7f542af27f141be2d14412c913adb9e8bc9601e9647651eae3c373ec5f6ee813

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newpage/page2.html
Size

2KB
MD5

a498989bfed1c858f0c6082c94a28dbd
SHA1

f619017508b247b657e3a62a4799161284a16c4e
SHA256

87082adb6c9478f94bec74b4a2ce69b0018e9ca74f00db0496f7a89e75bf5a9b
SHA512

e5471d58451dc1f87c79fa667eb6124e206f00969cfa877de4aac9d0b0901844ea059dcc82414eee4dcd23bca6854b6dea5490e5d1d25d3ac433fc189961269a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001db9aef9b7264248af4a1b938e8553df00000000020000000000106600000001000020000000166cdd102592a5467872683d2ee7525902cf22b9de5df8439901391d883dfc59000000000e8000000002000020000000e50d6b56d93d8dd56c183a16dd2a9f20252b3d3dac3214c3ff60ae42ae88446f200000008662ee54dd205861375a8c7a6642f7b20cc27344dd9593f68946bb860d41052b40000000dc2601c74228d8aa7bb9360aa49f5fca13732f4d42822d5a7ee83f88c4ddbf2b76c90f9240970974eaf9f89d414b8cf9e4ab12e9b6718353bd90cb1d37ad4eba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b7e0a01094da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC5B5C01-0003-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419882054"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001db9aef9b7264248af4a1b938e8553df000000000200000000001066000000010000200000007ce1b5abacf5b587152c1c20a03bf83b978b366c86963b55774cb1fd16d208b5000000000e8000000002000020000000ca24b70945ec7bfcae3d228192da784b36efa8e9fc76f86f6ca0637667241caf90000000e6591cf518bcd3321b190401535ae26604c64a4857db8cf4f2f920fe9d9b3ec0800f787099539ee94b3ba1d75c8d9f9fcc06a5e1cf9a69d940c693fc1e42da9e3e8a1e95e3943d810ad9e6b79425c0fc350f3bef3c82a3af1d09b6866355d03fb3b188b93788f1fb6e0ac9c824038500ecae8bd9ed8415b449cbc6442955c899f5bc4a255efa2d7b0c713e1b8ba2114340000000e1517db0f9a6741f8435bdebf499973fe622fb2d20dca9578aaa68c04574b75169ccf4f2744a3e9312c888f6346d8ba79070f40dd7aa81b6d7a558a82e413c31	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2240 iexplore.exe
2240 iexplore.exe
2376 IEXPLORE.EXE
2376 IEXPLORE.EXE
2376 IEXPLORE.EXE
2376 IEXPLORE.EXE

pid	process
2240	iexplore.exe

pid	process
2240	iexplore.exe
2240	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 2376	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2376	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2376	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2376	2240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\newpage\page2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
8791d2a2a76bba98ec6933b375c0849d

SHA1
8ca3091b6dcd67a10745c26dffdcaec137562d24

SHA256
3d28ed3eaa417c3776e1cc686570e44f2f57992b3939c4904b3f662dd96e86d4

SHA512
4bab5477aa4c4b9e5a7bd03a63a2104ac99caad936f40e935bca135e823aaf5b20a1e8a4f7f0f2cade2c9fc1461f6e4b98cc441240927ceb44cdb881d8796b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2f8a886a34469cb3aee49ae3bc381799

SHA1
cc3bb8cb4f99ecbb5b036f88e35faead7d0fbd17

SHA256
26dc67c9eaf3db4afddee07dfb47e98e7228214d99e1ffb71722f18def25d87e

SHA512
5e3b8b0732fa23d41baa87acb3b4c30efe2ffd0d5fb3ae3d87963b873fa96d9f798ab671ce395266e1dfcbf9856d6c766654327a8941fe7a320d520e8e37127a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8970112b34d98f39bb8fbbaba4308390

SHA1
3f60a41003de047a9baff695a049835e9f64511f

SHA256
5ff998c134fc712b5ede2070bf58484cf988b3f9848c0e6ec53d3c219c0fbfd8

SHA512
93caea24d83b5369ef2cdbf4cbbb85ca848e454ddda9dcc968f66badf5c5f968bce39dfbce86e1bb010da00e3a78cd6ffb74580f7a44e9a008b2ab27f40f2c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5a466ea20fe92750b6b553d08db382fc

SHA1
3060895d28555394397f90121277d3f24e8602a6

SHA256
c37660c924fe5a369f8c51139facc42ea69649bb63baf5dfb1f2747864fff743

SHA512
43fdb05d7578381d551216e70b48be63d8563785b4d8e5a88d89b6169ae1b62405f68055f61858600241c6868530acbac589ca9a80220137f713752a7238f0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c527c69f632de36161d1454a89f4badb

SHA1
1aecb60c4b3593cbf000b99d9affe1e12cd84abf

SHA256
1dbb89e2a9b0e4fd22a2facd11e4280b939095982121612021b610b3131e48c7

SHA512
ca750f32d6ba6f936a9d1e60c12443d02ba49672e0323c2b8cc8db5167397258986693ee1cc60cb5c39caff73255320d54d5a66194de2d608f839518719db794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bb8cd4f609853a9bba1e8fe3b3882b83

SHA1
03f97e4058bc8d520b2ba263d9217c1aa32eaea4

SHA256
bb4767d402ad9240c325c2a380c94d2874d55950c513d3822c69823a53db2722

SHA512
6c0bcd4575d483e275559373dfd1ba342114e826f8068840700ccca58b5e8f09176385c4017099b460f4750fa177a14d40b09837508c5a3842e3fe5c0928be19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
35f910a7371073ebf36b92cfa8a1ff16

SHA1
4065d57a4ca4a542307db8255e32f7548b33b91c

SHA256
48e052e111ec135e571486a36609b7905b58640bf2a86c1d140b64bc94d60d42

SHA512
b596c4b35fd0e313bc91524f93f91acc723b0870874579bf1d82cf58de8b66dbac274f043c272f3c78e71e763a0c117f2ab65a08450fd3240aebdfa570d85362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
28f3aeebc58657fceed6804399cd2eca

SHA1
fd75f0c3cf2c1195ff38235db447701f9f5f08da

SHA256
8eb94758c05bf839dbed8017f60d2f228921a23d52e095a83bab45e9e0ad3eff

SHA512
8ebd48df03af7f94fa72946d3ad9742651bf6c88592cabe053f52e51da054fab30242756049a05ff1d5c80fc34dfad8442e052124594056e637f4b28efbb2550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8514da55490d4d3aeda0ca309fac6c8d

SHA1
245d0482ba4421583030f11327899b7144b69b11

SHA256
82ffa5ef5f91c9a1242919445449c9139342114c16e8d6ab28f1e746bc38043f

SHA512
cd1bdb705674ccaa4d01557870f5ee675707963d01eb689db0f168647677d0bce64b6569175942c691007d232d4b482d9179e13ab2833e5fb09b2797f728c389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
1ca39f9da00b2b83b623d0b724783601

SHA1
d2368e36993fae302174460a6bc72b7109c41a26

SHA256
88aff4220e32057980aba78a4c1b73a23e5fbfdad1734bd448d88d99090ecf78

SHA512
1988b82dea71955aca01a2538869f82de7f5b8f883800b25ef10a25d76ed49bb6a8c4b3817fc141b50e2d2251f2ecdcb3de13516fd60770c75a1a96055435a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar290A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit