56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gpl_3.html
Size

33KB
MD5

5851f1dcf33b54befced1f620808e985
SHA1

315b4e8585e7b3dd295cd6ae14acaa7317e949f0
SHA256

ec7755520ab49908e26961200839cb5716f483bdcbb6678a23b425196ffb499b
SHA512

ffbdc7389cfba218e3e752282e953b2f9088be4e138e27f73b1a48ce0fc6331c30bfb88f392b7519c15ea27fb34d6383401f91edfee24d6a1e27ecd2e606bf86
SSDEEP

384:Hbslv0tYdMy1Ic73GAvV+XbTQ25IT3MkZDHXSkPO/aWCGBBm0LLfCgJCJnePxa9Q:HbsBRnIcJCQTckZDHXria9Mm0PC5eA3S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dc2a12fd10da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D270A21-7CF0-11EE-AFFB-F248F4CC955F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405470044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000007663ff9e47c2e9dbfc2a4058dc167aea996c3b03f171c9ba019aa3055622dee0000000000e80000000020000200000008df8c948c3a271c3d33522937960493c433eac8203fcc20e42be0d925751a5e690000000dee042792bb1ec55476592846e4608c57a6832aa1d5712cf4e438fd8f3fa20ca3a639d8102bf54704f7e9c4a4bde6bf82a83b0a9673affd7caed340984a37185d9d3dfedfbccce45e94284a57400d27dec258d064182deeb9949cc9e60ee67e737328b0358d7ecf2922a971681c5a6e12b0a5be7840e3d676c76ea71650268ae423d968dbbe82937a5f070395d6e825240000000d1d9fb85339800292b2425297853eecfa551850903a97a9d3c3e263af7cbe95f9f92c06eaf1d1339a8c1ffffcd2f8c578b550f44a3072d257fae233cf47cfac3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000004cc5545fe142e0c855847b6fcabf67c1ba225ff17e33a6408faa06792d8e02aa000000000e8000000002000020000000216fb3028ff9138bdcfd094b3ef9c5a39474ac9bb31810f4a6d99303fb8d087320000000b5eda30e1b83277a9b5ca25a952b3d2e1b6d8d5628e1f9840e1d51c1bc40713b40000000ffd2fcc5f2ee0dafcc11f980fdf9f24458c7167fdd4291522af76876f54378ef883d81302559c4c5c0ca4498638c773fd4ac91ce227f81aab960d9bdb1cb2eaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2108	2660	iexplore.exe	28
PID 2660 wrote to memory of 2108	2660	iexplore.exe	28
PID 2660 wrote to memory of 2108	2660	iexplore.exe	28
PID 2660 wrote to memory of 2108	2660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\gpl_3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db745d885f5b3167a6f4553d956cc01f

SHA1
37b93cb4c5ae789255709bfb46469cb84e430b25

SHA256
0ca37a25f7ea58c00855fe5edf4c95efcfe4b8299b1eee67ad54cef2f5e1fd91

SHA512
d969856f38b6be138b13cfc90e27cb2a1c940f42c44de0fcfc59edd17900b772e20aa3dba3667bef11b0d36af6bf4b7778f8b4842800f8ec3e4b9ecf28e67843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
399cf908ced57983fe0f780a367e3dc1

SHA1
36a409b08cb391dd26a16d63c54def94ff320497

SHA256
e0f77ad299cc039c754bcef7e15361f5984557dc94e747b087c7e6dedd91f3ee

SHA512
8f1cf19607ec6ebf7aea2d2b657e144fa9e3cc3b7dfbdab78b540f815348b6a7df9a3514e6fe47830d3cfe3d4963f496acbdf8fbe45490c0b3ddec489926c382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69927e64535fdda682963a3dd09d82e7

SHA1
480605a424230cb735fe7281a7d4338a5bcaa9d9

SHA256
6c4575372fe85e4536bd90bbadc75bd88f555f0a94b2534a3e32d882d904ace3

SHA512
aa73e6c128d6abfac6bb924183fddd0fc36dcdc30f6932d7660deff1ada665399501d9e3be8dd237b359da8040139bcf92bc40f9faf85591d0db1dfcc53d7874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d805f76261890e1d2beaca02badc61c7

SHA1
99b39f0fc9ab6a910db037ccba281ce6655dc5bd

SHA256
b2aa8fe34c31c10d1c87e2edeb75f7c1f0aa6f4815d3e8b0029a0d76e3fe2c9e

SHA512
cc42f2419337957aae4491cff1a6a4efffc2505807971dd874b495809b296982dfaf79cda99856ab732743c5853d1556f64e8ba696ce27b956a625f3c08af31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7d787508a10a5d766d308dc1f63729

SHA1
58a04b851ee94deee9c6ade89cf3c23151dba800

SHA256
062f92b25a4c98c126d11123dc50e525305bd0a793835d5826d1bc569cd1b7b2

SHA512
fd6ae6d870bdad80085e0e2684ec5a7c7eaf32895190a4504b806db0bcaf9702d580ed45e62162c7c541309ec987a06b0e2ecde54478c648c4a7bdf73eb4b6f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f044beb09de4d6ceb73e3d7882e9d16

SHA1
5116b032d602f22049a23cb6bfaa547163d439d5

SHA256
e17ef63e5b4f8086abedf81b470a6259d0212d111d83ee96cefaffbb1603875b

SHA512
ec363785fee160598cebc5382b6e2c3482a7ee792423c05a0052947b8785b964acfa8fa436fc889c01c828e62154f21074c9f33c8564a3fe90992e63f71be18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5110720a18ff2f3bd13bc5ad9eddaa93

SHA1
5f1df3918b5bdde603dc1ce321eca8c679559c1a

SHA256
adc1404e886c3decf270617964f3ce266f756620654d1b51a811edce5cb76b32

SHA512
d95979b608dd36d09283bbce3ae9b2fae9d29f80f16fd6ce5e2f07d85aac52d66c52655ec1f691999e42a1b30350b03c5a31e0db6698bf5e96b03789e08824cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d61db3ca6b36ccf01d1f8ca44bb9f0e

SHA1
15117878d695737338f7e682bc5d1c67a7df446b

SHA256
f8da4563a2e78928685663637fdaf3db90d6571e256d089c2c3b13711e65b245

SHA512
12f342b4585d1562b14c450706c0cda8c01996e7eaa2b66932afb67d3c42a490a375f62b3bff04887b34d3fb67036dd24719555b2f9268c21f6cb74c2ce4cfca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c825da6d8dc90d478f15382289167099

SHA1
21d6e01fd4546b2673c97ae1bb9ef75abee4cc5d

SHA256
e728e1b29ea629d8fbb874c478f35bd296006d34e40993305b712251ae2bb4cf

SHA512
358c479f07465f5a196a0acbc82e726bab96326ada7550c4d4c16005bd2e3e6aa377049c098294374acfdf76a9a1ba6d517d81f893a8a90b10ba369017075563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf16693ff8a55882bc2b774f3fb89a0

SHA1
42a8d7e5877c5ab90fda691126cb7c8eb7b148f7

SHA256
98382741493ef3034609f52e87e5e1b63378a4826d869e1b8736f99aef1a6341

SHA512
cb7f9163342dd33f6f4628e7393b2d74f9fbdbc06ffbe2bd059269e5aa430b754ae23cc35c7087a281c1bd39a7e2c1561965850bed3076a0f738f424af61a53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f261282383dc2cc7162c745964c3e42

SHA1
8410b097ea6ccfb0da3ac69ddac2880acc91a12d

SHA256
7b883d43763e6c926bf35fe4dc9d9052f7a581e885510ce9b731d630b6c50b17

SHA512
476dbaa3028fde119df3ffce2d34c2dc40a865832360f8ccc51a82959ddf2d8af6b2521f7e6f5f743075bc8ac41142c9be039d1eb188d8b26a55032d35fb5ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3688f82133a9013f51404cea43ac9c9b

SHA1
e0f302b52c5d87ecdadf2b393d63886499f3ee35

SHA256
313334621f6bba1264508caf5957c4f1a02ba8f07ad38087a0511fa07aad964b

SHA512
4838eeaa3741adea0bc232eb23403172eff27cf9fd2b741def6451fef0bbaefd897ae124c84f7449a2795534a10a82d642df1343c5890fc96655ca76ccf76ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95a47b19c07bdca9923d4aad146b2fe

SHA1
c0a7886befe17c9c1c46b149bf6966ad0d8e5a55

SHA256
44d13ba96838f3f6d35e59f9860ae549bb7c6beddb68f78becdff62fc95ab339

SHA512
3cbfe9e3ade5551d0f3a20211b0faa3c5e846e53098b2d79df02e8f6d6c560049466ecc5674b68b2d3b1ed0752c033d5fc80851c29b72fbee96b0a9a570fa5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d4022bf2c354530ce42c715e51855a

SHA1
611cdff57690f9c1e020981d00cb817884a1f6cd

SHA256
4c07478fa467a48343776649f31e50902f698e754c96947d40c703735cea420e

SHA512
a9cfc67ac0cd74e97f3c1811c5da5bd0c65ccf7ee2b99c233e8e3ff6eea92cdccea8e23b79deea1511b04fdacb55912c9d6e4cc0c96049529b1aa66182c0d97b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b31ade64854f3354e70a61f01b2c24b9

SHA1
cef3a26d03bcf0ab4e53481623307eea0c7c8dac

SHA256
f501db91f5bda6df560afbc45c6b50712cfd0c77a8cd2f84c9fc3f687ff40f9a

SHA512
1fa4dad214fe634301be9ddb8f5b3bba16702b1e94bb5791baf87ab84d4e12828f169b98b282260c59479d92749b69af64dc1911ce4c0f35905c8a90514b3393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd4ed2a6d83bd9752d5ce1e92b4b5576

SHA1
fb2ff258937400e0405d0302a863744ba2cad452

SHA256
e184fefec3122b876755aa3b01627a10a6b0a559b7753ebbb456ac498cbd73c6

SHA512
8c31e3febf933d771fa38650fe5d77297bb0f2e5c6db25d7b2b16f939e68b0628e4b155388e5e2e5c90e72465de8a306282815102958c724bbef8172b2111256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fe2976d4dfd1c96ef35398d2a43641

SHA1
e3f07ae844c99f9426ce0a4e45a08874b294d500

SHA256
c922f107bf9e111bbbdbbe0262275c064db4ceebec7410c94f2c69f82267762d

SHA512
22fd61caf137f8780be166cada1bee263be33ad4755a525b9abfd3e300ed1e9d36379e5fb408c64ab139bd8385bb80e61656d82d42115508356308aaa2b8ffc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab673E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar681C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit