b18ee222411cd6d5ca152f86a6bba331c83ea8dc79c80ea4ef7d6ae2b212d98d

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
30-10-2023 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

skk-0722-29/contact.html
Size

9KB
MD5

4ff55b17ea25c3e90297df67e24ac864
SHA1

313de7b1815513a9910ecc5b3cd3694cde87ae46
SHA256

e21ed2aacba20fa3d2f7b6497211d30c23b117516a0f2c67d8e4ce1c18c3b192
SHA512

e2600f750b0342e82bf7cebbbf163ff3e77734c8f5f8f3ca3e4c215d9d2c42e7c162a32d16e2403af2cf3fc8471b87364c0fa4922f8f250ac71c9eb9b929ce3a
SSDEEP

96:1XjzyV/SauvDO9TIskQMR92Z9fpTwtNr024a7GLZaPX9iYmS40afslD4h4CK:1TzvauYFzhZogrIuEXd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e1f9214e0bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48EC4F51-7741-11EE-9C00-F2322C0FAC57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e7171840000000002000000000010660000000100002000000019e594b24a1a73418666179e28fb5b392a17777ccaf7d9fe2cf8efdfada81eb2000000000e8000000002000020000000de5715820b4112d0a756f180798a077cbdce296b059bd6d5a13212f76937d405900000009eb96986d89d96ac8bfd7b4eb4e98664d6317bdf1bbb3f97e802e16dec4a1c5fe5afafb062939575a617359810827f2c51e70dba8be55b96a42157d2c5b9bf67ce937dcd20f553fad82f4e84d75804178176fc0cf577151ebd6d8567d733b27acd9c50cd5cdb56089f3f6568506744521de26d0e74a7747e9053ebe3a1574f2f5a1201d14c2d91ba4653b6dfea90bd0740000000aab8d73c154d194f919557ab5d084bd276e5e5fbc9ca89cbb37340264b1120ca7d96080141cab22ede67ac46018be123859f33d8eb716b36ec76b4c02263ef8e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e7171840000000002000000000010660000000100002000000075e9e850c746f0fa9a73123c56748940a19a0365bf64e6cb35e2e2e602199eaa000000000e80000000020000200000003c389c7abd5cdebfad242eb18b0748718a58f2d12ece25eac668db8eceee6a0120000000427847c611f7ba832a86e30a8188a03fe4c76cd93cc094308d8c49dced46f40d40000000030acb877690ccf0b260823ca0e1e7efd50abb217779775a6e483d7fd77770e7d6664fbf7ef5fb0c2f2958eb1b695d097ca103b794a1d278d99b940fce62e25d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404845145"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2164	3000	iexplore.exe	28
PID 3000 wrote to memory of 2164	3000	iexplore.exe	28
PID 3000 wrote to memory of 2164	3000	iexplore.exe	28
PID 3000 wrote to memory of 2164	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\skk-0722-29\contact.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
387d8a83852056981151e315cd9f19f3

SHA1
5f607f62fb778dc5c9c8c93cada94477c0487032

SHA256
eb9275496895e5965738bf29c643b08c2cf2c8e168b356690cf1b002a1485d18

SHA512
80a716f33ccd19a094444530769a5acd7ee206485650bbda360e11241351265b977e2a803403994601f58c51c80fa2dd72be0382ceea1d35493329702226db8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5b901cfaaa19c322da339b54bc822ec

SHA1
6da626793477ec982bf41cd387265d94df597f7b

SHA256
6b160a7be3b2793c051deb2c45d1885c2cf73668bb4756777ca53686d8ea7a7a

SHA512
531e06771efb2571ea93b2e99a0e6e6aeaa5786235622f6be667465933f9d6e50d69de64582c88acff9c99a10186d2b6ef0e838d3da84e9b1401e6d2e624e824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84cd3b55e9e95b23a79ca57c5c0162e0

SHA1
d05bf417726dd4d4ffa8971eb756eb387b40c1ca

SHA256
faf48b5a714dbaffcd1a174de48be417df26b84a197630423a81b60e0b11186f

SHA512
a5a1b81d8f73ba3af78ec3e3b469187f6a4710a58d10e400d3d8b496ee5b1d846c95695a8d09ae631d8ebc952695c4bd1fbaf86c58f8ff2c436bb7b7716c7cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41514e30046582f33c84da71c1c332e5

SHA1
6749891003d1ad96352bfb395691c7f0071578e3

SHA256
1147cff88c46c103c6f96a5e3672d3a80c5703cdd113f4730f8add82f3ac3d42

SHA512
86d8e2a392a2db63ad91bd12519078ad5b762cd8893b807ab5e593f9e115735b3d0e7bf28d09399e2c1e88bd33d1327dc83bd953508d2b8bb0b6b417c1c447a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe71367741fcedcb51f6aaacc44ce5f

SHA1
e0d8deebd338dc512045e5672cb3389aa8cb1946

SHA256
750a5467ec65c1f0247ecba3db0c179166470c5bd7da3e36be67274e0e8feb4f

SHA512
6b5d189c0fbfddb93fb68447484fa7d0a5c6a4ca24117f602396d915a13b78067634714c13107a1ef06d8b65d56fbf4d52ee0f21194b0392e2778e34b1768be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40bdf0409ae87f68aa7b41573c60af55

SHA1
1c907f65e8b04ee1ed4cc58c167b941531000a49

SHA256
4181acbd8f1891a672ebcb396f964d3c66d35e0ae29acb39625ff3394e1f2751

SHA512
6a20715a1c80f5308655316677a34827cd213745fd23216f919b69047ce63ffb3e6448613ec330120e178d8f20ac930cf084ef08f9c93ef6bd3b907fd9e7e0e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212301ba95b300c97520d9521cd36e4e

SHA1
02235fb4c6bde42d8ead46cd2508ed9c68f8ee08

SHA256
439e5edaedd69038a9f23ccb4e1f52aa3e88503a6f19fc1f26fa1e10541b1425

SHA512
d358a45ceb6629dab82e5c215409eb39fd9a4666de7577519b0898966521b5a1e3889bba816c30eb4b0233f946096d6e1ee3b10be925f434c285767fb5303d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0992e3415442ccf5a32d7fb55296cc2

SHA1
bbecc31967bfac798998887a762fa7a02accf081

SHA256
f83141693d1bc00e417c27b06e6bf53109ed623c706c7e0eb3b54524bb74d4a5

SHA512
b7159aed0db56f5e45d8a7a7eb401847b2e58c604e184f875a18fb8281ca30f4c4516de1a6ef96a11adaf50016df94c1536db64bbe933534b8620f83bef7b11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2868b9227db103e11aeb74689de3da

SHA1
380f114622b75a3aea44c7e75d947ba412829bca

SHA256
3784fef9c5ec281296e37866ae7264550f3b4e426383e17e61b3aa1451edb987

SHA512
0db8a02a504dbcf87a812648850f6b03bbf16449f3984d1c32c938c966a51561bd3cf85d53f384ff796764663349d62a453c1092c35550ff0e57f031b1334a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
063e4a0293fdce20e3f945c6afb2dd69

SHA1
a1ab5b6f9025f573c6aba7d0927802184c22b946

SHA256
af176f518130ac7afa876beb62eee7e3e779aace35fbc9cc4a7353d76fbbb917

SHA512
d1d966a3b81fc771ab9ee0edbe352f468b5c84719c1acff7361f6452bb29020b28355c319d73460993bac092b17fdb7f5a14744ab4ac65c2115494f0e0e40c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a0ad095049f2be463ea243c82aa242

SHA1
1f01edc0af92e17598970263216e3ebcbd3d9092

SHA256
99adf41506299477114fdddd03666b7a84f0cc03e8a00e9564a7ade1c3f71f0b

SHA512
a455cc14647b5d4ce02dbcce4c13904cb756e8fce10e740d1f8a5d405e819ae8ad2ccac0c730787786848b00d88a44655566bba12f20fb4ff5510fce9eadeaab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0902342d04b7a2cacf1dad914b05572

SHA1
bf7e853d9265b6a7ad87ba3bb12be6fcb53ae938

SHA256
7012cc7bb825cf7b4622f417ba7ce3966b94ac63f2f61ebed07eb446784ab5dd

SHA512
a1c1d224311b706c0f2484010ffb8988aea52632ad09b8436128556ccc62649c24cb2d8fb4113741791d2d12c438847dd46d2d5a3251b98f0ed0ff615d9a506a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81CE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81E1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit