55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
148s
max time network
135s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

account.html
Size

784B
MD5

91bc627ea1b27d968bd8368c757d6dbb
SHA1

a54ab25bf1246fa6b568a776bb76109fbe7f6d9f
SHA256

a102d56e4cc31e4d46e1d422f6087db5b6e96086763598eaf07e9e007f4376a8
SHA512

fa214e2556956aa05ce80971cbdf96cb148b080c9cd52d89e3c611a3496e9a7ab8d30e608086a4e7de326b6385424da43053b4dad2bbf6c3ec4f599dfa121cb0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404998894"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000008b7afe1e9055e6b3701222bca495402d61c8122205848a5e1f12e701642d2622000000000e800000000200002000000059cba28bf00834896756d8446f8123833ff71d517604f20a0c3402ea46caac0a20000000289e983673857a20dc617d4597f37d84179388ce2fbdce230e411caa4c61e3b8400000002abed39e1ca14fe2e739e366732127b1286ef4a2b223b62e2372254269835e55624d3477bd9b9472ff98c29cf77104b8e78af79dba8e417ea9d35f968686429c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600d7f17b40cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{422E0D91-78A7-11EE-8517-FAD03DFA5361} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca410000000002000000000010660000000100002000000036f48dc3bd615d78b709a191ac9b86f5f26a0cc8ce7e6b73f59ec783808a7bcd000000000e80000000020000200000009d64693abb43dd46bbc2b6152876bcd05a53fbdfdedd71195b91682660bc1fec90000000fd4775f9c18bca1000d748010641a91d4191b4c14e83b40bbab2a835c92eda5d026df4fb4a015c5b9e71b0723e1f188bd1542afd55da70f68850de01b5cb5d9ece58eca69f37bf3ae556f8619f6442e0849eab3367fca220bdde281d9b775216b6a906782a5fbc52b79423707a08fb976976c433cc10472048f7b4a69b7c345466a23b251786c93d42cc20fd0d861d6b4000000033f6dc554e242efc005cb2225ad55dbb0b14a2434c5bb1efbc391de7b7d8baf1cf07b3c17fcfced3496fc12590f10f43fed06b5e808ca0332bc64c643a00ccc5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2164	1516	iexplore.exe	28
PID 1516 wrote to memory of 2164	1516	iexplore.exe	28
PID 1516 wrote to memory of 2164	1516	iexplore.exe	28
PID 1516 wrote to memory of 2164	1516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\account.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754316c2daf12f8d9e21696517a7dfa9

SHA1
dd3f346e9dc20ae54d1713edd0f524ecdd8c36af

SHA256
2e0d68f4d4887aa9bfc5bb46fb20e2630d538b33cf785a68d3e5cd81707102f3

SHA512
aaac256f510efa05dad370eecf71353510680e0383cae0970e2279ef4dfb0930cfe5ea9abc68367c81e8d2b0ac4756b91b98f5f3ea74a3aaf76546fe09e25d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e62a5ebce07d8c404a2d9222432b800

SHA1
bdceb97a1526cdd62000bc9b62e095e0e9f1cf5f

SHA256
9db3cd159f65f6751c3decf84b52270a18a85c32d52bffd577bf4e2a708c95aa

SHA512
9e571f8c8a05da4d7d5941991617a635c014ea894d8528d43b9c0e69c47249ec65167ea81a65c63e3f052baa40eb2fc61f96697123a0260a410c396ca21dbbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c4ae59cafdaf7cf5721c521ce7032b

SHA1
6a5b53e1ffc020c38199846ebef7627d28a7ab87

SHA256
c7d56c08f764073ee6e76758b6f605e6752a7a76193e45d058a244ac4ddc2a40

SHA512
635e238bfc374a26f2ea078e8cee21a550c6ed1af3a2d4e9607f6ce65028e512c613a83d8df6d1abdeb49a2d6343072edefa850ad1bdd4084f25298018a675cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e34a4a80b01b6758520c22bc9eb1a8

SHA1
ca97243d2c0511cc4b14e2787f48a64e503c7954

SHA256
8ba637e01056258e162264440e761161da5cee90909338667c68aa65cd0a4f02

SHA512
026331f5cd34a474d716be326b25702407a0c30378fb99cb8a09cdfe575dff30101cb7ffbe4608436e98b726ad0b6ac24869d3b96fa9e17f4be39e26f9478b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e47fd4d85c5867371dee8235cd052366

SHA1
1019f48378048238cb2d6e2fc39697ac599db9a2

SHA256
c422b5e76907ed4d96474ddded433bc16df62a870598f260f48a1f607c8d6a70

SHA512
bcc2d0fd52d82d9274982c303cd0597c8803b1e7395cb784e9c206e97b93b5ac984166b4f9b89ddc4cbd104900eaa7e2a97805174ade82a759a4fb74dda15793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8c588888815ffe4d19bf7e007596f3a

SHA1
e077b61361cf89bbf97f63dd4886f7060dde6f9e

SHA256
8dff90dd6945e70ff6e356b1d5f94ae82d49825509dcbfe3520280f3ddb7baf4

SHA512
18d112a4477786a4185f8c4b9e6848f3bad390feca21e5b4eb9bc5e45e02ef4a95cfab80d75b78f5740d7d11951d5143973b5435b77d2e4a1600789a251e6650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a4318867754f1f65f2b601383ce305

SHA1
49f92d68d65b58902bc5172f4c8e5d042e8aa54a

SHA256
bb3df4b6c054940233ea556fd2432b29e33a5ba6523793b465995fbeeec88a4b

SHA512
05f72440716d48d88c7688c8b3bb7397cd1e26da69e7d40c7c6d9d0993d1c41672d4bd0f072d3dc75a66276c7c51521080270f9f90e11dec687f6c1a23815604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dfa933c7d3c7f4a9b7e96b96fa18e4b

SHA1
4bd422b2e35cdd2a77a11c3343fa8fc674c57674

SHA256
f5b6707531b65325f9550d3091ce079cac871c6d6e9c3f5db582c9daa94b9677

SHA512
3a6b4c7e4b90d1e1e567959f4a29cbb90272b4994c16397bf1a68ebc503562ed240d22a27d02eedbc840cec00beed9866e74c8336921e51d2853591d860f24b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6938742e41c8aeb0c61fa3bba0bcf8

SHA1
4d32f98ac2a5f8c3a2954a5e0211e107bd191237

SHA256
eeded526b3e045dcc85b875012f22e6732bbda289ec355ac0da8669c4a64d583

SHA512
3f6fd13ea85dd3cd204c866c50fc38b7ae943e5346e28b4c0617120c5bc99f19af2ae1aca2edc8a866bd483f10aa1ba44e981d618e0a2eb1ab47683990f481d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b820a103bdcfd85fbfd4ed1650e5719d

SHA1
011989a946e4f2bfe4c30b7e7c71e82765b4f0dd

SHA256
8c8a3f42f4b7df44a3fbf68faae9cfe1a8ae43a720beb01e249dee9b4e86ebe3

SHA512
b158b1a2a6c20198c66459c74b7d0a90de37728c75b6e2c1b3f3a1078bf6e031ec5d9968d3e230501d8818af6c01da45567792491a9eeaa4e3a5fe5cfbf8bb96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a2f7b8387494d03b7a112a85b31674c

SHA1
eb7cc046ef4f1e11de267b8d2177d815514c3fd6

SHA256
9327423296c21ac754505d377d0dd069df2babd6e711035807cec898cf2ad790

SHA512
a39f936950f3f9f1a2ad327b973906feb5b36bb63489790972dd0707df22abdfa104455f34e77ea997979fef541fe72be7883da285d2460aa04b179852b21469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ab70537dcd276e1f04742ddff3deb6b

SHA1
374be93407be662254ad0d6279cda0935de4bd20

SHA256
378002cd16c5e8a873aba4fe3c9d748d33bae7e37de6fd8161b67758bb885436

SHA512
b8cf17b1b16507651dad273570cb2e17f1a46ff139298f3a6496e730ae206716d0a6bc5a14a8e2b220d41b27fc1b647cff1298ce909e93aa2ec7bdb49b77df2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2d54de2d6d157e65df2c5ccd62e603

SHA1
ff5903cb67efb1412ebf6aeb5b5060f2c67ae50a

SHA256
f53bc3acf3adbca055ddc2fc37c5b6237f40fa843fe5d0949326e55a3d831e0c

SHA512
02a5c76a01dd0526de18c1822786533b4983a27382770ad41b1f7b2df0a4bba7e9eb2a6abbcb6834a021a10d208956cebb5a86645402a0ec5a3aaca43eb2cfd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d997436224862e83378fdee191a641ea

SHA1
a039407fdd0e87a8ec627176dbc64b08de16a9d6

SHA256
fef9e373b3fb9558cc553357968c7960c0e14ef43f82710bf5df1ec8ea0be4e2

SHA512
c3f32d046aa5376ad85e8aa4a58dcd17728b91c4ec5643c0b9713231a93fdc6eff7445249688bf6126e9f008cd3ef465c880c59e37bb3e507ecf88d3da7f63f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24cdd5c6d72502bf5ef5bf1cae78807d

SHA1
5017dd092fdaee1b25def19f7e1861f728ec430a

SHA256
4f326511c908d5ab3809f0b6ebbd60c38ed0cb46f231f42be9d813590700cbe2

SHA512
59064e501e99692ecb8beeee3a90c2aef4d8c846d44340dca18877c0358ea83693965787ae4d62112ce476814bbdcf8d04e4a735821a446af9bd25ddb0a67bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7CE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB83E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit