063d4a5982d6df538a78089e7be4fce84da94ebe2eaad1317f3b89eb93240a99

Resubmissions

19/04/2024, 05:15

240419-fxljqaag5t 1

19/04/2024, 05:11

240419-fvb79shf95 6

Analysis

max time kernel
60s
max time network
64s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9XAiwCpS.html
Size

2KB
MD5

75feb61fc44e926a03e3bc2d571de570
SHA1

dbfd9d6dd8aca06134ed344c28a508bb530c0944
SHA256

063d4a5982d6df538a78089e7be4fce84da94ebe2eaad1317f3b89eb93240a99
SHA512

69ba3e1f703f08b15015a006b4eb502801c6cedec2b91976894d246fdd48f984589728979ef8b6f9d5a3dd57dcd93fba0fe148e0aa72badcda94f7d185952425

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7052021e1892da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b20000000002000000000010660000000100002000000065f41fdcf9f15a251ee85e80352f5c70d305aa7504147355b42317204056316a000000000e800000000200002000000011c8fc4afdb5928dcb69ac0b31653d6b6bbca69c8aa0137539ae7f27921be51a200000003da6c3752ad0748358ea152703b22940f75f8e42cfb675066f991e128d15dba14000000023bc80a68176ea8df40364c356df76736a35822494a5302b0a3c17879892fb26873978ddea8e0e6a8b05d07db4c4e6b74d88e8418c80d09ca75a6bdbda875363	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48BBBAB1-FE0B-11EE-B55D-7659DA376B3D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000b1bdd6efe6f57b969e5ba05b7c9048d387641057812522326a2f646a48b77ba7000000000e8000000002000020000000a0a6def21fee44b650b41ec4aa27cd93213db439e3a35adca536e8111ac4a27c90000000ab382ad986d6c58c8b9b1af9d0fbdffdd0a866b33e36d6571e182588d8cdc22430859ce63e0c6686eb7067c97b9b1738664e25fb2e0a4abc78c1c83ebd73d3de57f4edc1edd54418e23c5fcc9b62034de3404f84233d5d2d9a82a2725265359bad0baed0350bdf9c6af024a7bedc5bca24e6286e14abd29a6c22e55d44becfe19859f8609128df1736595f3ac3518fb6400000003a79f4701b52e61a3bbc5dc947c8f98619d0178eef35e44694ba43d1dbe39f95732d307625a4278f43f0703c759a604d9001d991a54243c77caa16930c4d8ccf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2200	1728	iexplore.exe	28
PID 1728 wrote to memory of 2200	1728	iexplore.exe	28
PID 1728 wrote to memory of 2200	1728	iexplore.exe	28
PID 1728 wrote to memory of 2200	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9XAiwCpS.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80abf5099a013a6b46d2e8b0b24c6efa

SHA1
aa7415c2494b50aaf3ab166e0e36e9bf1c652d70

SHA256
673c987eed5d7d867c045d4a2f862a81276b3652ed433dffe9c07add55601058

SHA512
d1c459ccd30d076eb566a4e40d321568d5568d6402dd8796ed96a7d98ec0381ad5edd717c4fa20b99f277e2ec0bb5c4a25f86de036312707448dff6d70902478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00aff84bff4b4537cfac3fa2dc0224fd

SHA1
214f4764db09a1e1e6e7671cdb53f88b99cae6ba

SHA256
ce03c46ae15f4d9967d6c101bac0b5aab62573d5fbc09f614807711bf33e23c3

SHA512
fe68179e23b4093c822a973efc6b0d91eeff5b2bce29905231dbafd108903b4aa8368c55055979f996da730e74919fe79e1750637ea823edc77704a3654f8020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee567872612559ec1e6fdbd3ab0199df

SHA1
bf32f1333fbde2a95bd030dc87e131e7cbac6c3e

SHA256
e0b3f2b41b287eaa0ccbc3d0d2f2a3e6683e5f48491368d3a049869d8e9bfdc3

SHA512
21709dde09dad072ba0b0c01ab172fa652b7bb1b0c0d71881e4df4b56fb9343133042eabceea579e4d1157beed422a9ae8f5249127b1e0ee761567bb100948c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65b9ffaf19f87bada31632449c0b8477

SHA1
efc782507546db270af5d3c57e6ceb44d226696f

SHA256
4e4584087400a2cf7b68c835ab9edbdca8e3d6454a30901f8665c49b6c83e0df

SHA512
60d4e39fe320773c690e8f5340b59048db7f4ee055b4d104f034ac66760d636a097547531f716ace4ef7f98863ee635d7a4de6c26b2ff48dabfdb9ff080d7592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2205124fb4991f806ed2f59df791b456

SHA1
bbe0e3fec2c37eb74e885b134c3ef7e4414ca87e

SHA256
ec95f76dd02a3aff6d4353bb05546e85d1d958a5ada6f7c07cbc6278b2a1245f

SHA512
41007a7f925a13a2c36fc5d047ad8d42ce698acd5e0069ac62766acfab1cb745947308b28c47bf2516fe5df01861a20103fffaa6ea4ab83521e0db47bb3f11dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e59552a2e0718eedbc9a63950404b2

SHA1
9f409af9b4eddbfb7923ae1274c2d5a2cbbceed6

SHA256
d3a02f12dc6f3c1110b4b121423f35b961910bf4e95a0e3ed214970a61ec350d

SHA512
9ba84721dfbc7c1c8b65d8e17fbe988291c29aebca037b41ca6f89fec00f3a5768c0c312497d7dccaa5518441f4d43949c97a73bf1995263824517be3758ba0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dffa1b35a554fd2dfbb1bf1072b7570

SHA1
1f605a75c987741c6f133eb4a829c796ee8dd653

SHA256
6255ae8dee187ed92dbf1bb6a7b0190a71e4e889711ba7391eaaa02c12c54eca

SHA512
ace873b9c97c4941aaeaaa6146f117e6086707d04d8cbfdfa63523fafc5ac83fcb87c735f57d809a1ee3b272026c55989fb1fffb4ce04dcd493ac364caa6b1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48ffd108f3a265b0a8a07f384b07cc8c

SHA1
44a8ca8b1051803881ef99faf638967e2269ee3d

SHA256
fd903a147da689e32a85c9f48697b70095c83d08255ced634c4d4c86fafe612f

SHA512
c103dad28b2fb196c91025b340383f4eaa2abcd1180a5702dd01024b3e7495f0b03e0578520f7c11f6a5962cb54ef7b6242cba3276d56e2f7aad45fc7f7cae78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a4bc664c4d4c7b77cd9cd221746241

SHA1
863510205488c19c5e748f6a4a3da7d5bf996c88

SHA256
f0483705fd117f4f3043c2fcebd2f4f0efc1ee18d334a239524a5214300a674a

SHA512
d3b4f4339646f90f723d92ac87e241d78aa7981802797c80b0df0670b5fd1eb29a3ced868cb541b680d468d0598cd7b0b968f5192a577b2d5105ef3f0b06f1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AC6.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C01.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C16.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF863E71E0BCB28F03.TMP

Filesize
16KB

MD5
35d19a017faf3e24a024df64eaa78e41

SHA1
7aa202f15530ba13d95cdf46a6ade9c6fd6811c5

SHA256
3e22d974f478367150221adb0f0b110b263a30879a93936394593d4988e6e665

SHA512
237c8815f9bb48d2531ab40a3ad426f0d6f87d1dc2fb2cb3279c9b01a4e8e87800340f2c44e02d4d6a95a36fc09c061fdd3825e63dd3bc99a38caa2535fd3e86

Download Submit