975bf6a4021c964ace26e9a0518856955e111b1d2b2cb7c4e4bb98dd12df64cb

Analysis

max time kernel
149s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

help_uk.htm
Size

114KB
MD5

ee5debcf16d309d049ac633b5834a58b
SHA1

ad9e5e501bc770bd22695b81482bffe1fc5fd62a
SHA256

7ae8f11037e5639b61064b8b0e881fb32c1a047f6877f9737541454d2eee80ed
SHA512

21f6d268794424f57639614d97edb81109d01f402886a242b120f206bb1fb770475ec2b3885884e13cdc1af09e2d982be999ce38150c7b69552b1ff899278506
SSDEEP

384:CBd+WmQvJOWzmSBkhpJ4/HweDM1C1ytpXjAoLU/S2wVIEMpaMtM/LPWZdO+2+FX6:HhzSEXeyag

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9F7FC61-6ECA-11EE-97B5-7AF708EF84A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef0000000002000000000010660000000100002000000083ec0204f7d6fcdb01ace263d8c29545aee74b68e9e78c949ebacb44fb52bb50000000000e800000000200002000000069b9a209572e500aaaa307d7dd89a2c3234b9d27ed9d5c7e317473222c9b20ff90000000428d64fe78c73fb39a24a66413d17a420677f4026f6574ede6944f174131600c10d7d69b5d3d3ecfee6000d31845d726fe6b3b4390cef7a386068d762cf75d0f749f74424e419859b5c0fbcc6b1607e28ff8b20c5c397e4f032f0464246ea673a02879a88838d39895b6ed1f95756348ea48dcfa05bf4f7286ea5e909149c1153dd31b7da29d4695b5e3b3e4102f4e0440000000ae11c5dcb5f9ccf267ced888154763a8f25cfdf864c50d78a73629b5aa130594a3c2c49daf2805d31c5aa2b6d340f254da34617029933c71e2dabd94a656a1ae	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403914726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601e36d1d702da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000009c4ee3e2cfbce63d60a670a50bb2c1ed7ce95a9807ce001842988f749c3273b5000000000e80000000020000200000000b61ab2892ce7988e70565b1c3d9460306576f7eb01ca8083c9555e4a9ab00ba20000000aea2455ab3241aebc9d0c6c51a9675b33a8b39e3c5360e5ba9b22059f797357040000000f3f248d39a3103af729199e33540c19de2000bfd5968715b6f92e1fe3df0029578c8289d5f538a3f15bad2fa0fca41ca856c8bf6ee031835418347eb880c9513	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2280	1280	iexplore.exe	28
PID 1280 wrote to memory of 2280	1280	iexplore.exe	28
PID 1280 wrote to memory of 2280	1280	iexplore.exe	28
PID 1280 wrote to memory of 2280	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help_uk.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
367351801c69d0585960682bd07a80f2

SHA1
8ed8524bc6489e8dcc03984b0806de5ec13d8aff

SHA256
e2e1de81c28b3aa2a0bf78e1e3e000c6250879ccae2ce2b6548e44f86888a375

SHA512
75f11209c3e7311ec5f25baf071095b6ab5ccb81b46348de0ee0d160cf664eca1655222424d98583975986383a979512b5ed1134c967a73715dd71a4cd0a3415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b74004b00b8cbc88f929df61b40e7e

SHA1
9d28cebd3f904ae5d93ed8153098cc5156e9d911

SHA256
22b4afd7436402d538ee927f3ca6dc4726b62e51c1de6042de84a653c57920d2

SHA512
83cc94a59d1d9c6dab9771dce47cae606d2129e334e0e46b138646071539bc1db9e0718b12b4b0e3b5a08ff88d2fa7bef31c587b74ee11580065f71c9775c15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4fcb7d1b227824fc7e2237fe8aa445f

SHA1
4fb0f67a47b7419fea4cc476aedd7a5e5a5e2581

SHA256
be687b484c8f6245294ef585101c98e5a158256fa29b9a90a7029ac6ff20c081

SHA512
994652eff000ca84ceb88b59808c820b225c245acda495cf672c39b697c4567a064d5f1319bf16c583bf68beeb919766709e31a5457c19984ec0bd854ffdb48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebda0eb43f268ca87d42abfc09e7ebcf

SHA1
379773519a457d869a5ff6fb5402ec4f8bd9a73e

SHA256
57ec7235806bc96514a3f68078bf1eebe572ab44b598b011453a5bd26c742760

SHA512
91131065ab2930736a957eae03a9bd93e05a6e3c9993770d1015ab5ed6515c4bdbbc0e790bc4c0f1bea8f992e273600bef03b13f03c044cd26b3e3dc15b965b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cae98392b32269ea91a74aaf23391479

SHA1
a099b229e243ecf91ee4c6f98aa98f7fad3e7a28

SHA256
0e6f91643cf5c09dc58f3eef61a1ea5929285ac0c3f6860091ccb2bfd5569224

SHA512
8f0a3535edf9fefe5a2d00742004ca7d5a6f0334826d539a81b33ef922a031ffab321d42f09ed468913e9e4e89542f7cdc5d3e38ef47b5535751ffd6702e445c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a95687b650424b0be359b3e3d3c7072

SHA1
f0045a64cfd7f3fb740592981ff8c4395f4e0afa

SHA256
c88b6ecd3f78a4cf088b953825c9ae2131e8bff0064519a38d8fd3b630c44ba3

SHA512
66c489713a7a127d57d7c2e3a05234d118c0af7a047c10c11f4056f01c9361ad3d2dbef7bd06af09be31f47a3c6821ff393c8e42fe1305f946358ba86291ed00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e11e2fd7057a31e3bf52846329f53e

SHA1
a88ed1cf9f725ecf0257223eaa66dfd638f32f6b

SHA256
1bcafb7d41deb8d36b341213f68e710609aa55af28eef541ef7ee17e1efe66d3

SHA512
8738d6454e6f340be5b50cb7263911d60ac2c0b737c8cfd2af61dc0917cdad2feac6053cdb8d49a57ca91c27dcebb02ea7446afbbe72ff3406add9e28ecefa37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5e59a8da66a1fa987e9768a04dd5af

SHA1
01e2df0bd0cbdd0c637673d5927c1e62e0478b63

SHA256
006599c2df59ba7c44048a748d0efbcb9f4ee7e78a374e09ca63b4b4ee5c0397

SHA512
c40c50c60c3f91bf465b1e69eb05f1439ce278e815dafb2beb4b1ee4bc4e947f2660946d846c18cca8fb280ab02108ca6cd879a83bf54b995b4955def375fb5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc087422ec5115314b486c0211c5669

SHA1
bb6772ba602ce8d0bd74dc5ab93d3e4bf111c67d

SHA256
a8f3eddea06e8b6688ec10b47370211f46f76a838b2b3dd81ba81fec230b7403

SHA512
17b24e8ee917dc55744e80bf084e7828eaf7bf1c47143fe123163fdf665895bc5b147e7a305ab73aa4232a5447b4066ca1e9d64ac45b5342d076c864e1beee74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6828.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar685A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit