8d8e61a7d0542b8ec257a1de4ee33db026d1e28a9ab28d9133c6592befe26d32

Analysis

max time kernel
7s
max time network
8s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

17KB
MD5

55369f0ee551391c7f2b54cb9f2493c8
SHA1

222efee81b7cacbcc7cb4c4018927d76b1797863
SHA256

8d8e61a7d0542b8ec257a1de4ee33db026d1e28a9ab28d9133c6592befe26d32
SHA512

885f25d59e8d9dff64e15350a5225ae41df5568f39d20595d40e7efc9e33cea72da9f24b117cc4eb0709f02063723828e0d3211a94a814020512144f31fda330
SSDEEP

384:5Ssl9qYoJkN0dMQ6VNG7BoWw5F9SQOanJVDggk:BoJkmMZVNG7I5IWVDggk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68F0A821-D3BA-11EE-BE0C-E2E647A5CFB6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3048	2932	iexplore.exe	28
PID 2932 wrote to memory of 3048	2932	iexplore.exe	28
PID 2932 wrote to memory of 3048	2932	iexplore.exe	28
PID 2932 wrote to memory of 3048	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138b12704a632a6dd80b8f4ccb951d2c

SHA1
bf18d311a8292ce83034c0372a0f5a017fa8fc89

SHA256
595c7ae748f71bb7790bdc395923f8a15037eb0f9b4bae983b3adf29e0423fe8

SHA512
3c88a272f529efe18e61c25617750109f39e4b22d07933b041e52981e221345735ba43c1fa803f3a1751f94ece3e93274131548ceca8d87fbe1d396f58a3ed4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa554a4c7e3f1cd520a3edebc95637e

SHA1
9d2cf71767ff723dd7ccdd4535812f155ca2de3c

SHA256
b4c358c1415ee8b60b3c53e69070db8ead7f243bcbbe469adb0aa5ffc534f1b7

SHA512
641f0a996aba043e0458b9f4038a5bd74acca8edb0d73919265969fdae0aa8a96b815b85933632bf9ebc01eccf4878725bb87d92685ea31f69005befa9632497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80df6e1819e3667062dd37256ffd162d

SHA1
7750286dbb20e124cce48b0acd7154279b0790f8

SHA256
be159ada8804fcd539b95b55ebdd80854b494bda31235aa9d0952b3a028e3773

SHA512
cfc8aa87079366b1597784c4cf6e509e8f16daefff6a271d39962886b4ab78cab1cc7bf9e8b5e58516f5799dc4d755bd99195c13a384bef1b18c585b8f1df97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2539b3b65f0c1368ea8d9622fb0b171d

SHA1
53bfe6f1d82168d278e7b21df81ef6008378616b

SHA256
ca6d3ccf977007a70001bd6c8d78c05fe23c2d16c8585b1a9e5ec2aff24c3c53

SHA512
3b985b415261295c6ed848472d30ac60ab80238e1c9cddcda756864e956157f21d0fa24634cde5891b414cf1d0db33f1de84042163b92c9420765341703d93aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e742f05070df8bbd8ba682629a6cee7c

SHA1
2241ef1261319a7701ea8e46c62b8738840c51eb

SHA256
209d0a0648a98787eee4cb56cb05a4a31604409d6ef6cbc7422071bdfe87d050

SHA512
90b1f866ab6838ad7208020349d626191d0875166d0a9b045d1e878e06a07fcee1ef074ba2163cc18362254c2255004711505358ab2c3b78979d7b7c1fe266be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90533a310635c7a79fdd384fb8c3662b

SHA1
13459c94eb4afd165fee5040724b4d29c0110fea

SHA256
b45d66d47086cf92c22606cd7dffdafdebc68ff6fc9f30c329d242b5b6f2d50d

SHA512
2871135f3984365b785e31b9b732bd4f98ea1a08053dacb4a489471f39403bb4e272e672a83010909a6b1b45aadb7d79a55fa7ecd26cb59b95d380300f7c2347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faaf072fa277873602a9c36160e59737

SHA1
499b58a48dab15eff5d9295b13c68c76ea94a1a4

SHA256
696bc1092f8bcc66ef128bf739619a1167ca5f274bc3e090951998c2f6437b14

SHA512
296ddd09af0826355d3b2b5792e53589a725f4098940a9bde24f51316fa8f5f1911f08a274b6398b0695a7775b1727c42c46f2c04c73839a98999f225716f757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63574b9a3a39588c702fccc3515bb4b6

SHA1
534d25ceb846511c26fbc6024b4bd7aeeda0d4ab

SHA256
ef10897c26c3c9f903c9fbbcd4cd077a2ba2668158a5007abfa749896aeb96fc

SHA512
547461a97bea7926e02017355162685acc27f69ed483ec86df89fa2762fc5af13901ff098cf7a2cba431f38a6115a901fb581fc4e531aa224c54b04d762d8c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar949.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit