3d0e5a19a3ea236abc43b2259e2ddfd912a508863caad074a84f43a3388923ca

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

administrator/cache/index.html
Size

44B
MD5

1c7b413c3fa39d0fed40556d2658ac73
SHA1

246f84103dc96f58f99c85e3a3149e4cae406a7e
SHA256

0f774764181a1d850141bf64393228b7acdb6261844f0165a78839f549d7bcce
SHA512

e05cd49cfa61dc4dc506c23151fd31558085a68544310c63b09386b5b6fd87e3d014e311596cc4f34da1cb9db0abcd9c5fa866c19e74c84718d941b7c5055a1a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e13c273c3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c7e75b0cb3e3cb2bc1b30ddca6dfc1c8f15298a6054d41a4245fc73fa0387b48000000000e8000000002000020000000ccba46fd482df71f6d6d9ea14abcef7064a966b182eba3a2973b5ad4a21f00ec90000000c90474b48c5684e785330bc25f56b3f3f9f3549ce9b20778381fa338eb45be5ed528e729b551226fcb833ab9f1e992bc736a673ffe5c8819b59741d6ac8ee72ffdf0cd12f99fe0da8858f14656cefb041dbdc144bbae6a14810f7538b2c081fb741cbd24a77459cf349e13d6a7fcbdcb63c72e670f496ef78471c075a2ceda101909b6e01a31042eec04af33b840e3b8400000000e310fa078d3fa0d58a489d9327af84d876786530cd2d8d33ff1e34f76291e8fcdb7397163f0eebe2b6ba98a2eab39e45d69b7325d1c10c9666fbf9d3ea36ec5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52DF4A91-AB2F-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000009009a5f51aa1cdd107972c739557a923baca700b1ca645da8bb08085af1c4f1f000000000e80000000020000200000008ac3e713aaf92d27c14f9a80d09a6f0fdc8ef0d03c072e269e0db0b0c0c842eb200000008e413d1a56a3c6756ed17954ed40fedd93e4903b6e0f8a9eb5da14a36eccf06b400000005bc9950c16a095286f2b376f682ba20f8fd2ed0a2ab4c034ca812aa167a8104475f20e2791a665f52021ea1b994fa807572ada13460ae5ce59bd06bc4975b391	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410554900"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2324	2904	iexplore.exe	20
PID 2904 wrote to memory of 2324	2904	iexplore.exe	20
PID 2904 wrote to memory of 2324	2904	iexplore.exe	20
PID 2904 wrote to memory of 2324	2904	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\administrator\cache\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
10efef341af6c7d7fd9dafc426bdfc72

SHA1
2e69dc9f3bbcb6fb81d3a7ea88b0e3af241cd6d1

SHA256
529a4668a06419c8da6d4149adb43a2ef3e2aeb867a48674e1ea2c2d02b4f6d2

SHA512
ce87fdd3236562237772b3efc72b7f65b3d1f5196f6d9cf3c22410fb9699b0b35fd02518e895391ea1d14c6e48abf78080edf7d5a4d5adee88acd1553ce27657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
939f395edbebb63d77af2c3c576239a4

SHA1
a0fddec3e83b37eaa56730caef1c5449ae325b02

SHA256
280a90b74defbc296495d4883dc389455d5e5fbe5cf775e6e544956b679ef1cf

SHA512
d7208169f577c0dc7b4207d751bda4796e2fb60e7719813927dd247b8e32d946c9d6825de9f3182b392fb9f4192b4b97b8eaf4982ddea44c51932323b87ca4c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59fcd6f273858f1e2ed440d907dc0629

SHA1
f9af618f0814afb065e49a6b1a4ba1fb3bbbd40b

SHA256
4977531f617e5a50b779190fd4e75eb92800133c96add9cbc5283182346a2af5

SHA512
17a178d4af6090be049b2a569f2e812ba78cef6ac259f7f6a87edf95130f64ad6a2a7182a04c7baedf3865a9ba9f44c9cb11ef28623210b706bdd2fd72bb5781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a66fd47dc8762a88b4b7eb80f3f667d6

SHA1
d87d574b9922940b32a878410f7b4b1dc3f05c88

SHA256
3b69f75bbcfa3a65580549e7458ede99fcf977a250e5e8cf235c36cf099a0e61

SHA512
7e0ebb632091e04f0f80cdaeb44327a5586138eaf7a8e598d585106b6493f276cb1324a9524ef64a1f46d467a834c331610a7a662b64ceb78b8daa661e3ed374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7362dcec8f33d6c4ab48ee0691a0e240

SHA1
9304a91bef8fa7ec4c6df4c4d4f41ab41764fb2d

SHA256
acacddb0d246756e9371b265ecbdca9456fc2a770f3e5d27316d2ef6efb1ac26

SHA512
250a6e9202ebe5484713977e8eef3643f502c0d7151cd3905c21c39c1b5315b282fceaf1ae9ab5150e607258d943af3cd88c3a4f1e5a2366902822dcef5ef20b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e634a8607fa5fdd6ff1b7b7518867536

SHA1
c3059039bf8eda223aab209d54c21f4ebc998ae8

SHA256
939280bf3495b672a07e07a389edf5532bea707246b076377b175c3cb5c8f900

SHA512
bc275923b74145c76bd73f6fdeb3592289de9fcd2baaad159d413070fa3d8d39ea2eb3d85905481d780ec14115eef5207748bb0953f41129ea0d0990d1b428a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b51b6414d9913054e3bed7c84e19ca

SHA1
671afd595705c744d640980bf77ef4d3007d5e43

SHA256
adb869586a55e9450d2fa119a05082054932418663e5604759db2d7bc4b4a5da

SHA512
1f5621cacb52507097ef187c5e58b02ae7f3f0abb616944e73a0a1945463d0867698b9ce42f11e3a274d96cdc45946abbca008c1e2d84ff2d9f8138a5a2f9baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
722226ec7a6ba797a0dbb79133a05992

SHA1
07cb3065d5d61e360c2e212b1ccfac51dfe616e2

SHA256
373510a43a568a45d893516d2fd48646000c16686db2faec71e16ba2f3433cf8

SHA512
08aa1989d87eb3c88d7bd87f9ba8079f0f6741aa12f3af5f853d808a431b23dab8ee7dcabb568c2329be00f2db49ece4f1dc66b42c6f291ca498616d092912a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5750e74781c94acb6d9d2564191dc760

SHA1
1d638c45c22454288be489b5f6d71bf27acf2c6e

SHA256
e6ea53f6671bb3b6bbddcc18caf7eba75d0d67e75e3e9629557d951f92b82302

SHA512
430fc4c0edd6c96281d5b15d4e7daecdde4118f1472a36c25af311b8235cc41a5e14ee63b97f70c5084dacccca18778c9c8a795f67aa7ada9427405a6a2055cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31D0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit