d4940401398aaeac4b523dca648577b1f39646f5942a19d62275df539afaa078

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

parse_search.html
Size

389B
MD5

32e2bf600a30bb974bd5a1c66c09fd24
SHA1

416519b36cf72f7307f2310bf8854c5370a0f6a4
SHA256

b81b71ae8c990f9ce8fd86cd08ef3b31009838f85a8db4637f66a080e908a379
SHA512

7f5cdb43e01927d66f3c3ea2faf6e588b547e2107496a8b5046857f9642b0a0c4e5ccbf3e1f434d26b33785077da2ba9934c06bfcb9bbb66c65d4453dab98dc4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709e97c05913da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca410000000002000000000010660000000100002000000084f6b741e7e78a1c8636fd5a110295dc22f15cf7ae0056385dd315f1d42b9946000000000e80000000020000200000008ae665b5f74e40a713e0e073d886d40d2523b1064a69e656cb11793b62fdf38220000000a754bdf4c42b4b535bf8bc64aaf833529214b7b6352327618c6f688c844a0d4f4000000078afcf96ed83f610c688fa618197282600c644d6f371b36bd9a4e840e127b43921d1840e9cd51e0e310847a2fa67bd74f983b0c4b2cb30f396272cf420be2ff5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBF852D1-7F4C-11EE-9AE3-CA8DA7255242} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000ef9ab55b5992867a20f4612a29549e23a116fa767c71551725fd84212bbc7361000000000e80000000020000200000006a3b6ef3c462cfce395c6a36ea8b6e87399aa66a7e6637baa61b2d49a40e666990000000c43cf8e64ac8c8b2986a0f357956d06dd37e3faac41bda480bb913b89c58e968366be267491b19b278a5d8e6f2bef3535486347f7cddcc4430d55f7e3d80562b769d0ba941d414900c9c967c757bf8d5b04890714924c88a34c7ef59e8e0eabeca3074980984094e1f96eb6bda46fc52a48e03022aa0592133bbf47ddf1b5895905fbe7c2b25e222525721bc2bf7816d400000009617906dc26407431d88330e2fbf0748b38d5a2a610bb1da47f1a251512b4ca56c0c6ab60fb46dcc8c0d628211073c6c0c23803da530ce69d94878d77f7b986e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405729752"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2236 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2236 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2236 iexplore.exe
2236 iexplore.exe
1140 IEXPLORE.EXE
1140 IEXPLORE.EXE
1140 IEXPLORE.EXE
1140 IEXPLORE.EXE

pid	process
2236	iexplore.exe

pid	process
2236	iexplore.exe

pid	process
2236	iexplore.exe
2236	iexplore.exe
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE
1140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2236 wrote to memory of 1140	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 1140	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 1140	2236	iexplore.exe	IEXPLORE.EXE
PID 2236 wrote to memory of 1140	2236	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\parse_search.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
708c16255be27ffc03cf9918dc1ed98c

SHA1
b6d5ac90588fe90270a16fba5be157549048b6e8

SHA256
f1dd71524fa61342492f8f8749c94410e58affa38a697e9a8fe0baa353f1cf35

SHA512
bb90f9faf8ed111e6cd8e1abe6ce7bb0a5b30dc9fd07eb0301980cc407a7afaa15b1bbff4e320a16132f8adadef22027c9685783ed739441657baff8add9512c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a882217b3034e54d8b4f15b898b7d181

SHA1
cc5dff139ff57632d729a9aa3cec01e226598086

SHA256
c0df8dda0ad8ba09aa7a8e6dd3b27256037c679f90b25ba6a208bc8dbcc07def

SHA512
92e0aed2a350a912fb3553c48d3f76c04d21a473ed0a4e6f88c86c25907ee2ac6e29f37e58d499fae3a65e46b8ed1d0f80b963f79345b7a96f4a070b68a015d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c21c1c1e9d454c3d2fbd5d9677f3138

SHA1
ac00b123280a41dc1b7c81e2cebdefacbea85332

SHA256
75bdc25c97aab9b42cb8b0b9884b2cea35c708133b188350aab3441d457d7088

SHA512
5b9462bca8e6fd8afbe6d791b9af0176281894ba3c3de2e16dceaadc60500ee81edf67d6f91c25391d75fa5a492bb1bbbaf9a3d7c58f6ba96fa29836dd1d0fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b11f0837ac7bf32867c6d1c4cdfb83f

SHA1
e441e85f5221062856e7fb4fd23fe635bd66ff0f

SHA256
a42fa43686714beda5c3e8b76ebf6f1b6efaccb7bd12bbcec95595002f73a0aa

SHA512
657a5b7d73c28b95e71e37ffac9d3e28efe6f897dc8504a1920a136d2a2bb4628b734a8510a9b1907bd0a9b1a8c99b7b0143aba07d8b6a9ac7574dfb6da471c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991d9c9dda228ee332e5d20cb4541634

SHA1
833e27adb1a9e1728845a0126c8ec183eb3d65a0

SHA256
457819b8a927d21b7aad1c5c5be514dd068ba658988c23a12d9947363ec2014e

SHA512
9c2788435e1c11b86d7545f1f4a50561441f91159cbb910be6f9bf0ca1a8dcf335b7d1562ae94820cf51c58282f34093cd6c4d1816bcd22b8dad3bb9e7689e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c3642cfada1f1d045f3c5e6e093529

SHA1
6d4cc423e18aabe32eb01056ccd2f118d026f6da

SHA256
fed2a0ec5131369f8b715e397bb2a503eff9e20928ed7cf806f1215ef079b986

SHA512
2fe652eafc2ba8cc66a5fbe4bc02009da416517c23135d02c1154d11993ad8fdfc0c17d675ab31be5c761725aa1becd77b09b88bbaec2a6fac320ac74db9a99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cfc7cf78deac21eca5120876bf3e517

SHA1
7bbf9514fff6edf94acf387e79c46dc733f30fd1

SHA256
4465d4dc17f4a72d9f65bf2c8f1b8743ba2cd0530263d95866b035cde9cafd95

SHA512
a70b1a0fc40007fb0968e0350b547de940da0a6a653345d388a1b34b669c716f2cb4e7ef99f7f67a43fc9b45d1d51e9557ccc1753551cfe52d2bd4968a3055b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1804f5ecd6c84ec11432aa84489be4

SHA1
9a7775de5f8b253ab96b59625e8d3889d30c28ca

SHA256
710827b8f320ba68ddd3f83ed1b6557ab6db847904f690c51ac02f30a307ab8f

SHA512
18cab9c73d2180eebb96d9920318fe5dc42da1808d5581b169154bf58ab162bb080540771413670b9899d8b1fe448991270ab0c207d4907962c374fa66a810bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86607e5bdf940ed6078ce81e184aae6

SHA1
98093f296ac8ee06aeb072cb6d00d0f470532444

SHA256
085c8f16720180a7f72ab747721ec2a5e4c524ba5c4a09e477e8181b861872f0

SHA512
adb2f155207f70c0be9e1dfa0b6db246325a2884396618c8d75061247b03cc53b737f2170cbb24bd352c1224b0a4add0d9782992ca8780d012bfa2d7f2dd3f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c273d2d483830049d15df5b037bd20f9

SHA1
e3e5208e5c6a456a3f2188e7ac467d374be9b4d2

SHA256
709b5d5f6cca5928b727e25f3d04f56653b30e5b174f817da4a33da4921e3ea6

SHA512
c239553dac3c1cae9f4d09fd19932ac970424e818deb65815f68d09fca49872e71490d07fc45f15ae4e650bd5822b963b698d99feece5edf4257b4575d3a0f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc8d04038f2bbe2bbd610e67544c3982

SHA1
ec56527bcc9e86f251b0143c0e3de865cee193d4

SHA256
4381dfa6ea43a2a540b800c60fb678577ce785c9755c5e129570dd441fc8c5f3

SHA512
14a93627bbfc38a7efde2558ddaeb1864f920235873d9928475dfcd58a365528424f7529aab38b799df8627ffd9c94b4265df47a5d93cab04f49be9030f24528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49cc43b98c0967c20be39d6007745679

SHA1
c86b5eb8ea9a61f28be2eb4ba9cca54f46ce0aba

SHA256
e1b869c2ca39efdce292d9146908d40ed3426f910e30376b5217022b08e39774

SHA512
b074910744e6ada45b75b69524897ea017a5f1ae95f58ccf561c07e70732789d1a79801bf01c302aabbbbe8daa4d52cdf28688d851541eb7a5f08d97c386ea63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e934590973aacd759daa2da76e8f28d4

SHA1
f5ed27cb89e3d1f6ea5319fc8218a8de2a17d10e

SHA256
864da5a8f5d057718a67fc2aa27d1428c39b8e4f1e35d727b35bca1a3f85423b

SHA512
2722650a37f1c0dd1c270aee6934b1a0fd7d1a31731f37fcc5deecba523a2942323e04b160aa9b59fe14b15f5c0118e71d1400d7a70dcc3d2275bcf25eacc4e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67abaab3caa72a93580b685fcabd2e22

SHA1
f1141fd9319673b7895204a5af6c107e70d490ad

SHA256
b3d4541515d6e38b7afb5db4e40d857e95fbd425faa5baaadd834c5796fca54a

SHA512
5dfc387c73c04b0c56de0a112c15f1ddc2a56bbd63b5581cc062c59d8c50927206169e4d6073765294c2c58272ec2564082de78dc974dcfe738da05375ed10f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aef490cd4cc362e61e9b458d98fb8f76

SHA1
c8d8c86db380ea9151ce3a4f80cc96dca4833743

SHA256
449e3ff25a158eb1220ca32a9c96cb828b2df29bb82bfd23e1b9f53b9d64dd67

SHA512
75b80fe78b42ac91625f3f28bfb49a19e3927d576e8ecc8a45c707450b33b8024c9d4d9a85ea4eae461c88bfa396f2af6e9e53a1b9078aded238f0cf48573f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8CA9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D09.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit