d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20231023-de
resource tags

arch:x64arch:x86image:win7-20231023-delocale:de-deos:windows7-x64systemwindows
submitted
26/11/2023, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e027e5-1183-4601-b7fc-913399630134.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000009a3d81ae11b481cef3382fce7dd7cb60796887990081ee2d8f544033a66afb92000000000e8000000002000020000000bd7d4ede22e58b223604437d40598f521a3e951992d97c22aa7aeaf3f897899120000000c28ddb8ddaa9e2124b3be083d2456cec8f7397b40447f75bc6f7641786438690400000001624663a10f4dc50a6657c21a34ce76f885b0fd0b01771a2ec0e79e3d8d39e9e1834f0a13048da569f9ecac96b639d20e873a247169eb53f8f14c5de1859e539	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f8ecd73820da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{030428F1-8C2C-11EE-B522-D6DAF8237762} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000629766d3e8408fba1b3be47f9b6a3091c24aa3260d5c7b52038175ecf54abed0000000000e8000000002000020000000448570cb542c2b97d88895a994f75006ab525a7b26d337f1c02c76984e9a20a290000000b2ffa345da96b979e76dbc3c4b098a63f7b0dea6d4e2fef44839d9490dfc19b1c8f4802e6cb4b32702199bca36795757bb8924482b00f6f43fb1012fc732faf95da325c125ae688be6b051db0857dd37c5d21de2f24d796f997de8bbc80bcd28774552bab3f65d7546d346284427ecbdc0fb19ba25e31427ce4c8f4caab02007dbbda6fd8c30b8e3e0573a5518f9e9ad400000003ca089a50a6725aa87d67fca42316484e06817b13985452b9b8f8e33d2a19ecc4a10fb5b01272d92c5ebffa57f64800f7a70c8a416e0d674d707ebdf9e15581f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407144983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2448	2864	iexplore.exe	28
PID 2864 wrote to memory of 2448	2864	iexplore.exe	28
PID 2864 wrote to memory of 2448	2864	iexplore.exe	28
PID 2864 wrote to memory of 2448	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e027e5-1183-4601-b7fc-913399630134.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e57c877fc29d3ae92b5d867ce867c4

SHA1
a3068a9fa8cfb9245f76164a51ac7ae51fadbbc0

SHA256
c4ebd01870fe8643f122a447785415406f55c7fcf5d6b83e73049957c49f784a

SHA512
cf7a1af99a3171c2f572b3ee531fbc6b884f1e0a7cbcda9e7577bc67fbb7a960a71035fbf310add1aef3c14c042947774cd52ec56e244e612fe7c84d298c826a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2affcac7f714d2e59dbb7f8648827aa3

SHA1
0c373ed416f5abfd34e455d145deaacbd68d38ec

SHA256
cefd063780f07094d66744495a3c11b1575f4a5a5e1fcbe06ea614f861322e49

SHA512
852543f79fbb46696acabb5afd00d99c9b684b6488a513e6564b64f29087dd6ef204c9f4634c7e4c1b9a9108a658d5586195d69a045af175ef01a3909ab08942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b91b20e894b49728e0ea53ca5c90685

SHA1
31a3b90d0f619bbf374935afbd1d22266bdd18b2

SHA256
8b2a00ee1962006f960ba789e586fbf6519d0472df0ee70671e4c6f7eef2be33

SHA512
797dbe51e404ded654a0d22ab7b1cdbcd1d1ada4ff90b87d54ed50a02ef2aae50bb81c967c3778dc8286d04176afb989f6eeb4d14cc8c3878fe6a7bad40551c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b8e82d7c1291232d019a9d70257fcc

SHA1
95b9268ab3fb93ccba6f2547b96ef06d0819dbba

SHA256
c9e0db57e3bb65efdbb585cee97157e5ebf1935adcd208736821546056eeca61

SHA512
f86672e7b3f5ac2b249a065833f648a46baf717c08b239112b218080f3d0571a9e5286715323fe839b267043f0fb320b81f5c0fd80b012a487906c718b7a96fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0085724ea7c6915833dc090e6b04851c

SHA1
db4c497048b366f9bbefe3de691cf7e737a41c45

SHA256
004702da117a9a8270c576d2ce0378433c7a3da03da2ffb4bf3831c861f6f67e

SHA512
046165e615aa1087fd878e84ab0050ce143bc07535e32b7ecd4d2c8d90e4beefdc706084721485d2c945980b54764bdf3fe5ced26988ce24bb3ea8f063036a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e6372b6721e8fde27d84b35e51fd9d

SHA1
c7c409d7ccb8a3549eda782e7eb4d95fa78b049b

SHA256
989f313456591d7034909f49cd34cbb0eeb308802104d985103a4d0f8fadd738

SHA512
6001e66aaed99491b08c35a94f09cefac0e2b8b71f3752338a877805d43e55dd2928567f7948e10bb4bd0fc5b67b819b910b92faabe84fe80854b7dfdc695ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
071995bc2182094274b320fc36ccf99c

SHA1
ca60a121b6f25238f427477af1d993988d68fa02

SHA256
ec217eb29a4f9aae833412a532a2bedff6a6cdd555521937418727b6ea3737f9

SHA512
f0447a3b3778f2bf8b168fb9ef7f39d401071bda1f97bc78fa93dd80b12993aa81a440607e5e31dba4ecf05ddbdce8d157429ad60441fc7be9c044a8b5a7e981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc512e4522624a425cf85af3b1f6c98

SHA1
07b053104da5b7ee3271fe4c7a205471b9f0f35d

SHA256
65a126c6cf16d604d41c601d396bf3aec2c2f9ce969fe9f365ec4a2cf71e6695

SHA512
aa39ca861cc256dfe6bcfd262b86d4de66f3d37cd1a9f05196cbdb21304ae46ef4658b94d08d2ffbbdb8307091d46591cb6c526cb9d5fa6eaee8ac4f14fb8ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f6ececb7920ac394963a68e38686a09

SHA1
3158592913214f7c06f21157dd49c0e521e56ff8

SHA256
88e664417301676642e5338cf3e964683269ab7c3fc008ca4eb3b4e207c79805

SHA512
1126cb5f55ed0c6c098ffa87b85aabaa5d1c15fed4038f851dc607e214243a9e12880ecbf70cc26b70f722d138f2c51c27551cc499ed4f44c054d2c996ba8375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61dca46faaf72f4d6af584657dfef30

SHA1
ae3a87905a9f7dde09e7984c1ade177b2b9f6922

SHA256
872f780f1fe823fdc9358de90561a5817b45fdd0f7974749091e588001e4c9f1

SHA512
beed59349851363ac3372b892b109f4f85ecebf30c61de56a4d27f714d4d06a0bae98052b31ddb64e17b11831168b382b669ab6460a0721422d80ea50bdb256c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e1bd9331eaaf5141e40b09f182498ac

SHA1
a1ee153930aabe2a0f5c9fe8f4441c34108cfec6

SHA256
126da9ca59c6fe8a8264a235a46681b928b745f5ade985caab3f1b28194baed1

SHA512
11abf4b68ad6a4bf5ca01f9ca0191fb60803a9d0140851078b489382d78ab0de55d003f4494b1cb20182aa3477c19d247b3f74a8ccddaf4d19c7779f76e2aa37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6906ebb59955d6d01a75a9c2c5868186

SHA1
41d25c87d4dfe32ce4a828da2d33135bafcd1003

SHA256
77f7c6350aee54ab217d0e5c1348ec940b578fe627ec3f167cdf81e11ee06609

SHA512
60d9fce8b538699bba9a29fb8a960bbd1306226dcc662b2cc867be92589771dc1aa7945b8ae6c21c2c5661203822daf33a393711db44bec6ec49289f3039a6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909606365f89f611073ce2d6304fce61

SHA1
8e748ecf999e4f6b0455f9a78e7b2be58e2bda0c

SHA256
f871e6d343fd31e52403115885b9405cc0e08fe8e88ec8f36c817bcbdd9f43ec

SHA512
1ce52743e3559aadf14c24fc94ee5e6d8ccd8e1ac2980c973380450143ed3710acc6558edd5ff4b18401d8e26d0f9986348c8f330cb982f7266e2ff26ed4b82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81a1ebde88df0ac499a68ef8966df8d

SHA1
1d5fa5b21184cda45a5533b0ae3a1b9b6e5e98c0

SHA256
5ecd4bbf984053ccc0062e5411b1020688101b5fa2fc69328844163a99fd2ee4

SHA512
85447595aa63fa64a3b746863cc90ceb0d76f9a0583ef70635bda850a7f4c6569d2d25f7a57349d61bcfb7192a30e0f8b0c0240bc905fde599676162b6d25a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebbf5f7b7cec9b9e1048c25334b2db1

SHA1
efb748aeb5d39550bdd9421af398a516e41456be

SHA256
0bea1b288ea1e48c3b722da2efd9d7b707b49ef276a2f7ed63bc1a2ac67987e2

SHA512
9435509b32daf9565e6fb42a1c9970a975cc0db90e608bafc64025c32f705f7c18a32fa5efa986f370149e536bac2dcbc589268b056ab0f581c1e9daeb97a205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa8890aad07ebe7f2bd208bed203b77

SHA1
41e20e82351c7ea93355ff698bb17bd6b837165e

SHA256
545d250e1933218132616272f2d0285278647778dab3715c175bf5adcae5aebe

SHA512
aefc449ddad16d84ff14a92d9f94583bff5a93d9b4d3b9388e1e8deec43f06300fc217b8c77b42fff3f26044d1486eab28c7064ff288dcc2b162ac65fc19151d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c01fe90314da47dea3c039fc61f285

SHA1
553c051eb905583fd835d1ef058537143b22adf0

SHA256
862c03d60e46632ec9e212f80e8222b07c93e4187af6e3ee67a529959212444d

SHA512
69a6ac048054b91d96ab25d4a047c4e1e9b69d34557b7845a81c5d41634c1bcc66f6096d4258faf9b20a77bdc2cbaab9118550d04d86ef229d968edf72902507

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7AD.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7F0.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit