ae62de531ea1b023914aa7cbcec89837bf

SHA512
ddcc30be8ddd8c2a6ad60c6dd7a205aedcc79b869b0114c0523c121d23fa5135d0f7941204c33a5d45dceb2a7e7392733fe11ad0e22fd08ed45649bae2a843f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890e7b58571a74bbeebfc3dd49a38687

SHA1
bca493ea31d44a74187f8057b11512e7ca208282

SHA256
c55cd5490ac555e7e29eb1c817a28f546e6a196a172f68a6f299db550a6858e4

SHA512
ec0aa66467d123627e0548b1c5dacdda5759027738c92e54bdeb3d814ce1c06968d9aca6dc49910c22eac8e2e73d4b7bdb92e5e1b560ace9e305844e9e26dbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2083046892fbd70a12b0350b1dc1699f

SHA1
8bebe0f9b54eba0a820d01a545eacf5a37eb28f7

SHA256
5c911ec5c02b2961a4f273b40dedbee8072f95fe14442a5e30968b7d1c361c69

SHA512
8d70e39956e67cdabd26c74cb3d9110f2379c0a328069becd7fc0383dd37f23a3a0d5983997f1e2b5a328a8aa67c6777619ac1ee504c4febbbe9988a01848713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93cf3cbcf37ea1a51b5e870e7565365

SHA1
be2258cf1d5e8b7f3c715c335b8ad5629b24a652

SHA256
767cc61de1b5b99a6fb51fd46548bb9b6017855171a5a35f3b69e112cfc30133

SHA512
76714eb070719e2a3e40542a110ce3c769a2ef842730f4b02478219774addb89cad628cb95c7337f9a71eb2fc4d2499d6d55aa5259c9124f7bfa3f1c2491e76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1b1d731cd7db7bf5510adccc967b71

SHA1
ab3cb14c9783ea9e50819c1fe5a5dbd8cd8f4c40

SHA256
c1a6169bfb8dfd54fa40747af12fa1caa372a0582c0900c54ad4e21c5db6876b

SHA512
95e43d15dfc5fee654fdaeaf4ee82ffa5d0cd1e6200e7e9a3fe4533dcbd42ebe520d1530a1a6a07bb532f8a9c46311dfd9a5c0d3205d3fc7a7f4972efac7b25c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEC7.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF99.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit