6db9f6442d46fbde0953f8bfbc36bd714e5e31a62f927563594cafd60724d3e0

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_32_/ui/html/exit.html
Size

2KB
MD5

0870fca6f1e7dcc2672de1bf5c58d836
SHA1

072a171ea9d49d355d36f2b635fe3433ca588508
SHA256

109e0e1d2b4d8603f92a58a42adcf1726a5b2b48ec692ecd96bf4b53916f6bba
SHA512

0d5507065fd8b30abd61e30d3c2ebea375e4a08fc4835c694a2be31868f3ac92067a8891b76cefaf4ae5e7ebd7a4736b1559bede6ac2b254bef154a019034079

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{428D44C1-D033-11EE-A03E-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fa10fdd20e0943ff6d93e1377f28b57519be7e86dbfbdafe60b06ec7bc69f26f000000000e8000000002000020000000ff11e69d257cc1f41bbae9cc8e96dc710e3b273e80c90b2c71d2038a7bfad2732000000083f5fcc2f80729c582ee6810f0e190518c49e6f953648f9c9e29747ba4ac414740000000402366f46a2fc92db81c5aecddc3e501b910832a44015c77694353aae16b0c7d2488205bdf4f44c6e16a3a88ccc61c4680328d51c52bc148834f9813ec505431	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000308342dd0882d13b410d51ab689de6b649b0b4e7988377f83c4c53901ea16f48000000000e8000000002000020000000ba7315c8f4972813bbdf0e3247477d2c67159c8e15b16910b7d3ca33cbb278529000000051f47a8d52cae973a07439f566702fba223478100d72dd8b272a012342a1d4326026194edcf721c8e9183488eab4667ba36f3f551b124c2ac17e9d1d9644afe4b33b89f2bb576c89197d41e20c94699d408445b463bdcde0f5907191378df7190d7105cb03bab51202b58a91faf4e2104966f5d3474c8ac85282f46fedd8cd639ac0d4f809cd4d3e49d297767dd78f9840000000a774047e954a0c4ed16330eecbbde8a30fa688d3417500e24d787aed7fdb07cad29fe9f8d176b092a40a0e9d4bcdbac9edc72229a5cef6e789108d64bbd8c0a3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09c89174064da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414624776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2292	3040	iexplore.exe	28
PID 3040 wrote to memory of 2292	3040	iexplore.exe	28
PID 3040 wrote to memory of 2292	3040	iexplore.exe	28
PID 3040 wrote to memory of 2292	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$_32_\ui\html\exit.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
007c16cc122ec662d5ce24af1f315704

SHA1
87e532de81138091d935545f2c1e740bd1de5b2b

SHA256
ef9057b12a7d5bc68d2e8f26fe8727da887f28b55e4bd5c20e04ac2a41651f6a

SHA512
417bc8228ab0d3d3a64402e6c2dc77785a70db2cecf470a473d6a3e90c93d9e3831966d4713bd26ff679cd22824157672291763a04516811df571ee9712deeee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c380a3364af7d739f57437fee8d5e95

SHA1
b57faa04f68304d55e7200fffc5b92698896ada1

SHA256
5fb8333cea30947e9a75692f1c03120bf96cbcbf39c1c3ccfad1696aed43c90b

SHA512
a03394d1aaf4d7ef71c2b9020233c4a35f6f4a8e7c6245d7f17c3b2a359a9bbc74d1b4002f524da75c974a1cfa8b345dae4f7f438e869009e118755d65aef71f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c2fdf1492ccaf1b4e57bc8843ea796e

SHA1
ed3719f440ea877f235e27d6ff8e133a886e67d5

SHA256
b48a9683645b220ce8b6033ba640e4957cb5d037190eccc1ade44b95d6907677

SHA512
b58c3afec8732dc992b876e0711d5e33559a6ce18a08401d3027c43c5d1759e9039998c886869ca5232d9c4eb3b47a0df7f4a88f6b510b1bcac4e3b6344f15f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3585e734b88df22ed4f180fb35b3948

SHA1
843a9e7ff87938d60c8f8278deef1be1eed27c3c

SHA256
ac5e3fd5f1535481553e46306e673263fffcc7e0cd27157c55f0017a053977a8

SHA512
507c1d1f869bbd5c73fb42fc4035fbb86386c8a4c2d4f1d0eb2cd8a9d9fcedb2342a1a78a04967110a6514d6d5614ce42f4af11e6379a590192d49aa92df23a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d6b6ab699cac266507a9e2283b19c6

SHA1
e19263b7527b00affa3c3580cb4cc522292823f7

SHA256
02a1347466fdc6d672eed6f24c25e0a3ba54f9b748fc40e6aaabb654ee26e610

SHA512
3a7f8d2cefeb10246e6bafbdece8a7cc53fa96b8a80c796edfde49d24ed2b73dd782d49168ec1f5eaaa1d0d35b54270cdb826db8aab1d79c55fbdcb353e85a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68232f40fb682e371bb0e980c5407936

SHA1
47b464d615b5301842675f9d23459ea4b8885b85

SHA256
fe27c52dec02867c8888a9267e8518125869a88ef55111735452f02134f2c4c7

SHA512
06f0ea6c21f8e260fea9e97605d4565b475bb99d4c7a997c5d44d82c0342124be97e036afd1f2b6f65000116dd5ef6c1f596dd194409a1e0a1d86beb3b31908c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1d600ada17bca5eb53180df37c4e3fe

SHA1
36e35b3df08bbb5d1b4d865ba41e76c67c32571e

SHA256
ca86840bdf0324658e34380bf95c77117734c8b6a43445801d6aeda850e81f64

SHA512
be18d12d2e52f76eb0964b11ccde10d7840eb2acc24cea39b43512868378edccde68f0e5f0e8e26a1a5a1451839b7daee24f779fbaac9b2d2a25af808a0c3ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e461c6fe9f4a10913772b82f772c3c

SHA1
58cfa36ceaa374eec394e312cec1a5d12c8ca1a5

SHA256
dfdc9449d7431850776604e32312066cb47c3993ff336552ebaeb69ac882061d

SHA512
cc38919945805a40a99a711d32292fd77c6b5cbe277c640e4dec9f375c058eff9fa4e4b60891250d79f627ede8bbcb1eee629179bd06ebf7c3d07c8dfdb039fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6daf7cf91b9c0c38fbffa4b001e88b1

SHA1
c937a10d2a7c9bba9303fd1fb043f2846e509f4b

SHA256
16414fd9e073570b1abdb1572a17f9e0b23d3270e608132eba4b28daedbbfad8

SHA512
1701e56cc18cb0c533976f544c98a7363ca181d45c0001a434dd9e1e6bdc124521c2ee2bea2df72b394bb2274fcf8272279b1c5eca6557022bde2bf05cae1b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a80a885cda68a060def27709e83b064

SHA1
5746dcddd1bb2135ce439143f21cc82cee97b570

SHA256
d765871f8e9e73b2ab12d38777b4ed27ddc6e1cead68a1c4166cc6633ff7529b

SHA512
7f18edd34bdf3bf3f21515854b7de6468d390312d179f580a516afe776d0cac75ed2c78907f466a7c97c0100d57e5aeb3224d94f962817d1836d0e5a97fbd199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba11372711a3c964a01e3bfcab30452

SHA1
59cb715aae0d4ac39a0c7a2870e8f322fc49bd03

SHA256
3791a3252d82d09de99a02edcb7d147e988010edb409b9abb54a06801765865e

SHA512
e1169149f28ae0bd33eaef7e51ea058f7363dd0b7f872b5707b0d7f64f6fb1a333bcc08c41f86bfc19d562695f74001d92836bd069d6073e8681e9e10b467387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3afc2778394c8be54cb89b9f3075294

SHA1
377d576e2d1b74263d48439978a6f8444c7a5221

SHA256
17771ad625a9f53fbb053fa7c52c007e33597fc65f6bc9e2d72c43fb9b9cab37

SHA512
1e8fffa383bd38b5e49a3f1d9d81e837b7280b4e5e046936ab08547db658f79ec34e6d51beacb267cd861f08957506937df95bdea0a15878eadb7fe92d1d515d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a092bb09517f0fcf38289610df995f8

SHA1
37ce38812da6920ef06ff5ceaf473d0a10321379

SHA256
654a46ef616cf516cc6a544bdcd18487625fa7ab144e1be9105cd882f890ce44

SHA512
5a0ad598bed9b6f2cc19bca98414159cea9e80090d63e76d9f2f4c88fca70ffcabc23915f1cbf64408ffc8d7c8c5d79d77e6344d0bc3edd5dde246150f8490a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44a848f49e6be58f260340f00c8cada6

SHA1
a6614c86d5145c2c420026219028b49e91054b78

SHA256
6dac38b7f9d53a8921e66bb00bd7904e9c547ecb58ab6ce3bf34ca6897893ccf

SHA512
3324905d564a9fe454bdd2ed9a160ec5a9279bf2e388b9a14891ecf7e2e1f8d64593f72dd0de4248c5d592c344a0f0d818f2dbc923d11a963d3bf31ba86fb299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96992615a764f4c3b3ad38904c831fe0

SHA1
341b1400673dc0615ea58daff41c088ab2807823

SHA256
0002315eff69414d49a187a520001ac6af410e9fc31a760a38f42972747f6513

SHA512
78c95f90e2044be620f093c75f3405d2549fe8a31e8142caf581960cacddcfda03b094511112251c7207d0416c5db5c5d585052369bb0dd0b12c95eb15a1f2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a725ddc56a8e40979623d08a5229ed54

SHA1
79ba773b9c9ef7867a3afbf9ddb32a634dcf5401

SHA256
1507ed393ddc8cab90a15c6f9876f8200aeab37165585417e5820602c607b6e1

SHA512
41e409d4e1d31a50615b6536843ba8e0adcb35f29a96321952c661b75d04a8ef506c85b6234372bbdcc0fce939515f0b6215ed7161dd0073e3289d92355271d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58624c5aa048a146fb59e664f5b32cdd

SHA1
7463968670b2f2423e644cb06d06ee25eac7d198

SHA256
3cd4d12908454f5602379b1367e77c7fb48f60a1d54653a59febf24bf621bca1

SHA512
419528e2f54467b020be29ade430326b95012788c158a9444f98535ef24e23c7899578591206b13ea4e86f701313f84d972f37f5453a2ab2b9267e5275968b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82AA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar831B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit