109f329ee44bff0a63b5cd2217e96e5d20ab9865240858eceda08d27adea6f75

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

authorize.html
Size

9KB
MD5

05b05c33834ffa58b67e676a0a0c28de
SHA1

2f78e6300158f54b0aa8bfad2c4c4690447859e9
SHA256

109f329ee44bff0a63b5cd2217e96e5d20ab9865240858eceda08d27adea6f75
SHA512

8e208ead5911a64f213f0a1b856843d08b9b2e2b05fffdc867d0c5eccc4a0436c7c25cd3b4395c2e5d2d5b10168f76772b91d97e65cfa3157f399f8d385a5f32
SSDEEP

96:mTQBVaOfRr8L1h4Re5oacbrwumiXF6HWuHTwq3CKnhR42q7lXFI9jp0yTMQr7+St:mMBJRr8hBe9FsEqFGFM10yThrySCw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60cfa261a577da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CD5A591-E398-11EE-ACCC-D20227E6D795} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416757366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000073e0004409c6508120bc03b8fc31a196489e699ebbe39eedb58353967c061df1000000000e8000000002000020000000e4e8e9ba4f91684550fe0df592af0cd9ebc01352c5eaddf8558c3d120fd030cd90000000f011a73e3d717098d47bfd77926b4b3071d2884ecddb65b9cd8e22a6d36be6c1b701013786872a1f7abe1e5b07dc8b873349bc165aeb0c88718ebe6d1afc106818cb47041a4b7422c58c39c0f5af194abe01cdd13dbf21ec1d79deb5734616124dfce05aabfa7571f8d7efcec58e745e979b703fbdb5178061efd3fe277e2d3e5fac0736cafc06a5676773d43a1448d8400000001daf982d304ce1f03c35b5fcb4105c9a8515cf606489468f4715b5e95087a4375958fb430a6a1fcac30ef1aa325b5c792cba201d87a11de8485d40b65205c817	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f8e6d2eee31d1009c70ae428dd942b12ce66d6da559e5cda391bb20fbbaad6ca000000000e8000000002000020000000bd6156dfa3c3747f552d0c7f1e615589cdb20eb65d39e0e9026ee65b19f3eba3200000007859b0deae2ae56bd6db7b896fa71b864d0df025321b4a163ece97c97126a7d6400000001364d998a0ebb0e6a41d3ae548a82d12c43f63b5861e722310c6f92e01abe22c025fcafdb6fd0a57ddb45f3b8a783a90b98dad73539602bf6e48632c513e89c4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1784	iexplore.exe
1784	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2056	1784	iexplore.exe	28
PID 1784 wrote to memory of 2056	1784	iexplore.exe	28
PID 1784 wrote to memory of 2056	1784	iexplore.exe	28
PID 1784 wrote to memory of 2056	1784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\authorize.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c34bb22ed5f5b00e4b5670418bcf54

SHA1
ea1f30f53bc392882de0344e37e2bf905ac110e9

SHA256
f55b3cc72a17c1633641c154e79b3565e6e1d58fd6a23752d8033cba851046e9

SHA512
806b2426eac2ad8e98412eec765574a60a2f62db1aa312b21d61dba37c5bdbdf0d7a728dacec22d9e67003ece99419a268ba287ab64204d08f83cf30d03957b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f7a0bb6ffd085c1a837e29c3baf3191

SHA1
672fb5523d251f2b80a7f37a336923084fa6ba07

SHA256
d3875986e85d794ee8ae7af4d89c121b9ee6b8ab2f0a1895911f219892cb5c2a

SHA512
affa5e9b1861d1ee7f1e20afddec3cd7237c98e52d560c75735d1cfe95f83fe05e3444d33d6ad518078011564d10abfd3d8047de5bed9c382cdae6159adcdd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd732d10389736fcd864c72d5582fb98

SHA1
17714a92f972609251724d5e8ff9a69a6a67be24

SHA256
f2febc13d52479a7fa40d8d041cbc4a4eb9c48ab151fa0496fad5dd488b7e03a

SHA512
e69a3b2bd9d1e60d3b115a8af15c71d30edad90c049c20c55f01595640c0e7bd8e26e4209b432c2bef8f076ba1cbfbd0a2881384e21538e98965495529a81c89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20095c7d5a77d4c45b1c8d8b0ee63ca8

SHA1
c83546b25218aef34b8d5aaa3018dd3f9f36b1df

SHA256
5333d9827b1b5aca2cfa0636fd825cdb860f8d09be7a7a683e604a911234baad

SHA512
63d97bc4546cbbeb17281613f159bc30670d1f4a113964022b2fb9430f7c67bc99776ebc596d212112d3492df38dff295e35432360c4f0c97941d68c7b21c172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bb68f6addd2d3469289247e19c26f64

SHA1
f65790b5be411142cd1bebca2c17f57a4cc26e67

SHA256
0082b8ff08c716c9222ba66dfb98063dd0507f0c2447653cf55197b2651aa906

SHA512
7e90ef34be2896172e9e25d77f1ca0097bc7a75bd6fcd752dade59d3e4b9dd77b4eb51a84821700d1921a545f0cc331dc56d5f8b774cffd861958d2146aa3086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc09ed9023a63af7fdb8da45a894c111

SHA1
754baf983a9c77c32b58b827a8df7e4eb6f5c150

SHA256
27cd52167f349d8ee1f57dbaf70ac0afb53e542985516007be1f18c9804c0738

SHA512
fb5c5dbd28de6b2ba2d6ccf79cf260749436caee4fb9bbaca561993b4f63170558706cc7b92bdeab9c817d42fe2a6041f0d3f883c9e716a691952715be25638e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0eaf502036c8988217d7d469ae8c25

SHA1
e025f9f157dbae000a4682d312f92aadb627372e

SHA256
96e0e5a90575fd1f6829408b6079916f7794608b4e6d7dce66d9eef949811d63

SHA512
48c94d5e8528a6c278732281a74cfdccd867f5da35600dd23569b61effd024c977a5550ab27b7ae636aae622ece11bab8c86ab584bd8af4f590b1917731f0246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a412680ad76ae75bb24c7e27dee077

SHA1
2c8356688f736845b333ea3441c7de5a17ec056f

SHA256
db0ae02dd24d1b1b77f1d668972621092f2a75014a3beb8285b1fa1b3ee75237

SHA512
c282a1a3203a06d9be9cabe36c74b203f8b0df6589a0a63ee287cc4e49854d4b809042a7c277768230a3f94b2a0bc31ae6c030ed28dc27cadb523201ba919757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C98.tmp

Filesize
2KB

MD5
208f235ea5503c48ecc0e737c2aa7102

SHA1
43a20d046c18fff57d10e08648077a1886b37cc5

SHA256
3ba458c0cae4ab840aae8ce84ca6d1f692317e986128b1621590d6703204bb8f

SHA512
a8e3925a8d0be87653e319bda5a33468ef4d348a07b6ece94ff0b6834bc242a5d1dc2354272dd787579b9d596801d7adc022c6e077bae7ab4e003725dbbaf415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DE5.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E07.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit