d30303bedf1ee0066a6f5535e09cdbce26cc03da3accab0431e9ddab73de8998

Analysis

max time kernel
150s
max time network
133s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faq-win32.html
Size

25KB
MD5

9a82de65e139150baa6d1bb817cde06c
SHA1

15908e17b224f278ad69e3b69360671915d8128d
SHA256

d30303bedf1ee0066a6f5535e09cdbce26cc03da3accab0431e9ddab73de8998
SHA512

819911534e821e38dc257faa5082221c32a93fa6afc31069e447d2fb32a19c41cf7da4f4c04ea80f26eff94cd727ae80560b747376eebfb22a0ebc0f58a236d6
SSDEEP

384:usSxfr3uglotMeOvL+dkX7st1XLHwqdAfxGC1NW9Di1ZatOikAf1Raua3k:usQ3mzwqdAPnWVDHjzadU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80907715dc18da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{400266E1-84CF-11EE-92C7-CE48D87E070D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f540000000002000000000010660000000100002000000095719a708e3f63c31d61e120f0d9283cb8b9b3f8abcc01db9a9bb8543b4e250b000000000e8000000002000020000000bb40e1c515a7b5724b78c974e4ac68648d13ba199afa38f7ebc0640d1cca37ef200000002d86103489647c8e5a7c9a937bcb754bb647c0a1508ba9f38ed311de539fec41400000004158c9d749f294557b4b54e7eb21fdb650e9d77b7475f8be4838aa7552fc6f60fe4a45695295a917cf8d0e73a5beef9563c5d4867c1690430b5d9d71c6ca77c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000ee8c35b3ecb1037c77eb20add7d93326d87adc5c98282af01d752236a01a4922000000000e8000000002000020000000d14f394a32530b77be15e8a524d537fbe8f2a4d4017918bd9d644ce942b8445e90000000bb79673ccfbb8a43fd6a97a60b7fb593ac42c63516c373a9d8bc051e29e6f42dc6f9492fe0ca8a67b916b2da4a2067d81f146a06e10502ce97d9af4d1ac3b5f7839ac5394688da98fb3e7f86792cd8b02131a960cafe47b7cfe756707463b7101190cc32dd267a5de5ee2b52f764e579ccc7a9e6876bfc5179f058a22c322a6a98140a518fe55a556f0da7c1fef6de0340000000b2ef2ca21643824db09f4169a3194e192ed6c08d2b097c6a43d50f29af67683a3c88c829bcf45eb4a541ed67014a96ccb131ae3c462b978ea17d754cc5553768	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406335484"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2664	2220	iexplore.exe	28
PID 2220 wrote to memory of 2664	2220	iexplore.exe	28
PID 2220 wrote to memory of 2664	2220	iexplore.exe	28
PID 2220 wrote to memory of 2664	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\faq-win32.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a496eb02cc07a70a20bc0e687d20c8ac

SHA1
0105b7b3a84bad233f73f9b3b83f0571c8365da4

SHA256
4ee1548d9c9ca4af5aca0abb4200fab80cc33352c4888eb7c6ab64be19e60b6c

SHA512
c3d4dadc77ce204f735ec57d985be4043e9c584222f47a853fd7d04df02d28e45f90ed4caa60a7facb5e569530550749c4d19133c40152c226daed9f44c02cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83e95d875bfff60f8d680de71a6a8c8

SHA1
991d3070ea9e2f8bd2e24923f78558a3cddd7797

SHA256
1c19ba38a9e8a084eb935e5fd4fb6d3fd1f6b4c7726bcbee6d4f36c6d92e416f

SHA512
3ea03eb541ca703788f8b9004444aa158c4ee33dd2dea3f9e28e972e1548f31565e35d146aa7c9c5bbb4435b53321e26c0791ddb8e9b1e94714d1e9f1de44d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba455503d8a8c5bb986cdd97e3ab998

SHA1
dd6c440ef3035b7793e25e8856b14f181b0dfc85

SHA256
17eb8a373bbce73439fa77e5ed39cc02630832b396f9d80fbb6013b1fb243e03

SHA512
1539b1115c81bd324299a6d8a6d617046a78d055c2206b824660c8aedd739434dc928dcb71a8fd255640624d7fb4baba8ac771ae47a2d8e38becd1b69b018d5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5592ae64a26e03cc01e91fb2305486a6

SHA1
cc4c1c2a60d01edfe3df35f7597d18750268264d

SHA256
771ac36f233bf0e52c0224f263bec275eaebf8373882118a721625edddcf20b6

SHA512
7e4908eac6fc9334ebfba40a9c0f706eb9d76a7754dfad70b16ec425cf4b6172d5797efddc5aa341632ba8c992edc308b234077f1592ef834a0ba94cdd846f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4479771ea91a4dd35ab525df5d523de

SHA1
608249f5f719e7ff8a65ac114969faba932b1625

SHA256
6aeee87a34a3d503d57b83330a726699793decfce5e5137906b986e5233fc4dc

SHA512
a3a7142b7a244efe80582584ec8cc8e5a85b0a993fd2871c1c03e8532560ef683a46250f17119e02b8dd3c18b43b6ad2698fb641a6668a898bef453e58d731e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd6cd40cbc50afb2c8f479e10827f5df

SHA1
68b48430d00e39b9822d38f8ebc2b7fb59c401c4

SHA256
1bbdc75430dc157f1a1845c5f771fbab88669e45b69e945fb82354250a4c962b

SHA512
5d031e7e7048d58a2ff16cbcda091458e85b537327241c632d57f69156adafbb33105a0bfa6bd6c1a802750fce353134b3de91955372a98504d97e38d73aa046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2826d5cedacf2c3b2a092e69907685b9

SHA1
5113f09e7345d87d2e8876be9605839301f8a3ae

SHA256
66d15e29f9e44a781e9931dfdf4d41191004260705c0071e9c4080104b79ef92

SHA512
5569a25c7431950cde235078da2be8a43cf15a0f7a52716856d011a510ad101786f2bae4d23bb749d5d17f955d7da45cfff8f3448fa99ed3a393b792d4fcb41e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267c290a5376b3b474113779641d1cfc

SHA1
36cfdf35217152035b9021f66fd93fab5416c247

SHA256
108939dcf20bf5bf766c7bd24eaba1758fa35613c84775069caab0696e62bad8

SHA512
ca663dc9b2c8de7e1513218813a16891cefe1ea4445590568ff663d79cc03127b58517abf7d97827d497718609dd1261cf5be6f09dbbb190e5dc4cb2424195a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
393710ea2e6341ae3530ac2fd4e97e1c

SHA1
75ad0206f3f7a840537890eb47fab4746760cd38

SHA256
4c76bd8910f674507dc0103de0fe96f082386e1ecee397ac2a3ef36067f54a8d

SHA512
ff49bcd9a00dc0489a9026ded9785fd92e045e1a120c7f70732ea8a8a7f7bc118144160f617739449927ab4e7bd835c74074b7c81738396edff3dd0a6866bda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493276b66d536eef7c60d84e773d04ea

SHA1
386066ba093ce81619a1ee1ee17c1378c9bb9f0c

SHA256
e24b51295e3dc68a95f7f35efde75812368d4dafe12e451fb2809cecbd8b685f

SHA512
bfe9b2cf0a3ba4ab8dbf7c68eadb3cad6378e36708a2bb9983d4c851ad949cafdcda1263a94494f52b6811db590746d8924975da87d775a06e88336b719f2faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd0820e0bf33e81e4fbfd7b017a8f027

SHA1
c50360fb2b511e0a939708248b0516cf2ff01fe7

SHA256
d2a6a8d811baab7b0d21cfcef2f2fff1d26826be9790bcec8fbd7ace8e9797a1

SHA512
be01b6c1e77a84cff6fe3eae50aa0570ef24703b0d06825ecd3127f5992ac9683ce1363d04def937ee32068d24ae09e6264a8b00eceec20283964c0f6e951bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38CE.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3900.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit