bcb299ab00ff5ea9eb4b2e252295364e68a94131e33908f5363897fea778558b

Analysis

max time kernel
134s
max time network
151s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/2.html
Size

2KB
MD5

8396eb3608b0203fe6146c6bc4bbc6f2
SHA1

a1864c1cdf5b3ce42f6a4d69390d33746b47bab0
SHA256

c82c57117b93ea85b61f51ded776beb44ef1705a7249165945f345ff3fcb0ed9
SHA512

bd4046aff03198602d5c270011cf2534063fd4fadc5609945c087fd2a56ffe255b257092e612b7cc0c9b3358bb5dd6a221755a5c734816b54e50c1ff145c3be5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10653F31-7B46-11EE-817E-CA8DA7255242} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000009a9a86c7391fe51055abb6449eff5f87dc3fb3f19616613830584324835e8e13000000000e80000000020000200000006b6f9de67685c69b6b46261bac1a0e7baf7e910e5d5ec2c1c3ed609d6d894eb990000000964840d274f52545af5340c54ba14f5bc2f40c98c48b1195732da9df109b092c963c4240bc887e51e0227b906fcd7e401c0c79a1f13d5de1db98017cc52de59c6a42a5f99de508390c9e7facb67bb309bd957f16d95d08af4e4ed417904d60b0a39e613b51dae1f6b2b6e96b640eb32b8f0df04b8fe5bb152571650ffe0b37fd018b951704b66128e869acfc183a5d9540000000402dcab1489450200ab78bf713b0248b06a061650a5aa978816caa4061fc6c09a268fd40df98523eee9021f99e4dde7aa437919471ccf71ae3afa528a12d2883	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03858e5520fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405287002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000fe32cd42994b01263d62b25edd979dde760227ca44d547e68407163a67407cc2000000000e80000000020000200000008996ca121891e5c8cc8f55075b2b0722ad52528480c7aa5b0a76ba2d7b68a2dd20000000c9bc7f4d0bdb9f9fe99bed2b8df6fa293cb3466686889a0111b2b040dfc702c940000000f23fdaa495d76c673da069d34134af0a3016d9c9129fde7efd8c05ab701b39ee1c990d77135e91d62f03f4030b8062e6295f491c1db872f1a5043d959caa8fdd	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1776	2220	iexplore.exe	28
PID 2220 wrote to memory of 1776	2220	iexplore.exe	28
PID 2220 wrote to memory of 1776	2220	iexplore.exe	28
PID 2220 wrote to memory of 1776	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65bb30a96377eb6a0e567a400234755d

SHA1
fd73953c817681f183db91a6e07355fa730ccb6d

SHA256
61fd48b70436ceef9759ed1efef5dfdf06b18293331b44f30b693be2ae784fd4

SHA512
b09b006a81d50a034e85f87ef74b5ba663eb125d05df83488324a38a469a9adb299cff9bb90be1332fabba291b565d6a1fdc3443be7488d8ed6bc64c6a4586f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b80bf14dd8ca5bc79425aa2ab9e091

SHA1
0210890dbd358e0a78fd84a9562df5beef0cd97c

SHA256
d810133042a2931d7b543943400077d13e3caf858db2218b113153c3427ba228

SHA512
ab668711f4ee05d8e1d4b5171486b4a53dd1b6581bf42d43a499a4c61fb0db3373ad1f33fe1b9f6985517b8c6e0deb69123541dd2f49952ab6ed6a0f75a43baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
624af0b339c7389269804da45de1eeb6

SHA1
2c50233785ded6d121807e4040ebece228d33f32

SHA256
e752c455376ea576c70af77ccccf36152622b9d9cd01639050f6df3736fdbd16

SHA512
8f386e16c60b1d64167be20e782585ee04c5543ad8a328a30d6aaff28badf1e25308cb9e9973b0956faa4915b1240b4a7cb3b1928dbbe88a1fd98ba486857eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
186fead91e67347a25f64d989c717105

SHA1
4e6ed40ff807b186b22f3c11c107722503e081ae

SHA256
8133f041f6e7863e68020ad44c2ceb7dc649a4288b90c6c32e0fe9964775c7c6

SHA512
4254b486e39026c2d3a06950349523dc8a2afc7baf6c760fe05f09dce46040fa69223d7aff540e6449c1aa934a4220c09c21d69a38de2c5eb46204fcc75093d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68f9a0886526dc52780c6cc7bb31907d

SHA1
a5cd6f49f9592a0f99a53828b0105b6e7eff9cfd

SHA256
bc051cf877c9fd8253fc16c90075672a0b69720fca1cf3f273c85b903fcaa07b

SHA512
1a24cd208f6a06f1de6964f263ec57762971769eeb8dadebb2d963a171a5ae887d7307e77682e15ccb29f56a698bee080dddfc042ec235eba0c18c42ec3e82bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b75da963e7bcbf672ab6295f84023f1a

SHA1
35b566ce761ff646ca8770866c1c53e3598807f6

SHA256
8acad5fda419485fa860d927deadc986b49a294f481f3b71950f0ba263828264

SHA512
4db8f6867aec39a86985934799dd39cd205fa74dea5b27644ff563717dfe5f402fc9ed65bb37c604304b73b6791293cd7ffc5d28eb67ca17b797adb30027cbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
219e2f2bdac35ac3a17932897ca1fc99

SHA1
bf4aebbe0778cdab7c86a79023ffc452c67d0724

SHA256
f52eceefa1742bd388ade462e4797e6597e3252cd67d08d7ce91c26568ef3671

SHA512
8f1a94ea46c3c30ef80afc983d2e4b344f17e3c2f1d3e72ae33438132f1b3345303db3192712b99b6cd061270c7e15cc9232acbffbd50da2e7817cbdf48b0c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bae0efae9b3c05bf8575028de872072

SHA1
5615c259b03a867f1448399e9d5a4ca12baad1ca

SHA256
64f54996719d244afb9d6ea3f5bee77f340ca22002271dc4e76f9b3d7723e57e

SHA512
61b78dd7e3052676bc0b137fdee8aae4425a245321acb5d9ce82c3c140b191e3c79ac9745b87953046ef4f3e3ed3c702438895400c5de859809a8514a8c47855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d94449add483864deac2b31dfc206a6

SHA1
4500b243c1ec7bef64999961cfe7264a5586f995

SHA256
d5964de0d6e46da2a5cdec2b117558f2711882a58b5782f73c9681dbb52e57dc

SHA512
0fca7dc88a45e749318f887e67297cc368855b936bb61199ffd6c163d625417d716906e37a0a4cacd6aab4ff9962c0b1fd03995858cfec8364300b7ed274038d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA621.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA692.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit