97c874f22838f52da41e3dcc4b4601246fd4c144933ad0edee18413c70f4a78e

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EncryptedArchives.html
Size

21KB
MD5

a3f820049495132ad16837c687a45dc0
SHA1

66b0d108db46d9332c96a387a6749053650ac0cd
SHA256

97c874f22838f52da41e3dcc4b4601246fd4c144933ad0edee18413c70f4a78e
SHA512

b47bf65b47ce01addeafc23adfe459ee1bb2b3d3d2af51243187f18f854c24d91105ff5a1040726dd57c79f5ebf4aa6f76c50598a73c15e0ec3b9b07172156e4
SSDEEP

384:pxFvxfr3udKbiM11YavAZImFT1u+sr4dA4xGCLwiXk:pxFhPuar4dA0LP0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51BA88E1-84CF-11EE-970A-5AAA8EBA5435} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30960941dc18da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406335535"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000b2cfa9337729a38b1b5a81dd1360d4f1a13b73956903023ac39cbf5ebb0b0c00000000000e800000000200002000000024c7c8064e7298626f046ed01b082cdb5459ff0bb52bc1dc9b2229ba474fda7c20000000407b051a2dd617c1d1a31592766011291b92d32418a0c140b83af975aa6f09d940000000ff372984520368cd07a83d6894d1f57d879d39095ceae2b617099fa06d122bd6f01e8d38d970ce398ced5bd0537896c93e5fa0cf279edf18327211c846913620	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000e75c5de9691eb7323ffe7fe750a5baed1abb48146da443fe9e2361865248a8df000000000e8000000002000020000000210c4fdd64f64f8fe2eff89be7e081b32122660c64634a84386ea0b753dd9fda900000001df7050b40e0133d2c1e1c0270a94e07dac8fae62e92bfecbfa994aae032bfa81c6a3f49661a094f85f8579867e84f976868330c1d7fa49cc8d53082cc8a7ea0fedc0c5eab6cfd9a0dd864a34498355846f16cc797a5ab9e54d2f94b8fdce8ee08c498d915b7e7d6ac1a931f7ab0ca982abce30cd2a5c382302c1115fc9807c2dd2318519274705e112084e1c8f9726e400000009250759ef5e3a371115c1a4c63887db238c615bb5cf0d374dd77a646838de4b1265d52ce7977a1d259d562e28fb73c93aa1ee15a813ae01dfb1f88d81268f9bf	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2268	2088	iexplore.exe	28
PID 2088 wrote to memory of 2268	2088	iexplore.exe	28
PID 2088 wrote to memory of 2268	2088	iexplore.exe	28
PID 2088 wrote to memory of 2268	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\EncryptedArchives.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37aa3153aeb496ebbfc12268482d0f3e

SHA1
d1cd5fa7ff3f8bfa5642a34467aae954c098f4ce

SHA256
0f143a25b0038901c4622e379092b107cb52dc0bd5fdf526b5727297de19b9dd

SHA512
22c5c9381f71854950110657ff0214f026e15b522ab7337f9b25345ad6f42461de3d521e38a30608386494820a9fe75bf64e264a4f8d383221cca40f21838699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbfacc8107ded5b4aabc906945f23dee

SHA1
e098603a854d21928466681f55f5178f87356950

SHA256
7330419b766d74b18c5b6ae64e4147411cc8a56467e18604119e10c2d4e0e272

SHA512
6a756fae9870d9e88260adce91cfb626f2276f812efcbeaddc1c4547a075576b88d7a6cc879f856b19acde8d20d78910fdcb030e943fd7d8d59713ae4e3afc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb1f78c8df89f2d034cc90230618ce6

SHA1
3a9f19d887b1a453688dca0af44b40c88795b4a7

SHA256
d0d0e1725c0d8b3f092b62a6305d0a8c98d310277c511eb5b0cbc4451826cb85

SHA512
84e9a8dc9580e639d4270dd9bc5824a7086a9270e794b4989d5140031dbd748ab6e1de58330ad3536206a75b7a0b2407539b302d61612e122a2b70d277481782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ac63b0fa6269541fc1ae21f8e3320b

SHA1
3aca75bf5650c3c2ba3226e477e9d8d4bcdebebe

SHA256
4970b72f2cbd913d50bab8c89d0e1c223380e15c69949122253ee4b5726d40f7

SHA512
fe9f8d3a7c494554f29d542923de8bec58c08bf7145ea857b7d2c851aef3117b56e312778a6c168d03402fcfa8eead4a6a1d084783e364d470cd568fe8ed2845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
178a2cf80c59a094e36c678b83e8100e

SHA1
82871bfa29f0d6ace9cd0802168f8889daee0229

SHA256
bd4563da9ce61ffdb6f5452d673447663b3d366e42ffaf15a18ddc387d16594f

SHA512
5d9874e60980644ef8dea6db9864d3fc60f79bb3e97ae65177d4753b092aefc41852d2a6e35a71d761e89bbc5389073f2cf303111fecc43db4fda55c8cb4d63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adfd30a2a33431cc6190aee50204204c

SHA1
99b4bdc24619d4b44d43b74005557abfd6ca7975

SHA256
8f6f4bf1f384315f86ec2d1c61fe7494d77f390827d55d923b7b6ba4d4a65dd6

SHA512
cd243c6ca8806fcc2e9d83558e8fa4899874fc0cc2a43dbe687fa9b63a0ed3b89cffba3566471483e26a4597f92d2e04816f011eca2b7a287ac7a1b47a88db4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598477b92204d0551d6419412af347e9

SHA1
2278e9805dc301a4a9e7a1e77b25838574c5ee74

SHA256
5fa8232d15b5123a427784c5a8ded5d934ee0d23267dee5d96fcba65dd0d64b2

SHA512
4184119798483a0f37ae93fcefa01c9801119984a467c4da93a0d2940c3cf1950c387e0b991e1f4556cbfba054f89085b0259f201b21318558a98036ef8bb575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ff08ae606cb5d6c534ace9b9df4b056

SHA1
7e6cf47ec71131bec6d9394b417aea4d9bbab4d5

SHA256
a496438836041e2434cc0875c12d9c8c2c612cba9d121fc75c505a3acf6b30ee

SHA512
f349ed072c8d637c6991eba865f90e7d9b589eac45fa07bc9ab81b94a41c30e84774ea8c5b70f7d34ee6d6326007412f691ebe147ce0e8f0822ea5c4a8f2c656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d39c14c10903d382f8b74f579e01a5b

SHA1
255efd2d618806d90aa6eb6e8fa6bdbb9c566116

SHA256
dabb9aa0dfc18d5c32cf16a4880bb23e7f380c713c94c29b1765ae5bb56cfbd3

SHA512
d18b0d68869e1c096fc48055895b5ca56f59f2e5d83346f85a1f42d5ac03be4b6a6396b1f3fbc049f1e21c08df39aba3cf97c04fb49d7132079829712a1b972a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49fa52e449322c13200fae0aef76531c

SHA1
c1480ce2fc22b068ef9033a5ddb6acb0f4f5d3e6

SHA256
10a6fb4d1bff057687dc87a375600b362f6a99b131fa4593f1f190ac9342e7f5

SHA512
00099f9b38afe7d9c424e0541317e575343d659b78cef72af37a6f06065e0a9017e9953e68a118516a294e3b95b58cb56c958fed212cf80b1c739e9a75f79360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2001daf0c0949eea954cd908c88496e

SHA1
e13c8c068ce5fe91508281dcf42d5e6f9c48d84f

SHA256
d99b281866c65b76283229e2922de0a10909d891b5e4ce80738c49ac3d8274c8

SHA512
eb0876d326c95c307c153f73add88fa9a3d634e95a10c62eb5dcc646a804155112956698c6a85aae1e792e05c262ad422ef250232f50c888186dabd80778a1cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47109d294051f3e586d5948c6167b494

SHA1
a269e6ad05494477cb77461a8812d4657467ab0d

SHA256
3b61103497bd2c6c95ce832c3bd010b355351ee9564e71e22ef771910960bffd

SHA512
be057b234c7fd3a13af70050cc497048f1624318a6ecceafe3e2b7234442c7651d799f23baaf4591adaf7a28678ea17178083ca35840c684c4e4dc848a811c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef80b84580fbbdc9f92f256d7deb604

SHA1
6b772c8825cfba0d583ab71a03306f26a1071c75

SHA256
8ccc5a5350e101c186bd6e44c35867b15e57f403b6e49f2f1cff4c6df98d697e

SHA512
68b54d0a9d1099218b6aa61f385da834f8b7fd1cb0d13f4e9b48d556ff5adcd921045029defa0da1fcf811ae08bef8cb1900b3f19b1dc8671b69531bcc43ae2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fa8075990884c5c27e58bba8b67996

SHA1
9cb25a91c357dc718accf184ebc692aeb31d6dbd

SHA256
af818e8c45268cc06203d4fb54fded4b8264baf824b6258e5dd8c4e577f9165b

SHA512
b5dfc6cb7330427ef7ded729dbf440099af852cfdcf8550fbcb7dba74ae2e6cd0608f8e6fb7b0ca0f3067778b8242dbed1ed54809f1395158ab47817695c0bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB7D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABBF.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit