debf351be78e09aba6a74dd649077d4b7ed011f244b6e0e0ab3c75577828862f

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

help/html/getting_started.html
Size

2KB
MD5

49814c331775789ebebdcc3138ef000c
SHA1

ea1cf1cf3ea1eb837435a73d40c9aab5f2d51207
SHA256

df581376d820437d02b951121fb97fd1d620716d6a47e9ca81be0b1174fd7f4c
SHA512

3b38a4ec900476c32f702eb3fc5b6a6c25c56371c63acccefe1d1fea2be7efcf61d8391fcccebc1d99e1bfbc2deb9b2db9a7b676d2d9d5eadb025d4add6bae49

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000003cdfc96fa5e14bab0d615df65003d28bc7a86296515ed22afa8d4fa8f67ce3fa000000000e80000000020000200000005a16ff5bd7a02d0c60ad689c6c28b38f99efd68225866a22b565a108fa08a199200000000fc7c33c2e8d60de78fd2c9a838986daaca2a78185fa3fc0caf7c16710eb098c400000008521df3a39cc4fc946d0c7bbc2706836005c0d0558d42b57bdf87325022c7d90037c3cc1ab16723bf57fc28d73a4bc6b8b413cee1688fe948e9431fed3ca1c59	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f313dd3045da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411209751"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b23a47d74a435148aed4b7024951f0771d36997ae88f6d7c2a54a18fdf9e4c4c000000000e8000000002000020000000fedf9d4d49a727a77058b06e47bb11dcc92d16742f669d9f9ec6f39d2bd92f389000000089c8b052c9e7e0b8be797f288829c83a77acd4d50da70b12e220371966c1a893c18cf244a7d574081fc5d004523e0e8b76743a9e910fc4c7a8bd62422321a51426c90d8fe787cbcfc057627be11f9b8c00516426c53f23b4a866b0a3a986620951fc6796851108de52efc858c06cad59210aac76b515ef3f6ae81cb6b6c268c104f38d9437d8b01d2a08485b17f39a1440000000f4e28dc7f37d1ddd452bd58cc6e25d9d474ee3d9e2135999391d8b4f1a9406425f2c0c2bbcac3a11f69c5dfcf5e81fda711d89af7beedaf35f06fc2dbd07edfe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08591961-B124-11EE-8301-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2708	2020	iexplore.exe	28
PID 2020 wrote to memory of 2708	2020	iexplore.exe	28
PID 2020 wrote to memory of 2708	2020	iexplore.exe	28
PID 2020 wrote to memory of 2708	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help\html\getting_started.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd704d653a9f3a4591e04f4db8147cf

SHA1
0d285f8a0713f24675980c83f4b088f99cde33dc

SHA256
3048420944437b053c51c39f401672137082ec6080eecb7f0c788ad488acfe0b

SHA512
35e0e16ddfbe384ca90f2199231d0c754d5fb9c64774c9527d0f0dc1659a2364988d9d83939fddcd68fab6d7ddae2276740b1c9a19e2e6baaa05845a0c3f7ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
933098c6f919d1987480be636b5502b7

SHA1
5d1f27aadc291cb4c29523b5054d727bf22767d3

SHA256
7dfaf2cdfa2c69156992a82a7b3a1a57d3188e1f218c7ee848289b61cf51cf8e

SHA512
221e231be4d23e2e614174b7ace6a04ed9cc9634438a2ff22f55337ca16e1e2a9f70c3ada37c675df05069d3246ff7e5b645abfeabe1fb36ab1433b9a1f197a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20b48a11c9a26e6f67756a2668adb8f2

SHA1
c7a0d87ed38a1205890ef241cc0026ca0d976446

SHA256
3ff6fdd96e0d168795cdb0ea49ed3ef932d777595718208a32601b4817df4d30

SHA512
559222f6f59d973beff0093d3185b0644567e84892e2bb1fa5097d1b0bb6079abf868b4100640591cd060ef2ecd913b705af60f51deeb5033f8d2c94cfdceca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea34adab67b4011bdc488dad90a6cc9

SHA1
b013813780a5bfda69c49b256b162dabf5bc82bc

SHA256
04e72a8f1ddfd02b675cbc992f21b535430bd69de1c9e38043b0166835dd81e4

SHA512
1ed91efe2968a772332de6c89d5e54f4c6581b9d61c804852d5fdb67aaf64dc942fd8730d07892a6f5327235f9fea200443d0433901b5e4100af37efca63b275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c60472b7135fb37eb55cee5874bb13b7

SHA1
8970037af5b09edff6e2c147357e72dea5772fe4

SHA256
f12b3e28e644ac4c19abcaa0ea8a17df811da47eb94086cce427fa1cf051694b

SHA512
a3908f0507493f3b2107af89f306a69cd361cbd78a6ec9305e553f6ccc995e6b4f038c1a11b64772728f192108ebab9219ba346f582fa88b0c2c7c4403a8bad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a740767268e01942728b47c36830d61

SHA1
27ebf6dadb82068f41e2befaaf6ae06f266ae9db

SHA256
ddc4bbab58d69a3b22fbe48637d300468030feb4e02df3d8555523fa3f7a914b

SHA512
08c7a95e8f5c8270c9664e4d0f785fe1ef4f088bcb43e137af51f384eb2d7d8a29a3dd16021c0d9c93db8c36e2e3f59b16e55ffe9248faa9d60fb2f68eba2497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6919d5f898c33dfef6214f3f7c854f3b

SHA1
0109efde231d1ef00534a17aa688e0240b23ec09

SHA256
52729b7ffb4407c561c971bb2c8dbee65d64164853204de5bf503d37dbba1be6

SHA512
57cc0d5ee998c75dd2e37d1dda7fa640bb5ed675afeee38617b8de98345b7425e335233d13201952650a85b18f0fee568b4d8bb705246199fe96e3f7badc0233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f68c8cd8786849a233568bfe03356901

SHA1
400763725813730f9eae13c022166f6d627514f8

SHA256
2a1220f25500b571d5364187292e7bb67791abc9e5d53253b8e5225797a71c25

SHA512
17add4c1d1866a3f1af0192a656adcb2d2c1a8cdd2d598509c0d60c0816018f383a9c650491f5b23a39c446eb6e500d59e7c86b2a6201255fd877417a2938547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
678eb0d5464c831e8c5500316cbb3ac6

SHA1
56137066a729f65f1fa2162d8edde0cb108724c0

SHA256
94ddc724bb2bc44ab91cd94a4222d03342ab5730ad33649dc16f7d162c52dda0

SHA512
8864e6ec2df54d58f749c0b88856c0e46f7233ec1b819f6682f7e2217a54ef417bc74841c603d1b2da4896079f4768b26bc24b57ae5b3ca917c77b4078065e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47110ba15c8d416f8c25e7d41ed39854

SHA1
c6dffc4a98a630cef6f5723baee3f30520340f00

SHA256
392cf1c26c8ae9a7a19b07f7f390df5952377905860394b896c2694e1cfc4fc2

SHA512
9f2d82e549d8e119290c184dfc934030b2ad0d374a566f08056ba32f4a65dfd91854e7685d88a229be89af58a85d5e675a2ab1695e9d9979aed20845eea68b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6941.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit