7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nointernet.html
Size

551B
MD5

6c2f16445d9aec3236eaf027852b8ae0
SHA1

76854c00267dfc7276eeee12e6df96c5a82d1646
SHA256

9d647b7f81404d0744ebd1ead58bf8a6f3b6beb0a98583a907a00b38ff9843c2
SHA512

fc835b8d68aec6ebe727268148c36bc6e4ec991d984e5b80f4f15c75d9de1a52341ef09735bb16e3c390a45ca483032a2fd393bd63d86bd067f25a3276958437

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7CD5101-7F1A-11EE-9F09-7277A2B39E8A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000002684d6408a4514b99c64f66af657ec7ef5d76b1a5e53469dcb9af722a277e6de000000000e8000000002000020000000e06eafa5f0127495fa6f794e64d2d86466fdd18c0dc4d46fe67454eb5a67b69520000000094ae8b1879375e267fb5fe9f6bf63ec6adf181cd9aed29948f7ecdec9c6747040000000da62ac8ec9f2d7c52d70c486ad0e70709318b356a3f7c2170b27f39a881dbaa5bd9be197dec826faccb2451dd2af0f5266502fd6f9dcee01382d8a41d0b8bdfd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00739a7c2713da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405708163"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000327846cac88c353fd957c41aabaf41e4b79d8d5ab0a7cda5f27bbb1a2c54db4e000000000e8000000002000020000000e577437d66c3b765d84843e6cb0cdf0792be13839a9f4acd5ab343709abeb491900000000befd2b8e43e4f5591cd2f7a098717ecf796874c761143081addeff25affbbdf7338867a6601e0ca476f4f9707710b3fcea9c0a5211782456735cfdf10765c10eb2b434b53aeadd38adb62ca7d29064e6c654f767069dc00a9846ec233f93b877b55c03ad809b9f0d2c7b9019058fa91237d3a3ccafeae0a50034f6c70c35388cabc70074343b139f3e0edb90d252319400000000d22b2222e64c8727dc36e7d598878cb6bbe58a02b66f507e94147dc28b228e308a652910c7938e080efd33cf601bd150f7212fe768c6f20606b202c16bac5cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2280 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2280 iexplore.exe
2280 iexplore.exe
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE
2372 IEXPLORE.EXE

pid	process
2280	iexplore.exe

pid	process
2280	iexplore.exe
2280	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2280 wrote to memory of 2372	2280	iexplore.exe	IEXPLORE.EXE
PID 2280 wrote to memory of 2372	2280	iexplore.exe	IEXPLORE.EXE
PID 2280 wrote to memory of 2372	2280	iexplore.exe	IEXPLORE.EXE
PID 2280 wrote to memory of 2372	2280	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\nointernet.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4ad8cf450f310f9265e5ba43185f65

SHA1
c8f97f90d0c0af757455b9704ec48357f9cbb5e8

SHA256
f65f2cd6e3ebe1ce4099ec28149fb816767706b073870ce302e2979704946ddf

SHA512
b0cad4230e7824d335a98addc0869ebf6c04481ff5ae0d6e5a155f6ebae711f5dfccdae65b3f787eced63987905a31aee02df1ea37189f1cdba135247ddf85e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3e5ce8b1db1b16e22d06778ed84f12

SHA1
9459ad71e6a2bcc1a44778c6e7aa4462e64d6bc9

SHA256
4d02ff92d33384a34f83325fd8f2d9249d7f860b084675ddf6a452194a5f476a

SHA512
ed0f4db4e1625b51275fcb6b8e718b3dc18ccf2ba15a6c3b0441210680801eb1a117050cf9fd1638459ee1bd55507994358d4cfac69061910012d038fbf2a36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f87abd2a94790a21a98d67948ac5b3

SHA1
2d5d8fee42684fe6d1239c09b7f92e8b38adc14c

SHA256
48b23891676ee189c8ea26d295dec29b32204dd20815fc85883f33a2512b684e

SHA512
b3bda8b647f39f895252d980a6fb9026b04d4a19f7735955e0cdf2e5e977f7220d9b0e1ce7eee72805cfca2668107eb29e0cbbc5108e3884f4745f378687f94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d45001af5e93a5226bd5715790ad3f

SHA1
442046c12b2d4ff9423cd45dc739d8d98dd40c1f

SHA256
c8a499556a0367c49b3e2e7b3767adf3a383296a12c66446ac3ac76c4046d481

SHA512
7ad692775c7f08f6ea26ced248cb82a0cf095b9b0934d4c9e03cacb797d6d27a32350d7a63f914f3cb54baca296af49802a50cba9c2f770dd5f02b1329469640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a952fa3e69f71bf4e3f01be54d008a

SHA1
a3611894ebb325b36ca144b9b67dfc50043c87dd

SHA256
3943bd99187ad9572830037214ee096645aff4d3844138da43bfbe34d02be901

SHA512
85b02a9be24c7bae5c9a0ac3d62bd74ba0158d04a7604320674c3bc554faac3a570b3467ceee016ed3d03f4232ba58d894a9a13cd5f955885238f80d206ae8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af833888d3595fc210afe868af8f1d81

SHA1
e69115a0308a28c3f534c7bb27b4ae7d26d046e1

SHA256
f5afae2a6b81b8f40b5ad0e59182fe9714c466c6b7ba005af138281e2e1e4200

SHA512
529fc0e5ec181381b12aaa0ca40cdd47c57d714a4df06c2ecc336c45d9c534bff554916d2e7cc60c440aabc80d0209a9cbcaaa58a1e57bff1b76ca7f437017ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60b30e251bdbc177d08d746eeac67b25

SHA1
6a1add7b4efca9d9283841311f244aebfa68746a

SHA256
9bba49cb763cccafb8db4cadccfd93d3a14f25f855d61e85d00e96ee6c533725

SHA512
b4c77fb1822b5e156f62089c0acadb59c0fe5577de538ec4fe5221f2f20340225844d11511c445203210134043349e6440b229f3d760881c31fd7d15221845db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52127f985d563ba14f6dbbd4bd0cd06c

SHA1
5632c25cd6372c09626ee088e526842db789189d

SHA256
71970276a0102d908374e4e8afabc2a2fa06488cbde533d989777ee2ac412302

SHA512
2d005d8b9ca1354eec1725e38d0247210db9ba4670adb97047720c673dcedf1bea5b7c092e53f968970dc982ea65ef46429ae890d3540d340e37d7534ac28fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a26d4b96f0bc71036681ec9202022d1b

SHA1
af445487a5da703237171f8191c3203cec8150b8

SHA256
14f00362b23ec8e9b84038e4eb38c94c990f788016850dc491b8c2c4365c438e

SHA512
a3f871943f9532e8747101b2da8396165ae07471ce63feb63ddc860cc8719df69fd88ad02ebc437c67e14496e7db1c4bbba27138c1c253901f894d343fb2b4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee0edcea7c5c1a71ad1291a11b56cd21

SHA1
dac4613174c57f3b7b04ec66d303a3eb8695339c

SHA256
c2aa84e70427408410aaf8edc24f0ca1ba8bc9e4700267b0acdd696d5986347e

SHA512
fd4b423e6f8efb1eddcc1ecccaf2222447391b830436fa515ae670888c4876d49d75c69fa9649825e09042852eed51db279dd15992c2a765f30c5a2bd248133d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb5a84891d46f56ae8f805d3a2c942e

SHA1
d811e97512b3d94e0ab4231010e145762cad1052

SHA256
b1826b1fef957fb7ea3872a0be832cf93592d9a63884f334ae8e51d517b8fe6d

SHA512
da3bb8a0dd5ed22ed9a0c04786a1ab7ade2c4a0a89df22c6b649c9b03a3bc026e41548ef03da405f867b363e890db3e540a7964a986044231c81609c40456cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7805b622b86a47a128ba1b88a3c5784d

SHA1
517877ac40373f7377ddb05ffafde5a720662bf6

SHA256
77b162114ced49ca43c75832ecd3ade3a335252fccfb5187a9ffec74c855c9c7

SHA512
3edc45644589e2b33f247f3b3fc7cfb2001dcf857ce15f8166f59ccfea59343224b9da2405d77bcef2a6f84141c348f5c0ef52bc2f3278e82981df95be1d5ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA324.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3B5.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit