16acebfdb93a7c8ed4675cc41ad236cbce86bb4da11684cdfccbcf2c4d364e34

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

window.html
Size

8KB
MD5

d15476a7be18861997b71c2f8c92e6b4
SHA1

94ea443502b55d4b8cde9d6891598efe374efb9e
SHA256

138fef140acf541c387c0aa9b9b70286dc15fdec5704584bad319aecff5f8e52
SHA512

0c41e6a66f20c98f8a57a5fdde14ffc804d621711b38db55b6118367625ed2f15ff57f96c4a666a708c8cc4792bc44a87e3a0efc130a6b8526106ec32fb4774c
SSDEEP

192:W/QYFiJrPCPG4chVKBVJ/DPCfWIMxFaxF1/UzfCPc:WZzCU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CE5A6A1-784E-11EE-A7A1-C63A139B68A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2980	2316	iexplore.exe	28
PID 2316 wrote to memory of 2980	2316	iexplore.exe	28
PID 2316 wrote to memory of 2980	2316	iexplore.exe	28
PID 2316 wrote to memory of 2980	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\window.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78322cd79d3344897bf5d10e165d91d7

SHA1
89baae58bd60c19a8917ad57b243e97400c05ecf

SHA256
638f9574a07f4ba4dbe79df7d2619bba197c4fa5f0d42b3bdb3e6560a685da19

SHA512
9ab229bddc4e0cceb1a22045eeaa20e58ad80ff5e8c59f456cfb1c1825b15dfc8cc898e084ded623eb90864b67ccb52c26b3600a24e5f5cd858f728f6c7b3e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9468e344eaf59cced61891c4c6807f

SHA1
67753808525851eb55f2596fd3439f7591a83e3e

SHA256
1b30e5ab23cdf0c09911924fa79b0c3a7041659f6a2f9a96d3be853fadb039d1

SHA512
f9620b1552c954a48ce4a59f500be894cf3514eccb7b0ee180717c81eea3402fd3eb87586963b6ff4b70a0075949b7ae4ff00217609fdfec9abd6ff564f0e69e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eedfec89eb764e1513a7c4a3b50d572b

SHA1
32da41cc8153b92d4fb2f84745b2a9f616c29763

SHA256
6d91e03095e1a61984da0b4389aedcd880738672852ab2d715450efc0f3ed58d

SHA512
159353677baaaee7e7b60956f986dc5029b916967f11d1822acaf75f978c241d434a1cd18bebecaaf50e11d6b26cbf95709f3ad1159f7c940c4f54ed7d146276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7609f7050ae8d5d4fa8a4bfbe9067eb3

SHA1
b3effdba9b4fa892be8f7a72c55870e56dddb4f6

SHA256
fea7a9d29bf67c5642bb82edaa2b0b292d7f35f05fcb046686085d8d3e5d14a5

SHA512
3579833dc7057125cbd4b8cb7786f40996db1612ea1f452dce00a24733a65ca1147481ce9eddd7512eea777fe2d8491187bfe04d84475b332c0f500199fd166b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ed1c1cc611e2cf3e89adb3a699fe2b

SHA1
1feb61c26bb0077e5a37596826aa75a9f965a97d

SHA256
9463cb6d7aede6d02e1b86bcaa8fc0bb9c5c1c372d82ca37e34bc2c186345317

SHA512
d41c2a8398a3a087d102141024404c0943aaa3e62957a12412e46e3354b16e3000a507b020eafc6bf1684d7d8f1a2ee4707001dfd06520d891c4132460c3fd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf353c90dd3aee51d760e4ef4326902c

SHA1
5c8b5ee7685b2f4bd627861d3d8db51cb8ee0bf6

SHA256
59f84375f955f632f2497cb293849245be69e5d746adbb1920eb189fff619b02

SHA512
5b8c187b492358f0500f833a831c7ef1243c74f6b773cbd1be1b63496b0d4c0ae7971681b4de98162faffa5002d6c0d64b76fbc4009f3b256654125048725f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7d7ddcf3ebc0e46aceebaef3051e7d

SHA1
a38953315d1c7fc045f3d2b2d0fcda258fd892d3

SHA256
f11150c0e2fd9214b392b44956a68dcf235fa0e4f9bdd8f1766317c2458b42c7

SHA512
1f23f6b9915ed339c391b62dc55e863aa40aba4299e20f2a7d2458e5e5acff81605908390a03e57de0bf856fa3004bd5227451e060e5a8fc1c391b64b78337b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03bf95e2c48c5b4a84717dd03242ef2d

SHA1
d5f41cf43c87db08a0cf3fece94e58dc223592ef

SHA256
8937f878e1d86c78583b02cfc5bbf077eb0811863894887e057fc00a22cc0b4e

SHA512
a6fe9037449c70da049c60e46350db3318226dd58e7e9f4e72feabd7ab992e2197e69e6d8b85be8fcfb1966a7975e543f1a52607344198689eb7dd770959489e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c612e6b3519c548a364e7a5c3122255

SHA1
ae73dd0a38210ffd0f443b26eda96dbaae54692d

SHA256
4701efdeaec8a32ad315f16bef24247ad94c7416714bb23335d75baed28e1aad

SHA512
a4e4453fb9fea5c23528d53bfa9d4c30a1eecebed084dabf767264064dd506c90d68006e729633f1e900158ac1b4269c241e52fc6da2f4f57824a735f809254d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC84F.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC900.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit