bcb299ab00ff5ea9eb4b2e252295364e68a94131e33908f5363897fea778558b

Analysis

max time kernel
121s
max time network
150s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/1.html
Size

910B
MD5

ff25e9ef96c9537d5c17afca51a08658
SHA1

4e13af518998ffcfda62892d4e0b15f7f835a624
SHA256

c0ce6793af051e810496ccf31e9837e6856e76cc43aaf5944291c350f6518807
SHA512

e7d847d7cb6fc56fbfe2e9cccaa7bbe62de97ace3cabfd324342fb7d83bc15bc4f91c84d56aa700e276c3eaab3ec5b91e55e7591b8d33cb371d352779f91a76d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03658ec520fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000001efe596c2c83165143fe3b12d6c30382339c7af6a53a8a985bd0869c02c37580000000000e8000000002000020000000f85b9f2f238e8bdfd2be0194e09e9e62f6eed1de7812d6f158ac6244ee523844900000001b69f9167ce644d891b8d8396308e0358c69d111bc8211e7ab5c54df38be2003aa282446cbd670522e459906686c1467e88513e70662a85d85a3ec89c83aa516e7ae6d5baec4c2d9a9b2246f9257428ea35cf6571b491485bbd4cab52c12a52b12d229ecf2aa429b6c5b69a75044300d83ca859d9068fb8d62324eacbbc7fa95eda7ee31905c3647bcc158ca91f0348340000000f236566f51d7b7679ebcceeccb3340eb5db94e55a83e5273de79650d2849a7939c80c135e773ddc36211a3b3a31f9f39660d59a60c209509d5b77d9f4142cc16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405287014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17A3FBB1-7B46-11EE-AEB6-5E10D214D0C9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000732de3ee504708bb90d2db46fa42f07e3ea787d9ccf3a38727d793afb18ad97e000000000e80000000020000200000009e6f98d09f89ac4a8e528c47208a1b1da7b78c377f33616e98b3c18fdf2a7b8020000000d0784a8959471eefc2bde0a8a6a3beb50ee72e494738e8c1495950289362015c400000008c4d276197cfd674604e5356fc60609ad874a89d59db114e762383e7459bcad4cadb7edd3c75a87fcf5252a1df5f7d4ccae4b7b3216fde6e3fe3709174a2bb9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
800	iexplore.exe
800	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2416	800	iexplore.exe	28
PID 800 wrote to memory of 2416	800	iexplore.exe	28
PID 800 wrote to memory of 2416	800	iexplore.exe	28
PID 800 wrote to memory of 2416	800	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6703c27144d4a2a8d3aaf28d08dae2d

SHA1
1052efeeaee8f4bc882533597647b1c570bc3771

SHA256
4f89e8418cabb336648c937eb1205e9fdfb006b2d4476790c5d89763648bff3f

SHA512
8b098efbb9073a205620302676b9d45748696be479c881d18958f2e8267d038edcfc6379e693fedc6420dbba5d4d43a17fb68187a0239f0221ebaccf5b19fe18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f1bd933902495120a89b8d564eab8d

SHA1
65ea55b8725c798481f8b4fcd592115baf415af1

SHA256
8dea9b560c90d87a70113bc86f2d1a5252c58e6349cb4d598de0e648b6c45dd6

SHA512
3341e7b49ae6ef707a01cf7bf027d0692391608ee91ec5994f5c39a5c384dc21de7f882dd378dd67944f70384fc625d7e82b1835f34ca2455231c893bef0b3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7236292c4505963091e48ee8759b1929

SHA1
23787c88ec092de36832d73fe93510eaf2e00d71

SHA256
82e15460d65b85071da2e76d511d8b17b391216cdbb635d59fd7e51dee5ae6e4

SHA512
adab8f3dabfdbca5020fc83a22ffa664403564d632a9561e4520c2d3dcb92e62deed2f7f09e20c4927c76f4944ed0bfa5dd3467ab8a6b5a242e019e8b5e23413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5f88fd7cf4f22940a0545f5949b847

SHA1
cc5ed5ad47fc143f89e7805853cab4e3a5f0ea3a

SHA256
efd58d3e725d614b9b1729957403d6e3e959a651d1ed91b22bdd140d987b160f

SHA512
fcfe66bb8d0da910fac262fd4c8a1b9beb170d6370a08dfc6a9d2674a4d50f8f7660d227e995e72937d24c3f51deae87247ca50a30ded63df548741ad97c5eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3233fe4c4ffd15d4b9aafca5012427

SHA1
32e411ad5fab56f045b4526aa39d04ddc7d76707

SHA256
9f49c137cf639a8fe3784e4d3a81a0f7fd5fc08e72b27afa04f4719badb9be76

SHA512
142be4ef7a6a71b3a0ab6731b9f02dafa10621345e0951dd4f36dd9b2880543811deb6b94a84f59274837949ea81d144457809b1b04999bcb1f7e59538d9029c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9347e809ed667f657feef60a38b900d

SHA1
53720d3bb69537b2f6ded5e54884c09c979e1ee9

SHA256
48dcc41a0d748ded1520aa5d95988a6fe3313d8996da5d96a1caa08b895c41a6

SHA512
a7d70ef9f0f7d7bb0dd11227b7653988f42a7ad819371057d5d2c58c970605b1d20d51eac3a012e78d0de30f962ba7797e953f1b8c4804e0610e8e32ffe1cd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb3fc4cb77a225394228abdcf313b689

SHA1
32e7e4f878f325ed72e09e2ec8db13bd101469f2

SHA256
a845a319b4742184bcfaa913158dc69f3112edf8794bbc6561fb53755fbb63eb

SHA512
b8fe314d303424e6a0c3cd041ea866776a558f4d7f239c7ee0c72feac2b73410b01174b241a6f4352411b9fe23abe91d0b3470be049f18d9d31a23665306f4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86360e1f1f535d6b50dd03026f90d626

SHA1
b7572605696641d1620766ea72996c927df05b0e

SHA256
d6c944919be4c048f61c8c2ae5105abae57dc144aa12afc0f43965ae85eb9eb3

SHA512
033e42d369ee30c166f01be8a157c50b1faf2f29badf0fe6359ead75fc4e5fbe49881ca843b930488f57695484bfab07b66696ec79df0c2a38199f1d5c13ca6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69627e46ef30ece45d5405321fcb51ae

SHA1
7a57134d8cbd1a154bc97924a98b4fd142972fe8

SHA256
ab6e11b4481ee77726ad265a034539f4d7d09a23194b3139c08929d95279a145

SHA512
813cf3c97dba29e78fd0378c14463c19a8b473c9f193f379274a92cb063cd28a28a6a18c904861b89fba91fccb2ec26e2bdbead1caf339daff495738d96a0ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac9afdac1c0bdadd9d5214c87b50bc81

SHA1
535af923afda7ec7c80ce731620787bb28d92c88

SHA256
dffde2a204c1545f940036c2370566be70e911ff25999cc050146bb695a3f871

SHA512
e0f1d3bf3d3a88ea56649b4a9fe33269605b3d688664850201cbe012ca6db5cd8c235f743168cfb01e80063176fc4f4b9f7a06322433d0810449a010d7be615a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7536f55276e54238f46ca7041bcce5

SHA1
33eb8fc91a182902674cee590630cd42f26826c1

SHA256
b1e9ffbcc9eda99cc3181864e4d3f11826bd1ca3e8ebf6c9942de5ab8f570ec5

SHA512
fedde21f8fde10f8414ab25ed608179b2c2c3449b389a327454b12e513d8dc52e43a7a16de66fbcba54b1564c8581104f1d879743b201ab861363bacf64a0ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFF1.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB023.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit