55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
172s
max time network
173s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

add_new_address.html
Size

2KB
MD5

7e729e418a7329ae515cf56fc4f6163d
SHA1

bb27d1562ed8cb07529ca67330944c9cf24414b1
SHA256

ca5a3b76d1ad77d272796dc2ca1a20c5c2559bb1adde0802a054dce6c780b42e
SHA512

04399f0dcbb19bc23afdd17a7fb56d9ab056d202bd2a51c4acbb6b9557fab74fc6661817fcd541def2ee1e4637b3fbed924969557a78b8bdd5d1a067f444b0de

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000005d053f3e8c3dfb9ddcec92b0317dd141cd2be15707e10443fedb7d417c3bd48a000000000e8000000002000020000000a38ed63a6e2c087bfd8bdf6a383dc72b3cc507d9565796f29d9ecf34090e76ba20000000d846aa5b89c7ccb0d6dc0c646f0647ccaa0f4c29acca8470caa18cc8bb403f3640000000d5c3a0fec3e7f6ccb3bc050a3c0947dbc8f7ec6884aec26c582aa8d3b822fe1dd4b61e73703be40ae15f7ac0ed52df77f04ae4347d59a3236ccc9e5c13bcaa25	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405108618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a6f891b30dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000005ea25fd82992f0110d34fe0664d0c3de016ad5ded35e79b10a3a585f6d7a1366000000000e8000000002000020000000eba1af8d36c9e52ab0fedb372b2b04e054f7860c0ba3345f4383e2c4861005de9000000051b1610e901c288814e948ca29ebc71ad9e318223bb33812dd2aeacc018d3307d79f9cc720bff7d88cd9f4044d0ff4d02d5ea08f782756297eb8f69f3ccb9dd4eb3face4ccd30261e5239e337cf92cf07407bfa5483a29e54b0915abf1123a70150c8cc3f3a5dfd371a935b077c6601dba43ddfa9eb7d40134d300f052744007453063b83c92417707a5f3d698b1f55140000000032fa369e7622cbaec72c66a4dbad5bde1b068c40ce91c671265ceb6e4e2a0c73c6519547d1bb07340a5fc5377cadc79d453cf966122e3226779ece7b6f47fe0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA866531-79A6-11EE-AAF4-6A9A6F1CE8E9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1712	2224	iexplore.exe	30
PID 2224 wrote to memory of 1712	2224	iexplore.exe	30
PID 2224 wrote to memory of 1712	2224	iexplore.exe	30
PID 2224 wrote to memory of 1712	2224	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\add_new_address.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90012fd76189cbac8a1e355a1270e314

SHA1
b0c5c71a1cb0f64346f7346c7dad3f6c057633d4

SHA256
50d5716e7043015d7643cc0807b7c0d013f93aceb1464af9de8c307b51500949

SHA512
4b5a789612ef61534379bfebd2ac56fb4077d94da8f4e75f315c16a1a815a3b7985e326092bcf0769c756397c182d73d69c002103ecf6ec08522c566da6f9652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97508236b1328ba1f8a5f0ae7384b0b

SHA1
020bbaa52bcd0dd729276095168b8383096e0eb7

SHA256
26a62cbf2df2424c9c8456dc56b6861cde9ba391b67f716baaa85e62f9f4b33f

SHA512
4819c16e12b7d9da0e0adecd35e0f8e78a92a8d045847250936d4828bba883396ef5d8d0bb34b64582cd1bc2ca0ee4d3f8e5c08ab53ef1b7fc675e7efd07101c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6056285602eeeb9ff258d35ef83c291c

SHA1
e8a1f99132b8a55ce0429d87c8d66c73362469ce

SHA256
f9b32a6df7a72632413cf88c9a4a0ce97ab41c231f4e513f21f1ab4843eb8901

SHA512
563c1f6bf7ef08439031901ba103dc8f0e929a0888febd3613e1a5f38888b3a20552f4ce49b8b65207a19542bcecf831e96ea1a0521aa4d814452d193c036d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461cd8c3251db7b04a3dab9e360638b7

SHA1
2f8391c3e77500207af7e54df4eb2a90a31d4d54

SHA256
eb2b33638b4732390019f4d30c3ad2304c8bac67bb76b1062f6463e8aa78baff

SHA512
75afa5db6fc9164c5498bc014fd036603bebe7d74e8c1d42ae4e4194f9d8364425def145ef22b1618118bfee0ad67fb869110dfe1e925cd33fca66094741dc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35ccc2f400eea8ece557c398b27fd49

SHA1
d67b09bc0dbad8733ace50541767c6c0942cc70f

SHA256
434c5dbc1a61676e6ebe6e1d77646c0a99710604142d52ad96892233d456948d

SHA512
63ac52ad29ce3599ce7749b62d54b4f83e174e566daa364af9db1a9dadf929a8c676c0fa51a52edcb31d7a614145984cbf82d3c3855468e74745db3e10c1a805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
302d59e29ae66d004aeed8080712f1fb

SHA1
24fc36f192c7b22eb70bf750efada29291875cad

SHA256
0d5275792d488b6aa45b4accf9e81ce73682c6719bbdff3ce9dbbaff2d800d96

SHA512
35161fb97fc8edfb42220a016e1ac431cbf7a43b84b6f08ccd6bb021303c50bfa52c1a6ccf1235307f811d21afb82d61c3ed8b7207b558fe5919cc61b85454bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01243a72499202f00a4dbda5189415b1

SHA1
9e65d8deb04373f7f8b81c45adc2c85987a08f6b

SHA256
5105964172b938408d8cf594e7e44c6ccb781aeb6c3ab33c286b52498c03707d

SHA512
dd0dce93f69484e70f366b7317b957ecb82cd4945bb656af5df442581de9f9c6ddf8ecae3297b72af62aaabeb38c66bb141decb3029629e548ed0ad1c8c76703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01243a72499202f00a4dbda5189415b1

SHA1
9e65d8deb04373f7f8b81c45adc2c85987a08f6b

SHA256
5105964172b938408d8cf594e7e44c6ccb781aeb6c3ab33c286b52498c03707d

SHA512
dd0dce93f69484e70f366b7317b957ecb82cd4945bb656af5df442581de9f9c6ddf8ecae3297b72af62aaabeb38c66bb141decb3029629e548ed0ad1c8c76703

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab409.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit