db38e8e03fd99b1479bedd284124494c463c74a29af1950af59c50f27645a0b4

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

default/index.html
Size

4KB
MD5

e7fe4c5926beb083e30d1307a4182c62
SHA1

9fa82e0dc89f6243712303651a34575f0363009a
SHA256

591c3938b308c485c3a793d9b01592089633ba8b620edc2712f38f0ed1d7c8fa
SHA512

4676eb5b24139867901745dde3381b52bf541a0949727f140b53661118887dca59261d8c9da66bebb031aac01109c1713028a8359b78e6c15793a4f3026339f3
SSDEEP

96:/wOJa8Sl9Dt90mIX0Ajx7SY+oI6TKoNiEZLqdHEaMm4M6JXKSQcQhOZ+Z7iwHOPj:/wOJf6dtCma0Ajx7SYjI6TKoNiEZLqNS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0014d226c3fed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000458315439e700f3c41d76020e5f238f4b4dbda611b79a511a8bb1a4bf26acf43000000000e800000000200002000000077aa934521cff15ce0cd79de5129b5a5294f0072a49070a004e2cc8a680e51cf900000002d3b4c83a5adb55aadc24077cafdf884e343c68370595f1bb84ffeccaf00c1f612f53cf0eccca9972fb415ed3092f71567844665f065fc8c2b5a649bbb697967bc9a8a5e63b48f71ad0c5e1febc57ec9fb7cd346b38d2d0ea301ba4709405306057406d27b05e0cda05c313c11081bfeb187e70cba908074a038dd8a91da67d8a6c511b9d7c4df524b8aa38d6bde22df40000000f1ed5109273c5b811cf4dd08ccebb57a6cbef77388811935a31c390c57cd1ad70eec67c256d613d65fc826f2aaf9feda275e0a2642686d103a16283dc4138b15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51F60D81-6AB6-11EE-95F8-6AEC76ABF58F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403466046"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000000ac771a0eb535a1c35bb46934617184259c5534164d77c86702448fd4abab4e1000000000e8000000002000020000000b82bf526dbba505fb2bacd1d0c83133272f8890e05a9e153f4dd12129e21158b20000000d507afc67fa69f5b86dd377f194e703e9f07042b4ef39018deaecfe26161ad2e40000000e0724bd40fccd31f9de670eeb3d2b7bc8f6ade0ddcf66582ee4b84355c21e9f65785f7ce383a1be2547c5f190edbd3bff78a0eed10b47a0a6c1e4281f6f2315d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1264	2228	iexplore.exe	28
PID 2228 wrote to memory of 1264	2228	iexplore.exe	28
PID 2228 wrote to memory of 1264	2228	iexplore.exe	28
PID 2228 wrote to memory of 1264	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\default\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e66cd7343a5139f90b12a1dff9ece848

SHA1
fd83fb96698f253d3de9dd09e456c8dc83a14f09

SHA256
9a57c5f5658e875bb2f5bf171f97feec4da2c03c80cdd1f45ea30465caab36e6

SHA512
30a6b4456a9ead7fe3f8cc9a2c24255d6f157a46970fd1951bda647885ba5e7cb76de3e3a463964653df618960297d3f8ede58275a8a4b2cfb5ae7b6a97f2fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a85e9fb0cba84f3aa76b85e3b32983

SHA1
ffce475b969aaf697498e6f88d18605c1d31786f

SHA256
6ca55a955d91ff8d7d27a02ceda08600b26e0bbbc7411c4f330f9b8c1287588d

SHA512
2276f006f7fcdc66cb772b9511a272a9e41f37fc3d879d9e6a1e3418d02f3d3bbedef0c797d67785b61f215bded6ac606bb1108ae46cb2e098bd39129df59c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da49dce78aab64382d06e73addb31ac

SHA1
6da3f4fde3498dacbc942ee2ec3460b8b4fcca16

SHA256
6ff1c50a2bb05ef8600a28d448dec37ad3b69c15b27dd3e30e2a6ccac49a8785

SHA512
cf9d0928edb8bdc38d57ec4d27e639adf77a5c0e4f541cc99044fd4507e4bcbe0606669e1d7c62a50738c2d6719c64ed4d10ee013b8b948a5ae611e273208cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e40fd26998da68be9edab9cbfadac91

SHA1
b659278addee62a921481991d2c8c46c782fed5d

SHA256
0baa86fa0f5c4b7e53a78d4b1362ad47998de251e7ebe7d1e19c8a9ef7ba5683

SHA512
3c63ed3a228fdb551e29d3e65c278f5b36eae43c68bf8b46d44e786ecfcfbb724bfb0de31cccf78ff74960d3b85e42cb406f317aa1896e252d024dc1da8f5c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d59898d26668912c7b8148e6a7b3552

SHA1
e5e1a467b18909d9a3f6c9d944b8980be3209017

SHA256
eb8d3f77091f5b1527cdc7983678eb04c7c326c274d7116f1859e79b20efcc00

SHA512
eca9e8433dfa11a7fab3b23782f337c58f5ce0485adb55e4408ca8fe2c902798f2e83ab4164712c15244ac5acd7634b122b076459c9a38095a9712267c096f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b3a007d0b713401c705a54f1dbaf6c6

SHA1
3fd98b712ebeef1101d5872e701e58695206c527

SHA256
75bc744b9276379d672a59e76a47c8d65486eb600a808b8362a1889af607582e

SHA512
b8c2de8535ea377cdfe115b1dcb7bad9766b6139777043277a15c3c2fcd40f0f5e71d855fcbfbe56d08b4a8a45eda9a6aec7dee6430ca3e5e48ff8af26c66091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e121f2e171babf802259eec2af44acb3

SHA1
e1be50e94bfca365f46bca0b4f89327585bf885c

SHA256
3b56afbcdabe278bbee665031d61c30a41df960dc73ea2ba0b19eb7f5965e93e

SHA512
03758510edd17cc242ea527537148fbcb6d2f8a31949c67dbd0006d30fd5995323ad0e46b26aa68cecfb7a43b794718ee5d231aca61858fb15dd8915328c27f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03c1fb07fb25e296672a5615badefd2b

SHA1
8f40f059356214d8bf48ba843dd97981b5f2fd1c

SHA256
ac9e01bcbad758a63f8aed412385544c562c6c7f265f3e1770dc00baea7f858d

SHA512
c8b1528cb2e093932ca489a7d21c07c59693ee7b281c208d9f81c19f8a624444324c1e7e723ef2111e6bf9a1ad3f5f36b02b3ac8d0daef6403575156113b857b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc4f30f2e2f1fac02c2d2bf4978dbc2f

SHA1
f0c6b30f56db309db37221b7752e30a1a0a20423

SHA256
ff0bccef48e1a1aa43f1a53924195e410a564de9efd80df920b1f84ac53b3251

SHA512
dd08bd1a9fd57eb453da0359c9b0861a572950ea3a75574a7f72a36e1782f624e765704980b5d35bb5d870e0b6a8ff89d550961c7aec08ae5dff2176de0875e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fd37a590792243b990556019b6ec619

SHA1
fddcca0ccccee096ef23af3c8ecd7a258145722d

SHA256
c8ce6a21dd2fe60ece4d69719442c9f25452ae5d5ebb0c11b104057609d7646f

SHA512
780804f45856d4fcd7ef8a997b861a8fa225eb019fe26043d38fd02e34322c53a5dd26e011cc61722405687aeb5adbe982551a51510a7204d232f3a0482e7212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7b45ca73ea8d5bb324f512bc1448587

SHA1
8bd55614fd0ab6e57a9e0372368df47769e7a60e

SHA256
c17565a8fc387876a9c8be65104c9095586c20392ffacc4d9fa39971979a1f27

SHA512
b21657173db12b10abd9e87d44ad8d4196a7791a9ee1f9a597072f0cc6bcb20705f577b551515bda785e5a6ad160da7a64fae01fc22cd01d99862054f76a109b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b919efb19589c60944278bd1ce9bcf

SHA1
08bb24aa6208cb75583b852eb55a4e2a824696c0

SHA256
b8adae8bf7e8324e0c44b1b0a3fda01b873c606c479377002a1bf29b6471d759

SHA512
381b2fb9265a818eb53b0c549629397330461617b0c7c0c147e4ba46f18490442edc79f007a3c570e7a6cd24ef894deba8c29e52cce80f8185a77f022ae2e321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598fb1de425add9269d622b9ed47d594

SHA1
a462744c8632f87083afdc3167da71ed98cd4c15

SHA256
c793022be9b337fcf8618ea1a367d5856c4607715bc1f72a59240b80c7606f8e

SHA512
2bd8d90787b26587d580ecaa43d5dfa090b633df88590ff0b70f3d606ce7b1f1a56dab40dbc25db04eb234cd847f7f494779ae2692add59748a65bbb53b695a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FAF.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7593.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit