84fbc64caa64f7a42ba5a80d9bdcdb333c10b5c2606c5730b2b14d8d836a4801

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

api/index.html
Size

1KB
MD5

f5977d1c65204a628f02b785c0526c9b
SHA1

3d2a9b9b3dd0f1496f3705f4a90171333101fefe
SHA256

90fa771cb6e5605cbc7a27e1207d168ce1b46cfa1a2b158b9c500ccf06369467
SHA512

96d9c1c440ef41f0bde32bf8b3d9d1dfb7d2a99426d02949613c51bd28339f8d304902bac663dfb613b3e34a920d44ed3c90bd2db131c8a89b6413a33eb5b223

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410189754"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f98a2a7d8dd80d8577dc2f85dc701279884a2b66e02ea81ffdd7ffbd92936859000000000e80000000020000200000001fc8c460b1656556c5dfb228cb7b95e9f9214272cd2e87afe03c83acbccf242b9000000077a3ebd2797a63c68def77b761e38721d68dad7b7ea96a92f52ae41b326eddbcbc3933870c89e27a74d444df8129a5132aa43684b354fe2c4c03aa97cff840beb6277aa37d28551b26c63926002ab255ab8326d1aeb3d2d09c2c47918f7657761d208d5a17ba7d49fa52243fdc3b12b5a42e8f675102dca5ae7002f4a64f58176d4a83948185d2939b5c22335afd25664000000092df11bc1d7bd28403f9d84f8b70e383d88eafd8275fa6cd67eca63ac6aa7ee90930b252e285b3a3bb32f38b28edaa4c1948d0540405d46a6b12e347af8e88b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B53CFA1-A7DD-11EE-993B-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f006c1ffe93bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000654e6b46312151d7f42e9399cb9e5aa98d55954a821f8969a8a8259378196713000000000e80000000020000200000000944ab45b61739bd353fb892fdfb24f67795eb69df9f8928ca0e17edaf11f357200000003071a962a814c4ef2f4f4da42924cf2b6fe6cd99e4323c9ab4abca77f4a8f7384000000036cacbcd369d83f977bd28b418284cab34efaf5a6337ca54a24591d780574f6a63a0999d6fd9c21326e58402514e7491463ad471c66f72b1e7e7cdb98cfa0ef6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2328	3008	iexplore.exe	17
PID 3008 wrote to memory of 2328	3008	iexplore.exe	17
PID 3008 wrote to memory of 2328	3008	iexplore.exe	17
PID 3008 wrote to memory of 2328	3008	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\api\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdb132ec9b41f07db79c9f8e17b7ed91

SHA1
b1392f137b849fda7848888a6dde7d5cb850539a

SHA256
d4bafd1075b4c28d977487a5a01141c5d6fc33c4afc8fe281b1768cee1799edb

SHA512
9938db420d376633aea7b3f8b73abad6bfb1575fe1a77c38d33dade9d37fccc9453630fe2b117286d8f28b52ac5a8bc63c45aa02ec046d6015f25cea11e91eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2e4fe7be9b978c00f71df23bf22e939

SHA1
0d702fbe3c93f4dfa5884fe87a0b2acc148208e2

SHA256
e1dd037b6d892f676dd6e8eb91ed2babdadbde5fd0a53a3fb287014e7389aff1

SHA512
edcc4bc9754a42a987d05aa47ca9200b8cefe4838d0873dc9eecd331840ce733921ea16a68c611f8ce5a4d5888e463c32c48271935c5e063c4e470d811cff716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26f09f125240d4aa2cfa920ab3de15d0

SHA1
b3c6ab24587f1ad1bc0b7ce34adf1eb0cccd4283

SHA256
76eb5309d3fea800a5c66b5565a64182c6422cac79c432b6e4716ff60e8a317a

SHA512
6a6230ad1dd28d8d2b620674f53cf5a3d1861a4dd8a46ae3d3efd6a3fb328a59d7e4a321ac9550322e1b3441724fd6a66c327c62d95a5b71eda81bf39774e7da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120aac00da1ad128a333500680c8e2e7

SHA1
0fbe2b4394b1b8c9d46c953399d54a6c68d6b091

SHA256
9d42c2fe8f295e281913d1799df416184e32e541161e392f62ae05190342e029

SHA512
4fb5dab91ca3488148dfc1d1e63f8e9639e9791444f88b3cad0d0ec8fe14cedf0975d5820cfe74453ce8767d766359de87668c05cf3358f240e66d8f9b375b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25cb0164fec72245a103fcebda66ef6

SHA1
10769c1ef42860e033d4e8c4115504dd19b846d7

SHA256
bead1cf4db70902704949a4eeec0ab141ec7d4041d88f1c6efbd44f0775413cd

SHA512
4d9662aa2bdd5b142520d1595dd420df5e595131b7e91ee54dc551629d02add1bfb468a2b2613a11a36a1c682bd935063dc25b98823100d874267a91a1549f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4db931b8bd256c0a69c13667f9595134

SHA1
b6a597100e74ff955f505e07490f67747113b40d

SHA256
5ffb5d9f513e18b5a50b89107e5059bc490b65ca3be0236df35802bc84aa3995

SHA512
61f149c0889ab243e3cb9915d934e031c9dddd00eb1102c402a46792550c1d16ee09ceeb00b8d05322f0a1aaae2e1b3feb85a9eff1f466937ff276c921e38177

Download Submit