834c4b46e8a5d23772d2ef3f59cf00ba515232ff5f29ca1a7155dd78080aeac3

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

attach/index.htm
Size

69B
MD5

b48f668d29cf52a6db9a95f56b3fb67e
SHA1

70d9a5412e54da30dc44868e21e1c00cabf04a15
SHA256

544503741cd48b65bf728ac517f8ed5b40961a7d8d359127b2d2fc24169cfb4d
SHA512

e30f600598f12bf6608a284eec1153720d1f8cc5e722a85928d02d2c3d53c533a1cebbda558066d4965b50d6c57ab06959b5003b622469c99db1d471a65b895b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000b9246c8b4b99ce7f5fe2ec3a46dfcedf4a04605299be12e85c4017bb13737619000000000e80000000020000200000005a42607978b505291337e33a18061da127aadbdf72887a268fafd5ef7e7d1f41200000003eb0a524b26ce5df51733921cb29d6ff2b7ab03e892ec3694ccb85343f0d879a40000000a1fe82582ad851c3223c59a677c9f65b3fecc503353da7bf7ea593fceb7f52efefa988f7dd447a6d738e74f3c91fc38d1df1fb58bb9ec7c4efa51176533517c9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c950c9ccdd05a86daa7e34ca6daab167ddf9299e44ba1c78f0c39f36eb19a573000000000e80000000020000200000004b6abe242505d17677cffeb948eabe8a0683ce723da46e89ec01676e52ef2cc890000000f35f019ec885cf145643871b90549a60afe24358169b180a3aa93f70dbb3eb2ae1c7440ad2e2951fe7f91c7991ee93b3d97253282390ba023fb92e4f0410501b7e163b2b34dc8c6ef3f54c91fac835e2dfdd86c9bba9230ee0f8f241398fba1a0d30024bb56e9c09e0c6887cdb6aa06e50df5bbbe3b54aaea4828e0f1c1057d9029f4ee192577404a3bcb6e09d2ddc2c4000000065434d361b76629f8a160cad219adedd1c043f423daa182fa35ae12c474868c21d249e78ec515a94c98ba8152d2edb2aa673888dec7f572ced3f954bfbc2e0f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410173743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E31A5E91-A7B7-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e146a7c43bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2828	2044	iexplore.exe	22
PID 2044 wrote to memory of 2828	2044	iexplore.exe	22
PID 2044 wrote to memory of 2828	2044	iexplore.exe	22
PID 2044 wrote to memory of 2828	2044	iexplore.exe	22

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\attach\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9720c57513f88b37fc59d1154203c2a3

SHA1
e0720a96bc14fea1d717d0e7317a2ad04424ed89

SHA256
1eb75c5275b163c20aa3c4f598d97f7c56d2d6fca59d1a1a0c3d0d54dbfc495b

SHA512
4af552c23167e7367cc0e9a446d7bc7be5f0397c133b925039ee5c923b55920739d5c3d45f9efb86395bc0335464ab62d6635e169fb043f23b992eee130d6048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5851a93c13ce838c7a939a515af577c1

SHA1
133bc98ade7ef7455b9657b6d6547e66f69b5117

SHA256
10fa3265be1f148917e085ada7a48cb96dbd1f90e8c84d105d613df68f53e85f

SHA512
05e7da5eb0b6e925b670ab56429eedcd4408e4d5423bb6d0cfa5381f102afd23b5e1cae55a5bae51dac3b8d691e2031152575e44eeeff33e98aa02c18f0701d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4457b28238e3b25de9da3a24c76b251c

SHA1
5ddd5873cb98a101c229915c5f60f964f880b934

SHA256
85e4f63b1ee5fe987bbc2e2209b5ae5da25dc80c906f2b632230656e9c24f09a

SHA512
d3c10c6522a7b650c5c8288f2347f844f8bef3da103274b3f5b9c90b154daa3292b128aa3e778e298b807f00aa877e7919629dcd7f4540ae0e47585d48deb342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ae86d74429ff15c297369480fe66c1

SHA1
f691a2b66dfc31032a16cd210630085daa19fa57

SHA256
bda942fbeb92aa1cad53f28a7e7e2069b66eec1f1d75d4400c6906d78ec24146

SHA512
ab4157616c3048e3a3c1b3b2a20c8fd5fb3e9d2cdd088e20ccfb8adb43d0c0280a1d1cfc6cfbd3bea13eb187dee8b16bce49317fa5686f778e5c5f5848c28647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
069f4aa0003a5b9517e836cc7d69726b

SHA1
1a60f8ec1efd1f53b9f6b25fbb4278459a24611c

SHA256
860db3fb83aee5d8923a16d0c4fc5862c3abcc82624aedd9dcc41134028c1c51

SHA512
f39dd0235e0941d3f94ca732cc8ea45d0dae8301afe04c690600423feaf7b1e2b2ba8395691564db247121ee8b33a360628375cd4e91e553dc203ccc1437d0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
643b04ded0ebf0e14cac524c39881f23

SHA1
f36a6c981640c2a20d5cf3b2a108c55b8dce5474

SHA256
6c2bcf96fb889fac8b63a484d25532a019699f1044e318e67323b8d75609cf84

SHA512
158b4dc944ea0c532b165337c877d6ac80bbec5df7c310b52bfea39f37b982ed6699eb02aae30bca9a48a50820bdc5c33dc0631b3afc8c612c417a1cda858386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
070d7354a048e20dee669b37780aa434

SHA1
22c0bff4e39e672ee720f29c85ed1a3d65aee1f9

SHA256
b589c1e08a9c50256ec849b713ebf93e7d4ef6601704556d952334c70913cc40

SHA512
1a931abe9d5cfba6738f248cd1db9e13afffd1fcf08dcc5eb7cf9c0cecc7d638df96531c130f154da101c7e9c3fbacf2cac7b64755c58ccebdbed28cc46e8063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccb7cbcf59f687e52d21d12d66e7dc1

SHA1
1e32463ba500f9b6d72f49d7eeaab46d706e1adb

SHA256
db079b0af33365312de24f122e63828d305fd02b22ef9012699554298adc4867

SHA512
ef4331c68dc3bc0129313458408a69668f6f4e18d1f03f2e5b508ce5414f4e46e6a46364c429323ecc43f9f6e6315106531cc67dbbd95982860d9a64d4a6d41d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f64f4e44429304a1d5a643e8a319afa

SHA1
0f9414d9665373d029b67f9d15bb5699a6bb3167

SHA256
9b1c9f8ead2c5c72cc57f19a0f62fdc404c6e787f044d840ef7095f0a843810b

SHA512
a9f0461fa2e71cbd7e4103aca9d1623e2d04f6a7571e7a278917b8cc5c2a5ce79feb5e68821faafd4dbce093f0ecfae3a7eef1f86b5033f88e3ab7d23845b375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b18ef7f7828dcd5f40655e7f127e25

SHA1
4d3aecba03fb386c9b28cbfcd5560a85f68c9978

SHA256
a0bb066cb3b26ca486e6e367fe3db95c366f3c50bd4b3812b01e40ee5bb8de42

SHA512
e189e2aee306719d5fe7bc03a701ccfc88d76ab22215c388f5e54296d82630b27c7938756f4eed19cd4c4a6993d929aa9047f5e144ca6a5a9d87bbc78afbccf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7d0e20b5179ff2488e370400f0f4fd

SHA1
f82fc5075ae75bb59168eb18115527c0896e6aae

SHA256
dbf4337c3ff97a9420d290280ef81ab3436b0fe3daba4523942b7821be0cb1b0

SHA512
499cd9726fd7002e5e0b970c597e92f74fdae1bd192190a9460f19349225fe65a64be605199398d03d85b324cd0336a3a1944185260f9a6bf62029bf1e7a2341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wz5r4lq\imagestore.dat

Filesize
1KB

MD5
e94ca3e35d3c61b27dd0643501c42e6a

SHA1
24490e0970d3caeea6dbfc6aac072e46ad0f93ae

SHA256
682c5daad9f525a1e85886693c1debe5b84c56904ba35d0c35099822a840c8eb

SHA512
a5a9f3e3407a5a86818c3d999f80223bfce90e23290932c60511f45d31d42e76bc4fe0097edaaae26ef62500cb00816f18d48025da769f4552278e0aaff3613e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\favicon[1].ico

Filesize
1KB

MD5
36023f9095bd20cc587ecf0d363d0375

SHA1
717c014504d8f771327734531e672172da35efd9

SHA256
893d5fcb463fc085f6b8f5a7d22fe35dc5de0418e35be89235b24bb832494a2b

SHA512
d3f8db3f417861a52feb0dcb1701e79ae81134f54b8f9ac90a848868dc37f31d81c27be431e1547e594903541212372d8cc900f59241f74b745e7f8e9f90af91

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8AD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCFB.tmp

Filesize
27KB

MD5
4de565a97198662b7e7e7402be3cde7d

SHA1
1e6b9eba7be30fc182035e93c90e9a93d2b93a50

SHA256
7da20f7f236e8b653b2ee22a5e5f3be2065b3b23b3fb463420435c3d93b190f7

SHA512
5fa545255288bc1f991390b038e5448e8e56a4de3322220e46728f2d8e11362be13c58f9c9ed0aad74db273f2181e3a483ca2688b88fae03829728a05f9d8e43

Download Submit