55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
173s
max time network
171s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agro.html
Size

3KB
MD5

b742111196cf03d2e0f1f9fc0be9de42
SHA1

5353cb696189ea7995b45a5855000396a88eb607
SHA256

33dfb23da71ba1d5a40cfabd13c8f5a5a673d46f923325d06e24afe8ae7a4763
SHA512

f087701225de8ec880d6703cdc42ea3eefe45eb16db7ee2c37ee40115c0f6711bdd358a0ba3549262c27ae02c601707640358f452bb8147c2c6aa82644981357

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b013c48fb30dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405108618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB0C94C1-79A6-11EE-AEB6-5E10D214D0C9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e7171840000000002000000000010660000000100002000000000f32aed9d3091eb2d2e931e62123b01714b4558008ce4fb2998ab96d4bdb681000000000e8000000002000020000000fe146c5a61b1a8d37f00b819bb7f6d7e2927630463429933f8fcd96f5738b78e20000000a52e2a1e8810743c05ffbd1b61de78268694548839a52d5ee997834a26b93e4d400000001d0cecc10ca4849eedc322f82d1199a93616727d858799fa1b2e825c190ec674957480d98b1d85e388083191cfea4f3c80b605e2fcc70e805ea63e76b2cec498	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e7171840000000002000000000010660000000100002000000010812f5710f2f7792181e34e16c90dd55606e87864c576b7145f806ea0a66583000000000e8000000002000020000000eeefd75084312fdcd4433fdb80f7076ea72d80f4c25e76a2e998c4cf0acc57519000000099bbd0ebf1083509708cc17eb037a71e9f8ea17d427e8d04d1c7f47516c4c6b52ad651dc8bd3e6c9edc047773ad515629b75f0ab43d33398ad628d564b35543f60584310f13c598961ef53126101cbe81eec9fbd86f003186c91e94816ccb020df6677c4d1954e9b7f371c53df23b5ccecc28f84a99aed1b144b80d3dc35504f5552d5d48a35a4a6c26aac9d92a7f8ca40000000c352cf402db56f88794bf8512f457141bfde5a3e39f244cc480447ccc4308297c82363e61144dba7974ccafe8613a97587606f0633380ee90f59ce012238badb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2956	2192	iexplore.exe	30
PID 2192 wrote to memory of 2956	2192	iexplore.exe	30
PID 2192 wrote to memory of 2956	2192	iexplore.exe	30
PID 2192 wrote to memory of 2956	2192	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\agro.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74eb4881bc6513f1421ec93496990ce2

SHA1
0d36cb0a5bccbbec8ed691117e2303728248f4cb

SHA256
63e007f521c79ef12c5115fe17163580718f18c2d95307080cd376a9a41c76e9

SHA512
85e9b0a5c0477d9fff7667ee5489236626ecdd65b1e8365dfaddf588918547dd60dce90d36ef204629df76cae5b45b409e4ac3a8ba0e5ff08f5b654f0317f49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d402f9b03c9c07542db1e19ba307a3f

SHA1
2ae766d0380d8880fbf3d2c193d2bf34cb476069

SHA256
16f60fb3d2f41d4d0e1a392e650c4566590c4f0521b1e72b3fbf316d0a585ea4

SHA512
5ea1da900744ada749e849976ff44246d914997ca3ddb6bd657b7d05757a517b5e678fdc1ff69723b9b7335fd37af2cfab7b85542c48d1c49ef9b441ada1cd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0988266f2e785fea7642d4bb502e569b

SHA1
e0b5ed94c1fbd52be7441fa97a67490a1128f110

SHA256
a391a17a213dc25b5baa9b97f7d63a6d553b28ad70bbb366fe7b74affe37d27e

SHA512
25d0d95971b2b76889de59f26b9d2fec59c91736481877da63b88d53d283e3725a158a06eee8107abf22166c53d23cebef987a026e6c333d15aa3fedd72b0949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac8a01635bc7fcf6b06592d8f45a062

SHA1
5eab81a7f4ea2d6e0c178c25358ccde495d60bb1

SHA256
14231a492e749a06c70b3c88669b2e215f268a8cc594425e0026e2b6438bd2d9

SHA512
531bbdf3aebc29a460f5d46f051a1d826d4d71673a3255ba5dd83f0c874b0bc56d54061516a829ae0d8c34dbe7792315b19241ea9b1412a56e8974c74fd73b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e53f7835478302c2495349097ecb37

SHA1
88945e8cc7b597b9993de382eae951977fdc7b7a

SHA256
20e16419e82227fdeaa0bb5b3ba0a9d319c3c149742fd70d05b667fc728056ad

SHA512
f5f94df37d1b45574ff05c46771a0233678df0d36080955dfecc2dd39fc198fa55d9ddb203c13d2fb78f1b874ca43c5edf49bdb6d32ba0f26a45876e010d8727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d36d3920f89e01fbe2adeb0cf18b7abe

SHA1
3fa8c276f69a1963b0da39d7df5e938ca73701e4

SHA256
319b62a6b4d23760921ed96ae98c77b6434a1828bf616866b2b2e93d4292292c

SHA512
26bee9bb6996efbe2fa1a4fe7395c2a3495bfaab5d294e1654b077806f535b13f220587c9da43e82e1fb91f73f949304b318941d075bfdbfc9e34cab5c99097d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cc3f0d73ba0d64426a9a7eafd5e2151

SHA1
c33baddd4aae57424a2a77ba38a4ed074775243f

SHA256
548062466024c369a82b98a5b4e2073853b799463843da1a07dac4932be8e793

SHA512
23d9068e771bdf63bcacec5829359438b7f68f41b8aec8114577aceda53ac5fc7d511b9325f45c9926ed1ba5eae4741d61db97d1d6e8938381d6df00c09b0d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef68c073578bb66f54f0a1513773aaff

SHA1
f404533cdfb7572f55cb6cd349e9dbeedc1c4d12

SHA256
bf350de624f8747a10f493ac4a54bffea35a86672308e3e703683a52c44b9670

SHA512
2a32b887f1d99ba02e569c6b0014adf21de63a299c202cae80f37cef0d2035ade1217cd14790a2378bf25ba59d4e87c83371fc8ab7158953feb76b33925abd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7684e16a46a61ac367717bfafab66e9c

SHA1
22482ca6424ee8d1755cb38a80088d8d647d09c2

SHA256
017b825a6082dc47f621c34aa8798dd5a3c24bdf0c166065dc4599a249275a65

SHA512
7327bf0a66e5d58dba9e71e36a18be3e48a98289a89b16beadd5dc8f059a66d7b112ef3a301b9b7643ed878a1130c0296f13249454106508e4bcbb0ee2972d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4ad3c1c2fe3739291414f60a1e947f

SHA1
61eb01d27d9a5845a17f06a06dec6253d2f216be

SHA256
6bdfe2d77f1e61fe70727e4abf651d6ebec646a19d117f9b8cbc57370478ccfd

SHA512
85b02b1f5a42aa06e86219fb7ac24bb8e66988869dc09c748f37535ee1da23451bb3b3b4ca32f1c52dee58853ad3fd984f5cc4bd6c579fd3d095898430c1ada1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0cef7108cd8f24da60ed8bdd6dbe71c

SHA1
7af78c2ce81f6cd9478ef98cb3d0553cc608615d

SHA256
c5cc730c007f631dbc7f34a5094cc161d240c493655faa3043737eacc8ea2d88

SHA512
0abf73942e6605e83a42d42ff205144f8053be21ede4b9ad55b29d441a3b0841d8e453fb316c6b508418f0e952134c712424ea94f40af242c3ba5f04b91070e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2504083b0b1ab181f25b0415ad9261d8

SHA1
63e66edb38815b4e53ec1e844197d281adc0e892

SHA256
5f351ea4a235f67bd6605cee6b5d1befa62d8f7364994dbcedb74978e260c114

SHA512
c8438c97f77cf608ed16e5d98e29e5ec37599057400690b42becfe0ecb0c9e2adecbb665422cea20ffb26c9804caccff47f82756010a0dd09297d1f09f3669f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb10bb9d88e17575bcac7f13e48711f

SHA1
9e266796504f7c86912c9484cdd923414692360f

SHA256
834eede7f4ef7ca00977edc0ef4355c275dcebf6c2d14d30f414f071d4f70620

SHA512
e2789c04dbce62e257ce3814dcc7454db5b250e4d6bb44f82afa698d93750b63407a8750da46bbdf58e97087642e9fcc7e2feeaf0a36eb23f640f22efff92b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b53b4cc4ca690f4d4832c8fb69139e

SHA1
0ac95bb3afb563d63c7398307b7b7f79e2a06731

SHA256
184f5fc35fa07794d16539090c26e9133a3ae86eba8c9c727f67b45272493b9f

SHA512
ec2c1337a11df69051cd24bf74ac87efbe96329ec713fcb4cfff835b25189a56153a995558f4571fb9219854c4bd4408e3236d07f14a222c1cb22e78d35c6622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59c0222c3dfc3520042a2a0cad3a6b99

SHA1
6bde7a6642a5b14ba161cd3ef87ceeecfbd4fc0f

SHA256
c4a93ada701fedebbadb768813d0960aaff7d81664830a8e91dbc1e4b2bb0853

SHA512
7845a58ce4c643fa264dc3be5a230e51baf1dd3645591f44d3392b38f647daa2cd3c854ec1c88cb27dfd77abf32b66bbb708778a937bf680278ca151c5510f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f3777b881d423ffca6a7906e06b7d2d

SHA1
520e5bcf306bc8e372698c695cef1cb9a21ad737

SHA256
84eb8dee855343d7db88e68e2190c4012fd06ae60ff6381412634eeef3f0abe9

SHA512
e499b05552b078358a6ca37480c00494c8c9c6a32665fb729244725ecdc9be1d5e1aab9e42e65a19cee1204f2e7dff94b8d591bfab6fd3e08d6913f19f90f114

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC7A.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCDC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit