8df846fd19b2fca0eabd0bec38d985ebad929168200b59a7d19276db11d64c92

Analysis

max time kernel
65s
max time network
63s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dmca.html
Size

82KB
MD5

78828c407acacea129decfdaa12ee728
SHA1

ae291a970910e5a0633e46ff75ca919ae210beff
SHA256

8df846fd19b2fca0eabd0bec38d985ebad929168200b59a7d19276db11d64c92
SHA512

24c64642f4290377b62918309fa46eb42af3fdc6291a0ef7a18a4de33ccf351e6eb9d96f009d689fd9f3ac319ade9c7f06af32bb9d306698a24e13b5bbe01396
SSDEEP

768:PRO21r218qx6I+fwINGsN0H0z3Fz9+FAn82/C/20C/2Z+a:r1C18qQNxN0o3Fz9+Fd2/C/20C/2Z+a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e85fd96377da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00FBC541-E357-11EE-AB14-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000006dc912d12bb194945806f6522b90f179cc86651720effd50ec40c29f0c7562b000000000e80000000020000200000006513e52464779bd87b88f9285f3e2cb03f597754d4ef097c6d77534400a024329000000095c8a62336df89920d267b4ae405205e47dc4758ecfb97c2168ad33727a101584262e5897a4d307b0579da767179a5b0aa1ddbad683831cffbf831bfcfc482e02ee92764ff21e5dc1672c7aa66169472a345800329245bc0ace24f9026c95667da97daa045ec142f255f7f48901a515bc2544a15a4be8fc063b0e4501ff82c79dca362f2407cb3260babcbca887237a240000000a634912e8fa87615bb1a4c891998f965e8012ba0f541f672126d3a4490726d0c33dd1a73373d1e7b35d6a7c513e624e0098ffd1c8a424a81aa9f0db2704cabb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003329c8c3a7964de01986afe49145f46379012410358e929e154d94591c1410fa000000000e80000000020000200000006ccc600139e93496189d85ba89453f8e1856546a2dc595ff2dbd902100c05ca520000000d39bf6a76d05a9e4a5e4750313d6580ec7b555fc5094282890f7151b308944dc400000000071d47c9ef582edbad1291739c9e687427a44b79267eca025347ab06c389dee04ab7cf3ff56b56745dcf201923f0455de87df075b1e60bcec3f9b3f0768a633	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dmca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a44a92115645589cd0c7ceef53437d34

SHA1
b73c544a94257f2ae281e7a75394215efed3d6a6

SHA256
fcdcff88c71ad253d5d34932ba3332a89d0bc5c132cb4c308a1e164fc320cf9e

SHA512
1427694f7a058042ad6a777e97ffac7c0bc58b21d86d6b1b946e123db78e73c77d286fabd311db19439e8f3f7f0f2795faf2756324127238ceb97929af829c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1245a1f72d8c31118371d01e9a3a0e87

SHA1
1338666c63c73a56effc32e8464037f92c6d9cf3

SHA256
489b2db7be8e1cc0c1d05c5087ef8a8fe7fce637d21660a28f9d7d691fa8d284

SHA512
bba9b5119639d9bed673e1db7fd80d4858a8e6ae74f3a1ae8badcbf4242043898b9a5d760ec3c116c27d1e7bd123cf71ccd5c53fa77858e2d3fea739eb134970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd073fee03d48aefa2c12d57160bcb60

SHA1
8ede45a61f830a619880fbd314c2300073da4fc4

SHA256
c1899371faa49b9fd1f17c6b07726ee11ca5959935891f1c5530253919b7f683

SHA512
520697b1946a3df6c3fd708fdb4121e287023abf8efed1e5166b666a2fc311b591eaa2f0bc3bd527cd815af2f8f6b327e275309ec0cb33c30bd896edd2c63616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
873437e5666d708e5a3995ccaeda7660

SHA1
4f0eff48fb398592ea0b524d023f483fa2cfedb7

SHA256
7724ab9ccf74901b93b57ba6dacd2f6ae25295380c3c0d21f6a822635a2cf3f6

SHA512
1f63dcf581b8c876da930ac59b4e0ae53924f5176de7d51bb689ffbc464d546bc5050f6795ed06b75db1391208ea738ce14e525afec7329dc8ebedb505cde366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf73f134c589a335ca8cccefcd178a7

SHA1
fec7f459a2a700309fc4c07a45085c39a9d5aa56

SHA256
544f7dd9146bfd078e6bb8a4a822473b92f7ba08817c944fa289efd1eae7352f

SHA512
6dd4172fe4c38460c6e6258e80d871cabe80da4d81fc92ae5cdb46eac255a3d639d02b40ec5bf22a9ea3b2e83d80bfeb5e856108271545ca7b2ad71f5b27bb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1804aac99f2b9b7e7b297a0714b7cd9

SHA1
f68b3816b87ea8ca5fb766e6612e917c0c317779

SHA256
c46e4da9adb428e1f776852f50bdfe5fbba05d11fc418720955a52b4e4c3ac77

SHA512
81bea6d657d4a2bfd1f6ca56761f6a4f361a55c7e7d23618d7aada641763a62be561ecd7ad26ba6f16052cfd491fa94b00ef2130ecef1084373ced96886beb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aba0edc19d99e425e150e22c6c4f75d

SHA1
14fafdcd0799d435d50f13e0714f0acd696b2a36

SHA256
c5c398007111b2ab0c142607ca03fee4d875dd31510c2e324d5e9647dd654bf2

SHA512
685499bba1d5a79afe05a55c946f77d5db71a8a30d2b0ec38ef8273f310f5072409314fedb44969d41b932f5bf7d8f856e819044185839f1e1d93ea3b9a3c70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4510.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45A2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit