6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12-11-2023 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AddOthers.html
Size

1KB
MD5

f4ea073cddc8da24bbb44924624d54fe
SHA1

1b64ae71c6c8e33d3c34706b2f8faa8ea0e54452
SHA256

01ec207f916f3dd7d72b800d530771defa2481f78e53f5ce7dcc21c5dfc254e3
SHA512

7c052282470d6a4a067ad1ac49395408c942a02d72a3b227ef4add41ec76d6f9895c1537768dbe608a7c9ba98a0e5482377ca750ec9b3cce920cce090c61edaf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000d9c782f8074ca5b6ce1f3d36137e21b230b81e25e817dd9d05a2fa9964ce2be6000000000e80000000020000200000003f75c65eef5d038f563f04334ac87499765458cf015d6feb3b24f2f8f2298a9c200000008cb4f27178001b2e3747035921a36aeb29d5aae988d5edf2cbe208aff7298e76400000006e53a1651184e65f5b9a2aa3be9af7644b2f6693a78114fb7410a3de6e4319e5d083e241c85c26a39f18580ef96456c1fbc5fbb36e261b93d674dfe5d67880ce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DADC5DD1-8117-11EE-A5F2-46832863ABDE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001322b02415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000001a88b42446135b95f4fc467c58f2d31f0f7edf81cbae268fb69b9fff7bf7e1b8000000000e800000000200002000000025249252a6d3e44c3f9bbf1c5ff5ac0e829a8ef14fb3fe0e1b5ce6d6379e04f49000000044998da14282e58a891bcef50eb7a94fd4e735776322b1bf052432738b67aaa5f10deff507ad64ea9a43432cde19e7291c219e91fb1b8eb452199f7559474444782e29a95ae949fcf4bfd528ec32c67578256942ac15c1470e5ac948674d9b8db47a8f434e795a4ec3d9492964966c7036a31b015529fc19a35dc2128a2220341827f10fc4cfe5d621f65290f10d267640000000760a02663adc2aaf3e73087aa4aae54e0a7243b529b8ed534cdf1bdc7c1545810de29600d49cb08f017a94401c6ae5b9db8a5f9fb56aeade6c1a3dd43fc064c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926864"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1212	2108	iexplore.exe	28
PID 2108 wrote to memory of 1212	2108	iexplore.exe	28
PID 2108 wrote to memory of 1212	2108	iexplore.exe	28
PID 2108 wrote to memory of 1212	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AddOthers.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347112aeb6c932c5cd69f4efb8ceb22e

SHA1
408b9d85492accc40a7e18a85233192da97b9a97

SHA256
1ea5eb8b5dcd843bc1e6035e9237d36450e66e9df7415afb51fefe6585aa0501

SHA512
94276344640b93c1d105244ae395ab4515d5348d13f8841a9b85c3d86e3f7589c1cbd09ed46eb5b61729705156dc46ab97452d142ebc444cb047a7ce64a2fe31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320f825d634fb9f1521fc5fd2f25939d

SHA1
57d46a53b17f4911c7fe827ff38663b6a62bcb4b

SHA256
0be8c99994ed2020331a32e51613771e110a2c63fc6b85152b18436049c8fab4

SHA512
83e5b4a000df657dc663d4058ae0e0d3acf466a172851586215b33b6a165ced1a40d2ca21cda7760dc6e44131a1a1587853e3cd9036e0b708fa3c13da04938f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
979a7c2bad3923ee6b1098efb4860f8b

SHA1
78efadfa7ff35a2ee9fa97aa17392671d6d1378d

SHA256
3715580c264af2b5fedb4ad3d2e071f5551dc666d6ff08724946902684ff2739

SHA512
f7e3ca6e97b501f2d4d8d3aa80c053c25eed1ba9bd0ded0f4f9427749aa8a8c8de681937263c95805e9cd3efaf27de92abc13d1ad33666fb8363d55c826f01cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3acb13edd399c7e222039f972b6790

SHA1
3e0138a56bce410d5b8e958c5f0618a272a193d1

SHA256
0d9e6f7f7eba424e25c01d790629cb38e7b97ac119ed7e43fcb4a0f0557d900a

SHA512
7fc1907d992582f6226a4b731e2005147af21590a4c2610c89746a1be424febfff9da8778a407f14d6fc92306b105b557ac404869d5465d480e067f4cc2d1e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db24f89195f13e3d6b2cd9a8849fb2b

SHA1
af8fa99c806f7546007863748a90be40903e2cfb

SHA256
b26ec6d0604891cbe1e750cf4c5546932446654c1f02f06cf9e3a71609677f4a

SHA512
3ad2acc384837f3cb6f0fc651477e8dedc4cf63acc9e3b6a2b922233d0480d10bc52bf038afb6dacecd5e869c606cba8097c11ca73d42605b8a28c7bd1350248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdb98b7ecaa442cd725c79379949b3e9

SHA1
a58b158b63dd3fa25298333f3acd8405f5fce792

SHA256
e385c83ade773ddb4a3841c85db4cba7fcedfbca99cd4f703cac85d8f8acffdb

SHA512
28cb15de62d1604fd1db23ed36f2f8e7c731ee16883578f2b88a5b3edc2bf6e8e96a9b060eb26e0d2631533d8cb0b406ba11a94e435d40afdf9941e5d3ace0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce6940602bb71d6336618e67b575d39d

SHA1
ffc131cdf8fbfdabb4a2c49710aa05edfddec644

SHA256
170b3613427060ec5c0c68fe8b98e2b75b299fa766a6d33c50f502931089fc2e

SHA512
c1b631e8e3a1ba1407128b46425ece0511de40c1f895c81272172eaa962be8157b3b9f417e1ca33ebb13db8fb42416a11e4012a097b673936e7de22dec9bad4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61cdef5e496fbbc552859fef7ee77a42

SHA1
39d5872e4e19157689214ca2260b8a13cbcba54a

SHA256
24e3f1a68ad6d5dd88c44e6316ab879b7c5f4b70d10e96959335232c96d5b4b0

SHA512
028109c94348edfdb2e24637706e4c0ee3d544b8ab4e56143f016425bea516f38d9c87c08dc03fba33c3a792f67e555a0c31061c0038d3697d1e25c5886b089b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b32915baed76baa3012b924eeb53d055

SHA1
100b2b296c014c5c89fe7106d82c56c9decd56c8

SHA256
4f74dac5d22b3e3fbd310bb91e69008ded29a6d6472266dc686aefcd2e278ac0

SHA512
dc66e75ea7c0e189cf90322c575d4d5b9f5e17b659e49498cf4da746c162da8f5975b5166c4d623819582fa075e907cec108d3b9390e446142e998855f8abaf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3a7b22dd06b7da1c29586d476c0bec

SHA1
737ccf2830a644920478b1d4c7864befdfd6846b

SHA256
723ce7654ace81c2bad37ff41b127dc8f02b741ec1c2cc4797ee5fe90c35cd8f

SHA512
2f265712337890bc24593fb024f3930329f12e4692b25389442a88c69352f5e4a662d431184d816b161fd5865369ceaba13795f88ae96fc4356efa00d32b4c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4b7f7318d6f39e3ea951e27cbfc2f65

SHA1
d7ad3221cb1a4e79cc5e267437a4542a8bc737d2

SHA256
203e29bfdb2b5757e0b6368fc4da76177c62e1bd80449138fe1b5d3617bc6b4e

SHA512
45e1c16a861bcda35282110c4777064a24eef260a24a5362334b78e2e53e65f0143b6458a15a18e7dc0ff09a0462cb9738f99643322db2c72541acf8cdbbd977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ce261b7519d780fa9c8d815df876ce

SHA1
4c45b4918b94fdd81914f6eb72f46e5ba1a9f282

SHA256
901881ac92c98938aed108e66be27e69b2fb27ac942b6bdbdbeede13d74a7f63

SHA512
333ca2449fd21140774f68df497ea402c687b4164e8c85ac2f2318c0ceb0bd609e609ff9ca100d2ff61489003c7ee9633a6a408bef4685df02cfd43f8cf61e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99357aa4a5368eb683f057cc8d6f102

SHA1
ef2343d81ab23f4b04c11d0faf90f2b502c8d204

SHA256
2caf960c8731a2e1f405630ccdc38cc89cc16c0aaeadf7b5a49b69273845d8b9

SHA512
d1cdfbe538ac9a95e8d46313dd8ecd2c44ddd6e8fa0336441fe9b698ffa7d289de8a25310b9876dca1ecdb457fa3cb6748f5916d1ceb2557cda625eb3e872d44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0394cb9cd1e0b63087a3913945bb0442

SHA1
815e26ac8ba727b6c22366fcd0ee4854181694aa

SHA256
38476b50c08dd4ef57a5c202b9371f44cc20a655acd7237991c84187fa61ebf0

SHA512
9872599079007314bdc5224aab6f5634f36927000ff497380c74b5c0092502e694a256725f51ca07a967148c61b01ac5799dd7f5ccc76495ae5a99aa08712e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
430fbc4d6199030cff127d3215cc66c8

SHA1
33c7e26fc16fffa06b941d9932382fb2e4e9b3a9

SHA256
3086adde78ce6892fc11c88f67e498082c1f1fc35941b594d35ef19c4c7ee619

SHA512
0e9214f1d2ccd55a33e12fba140da1ffe623168903f5c4692f07587182ee7486b6bf3a2b90457a9c2b328bd00efe15903a55b13b61ae379022c061910b35f0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE581.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5E2.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit