c290c23603f87fbe231893280e241d256314577cd475f2c5667a6f49b9ec61b4

Analysis

max time kernel
32s
max time network
32s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

solaris.html
Size

189KB
MD5

5f111671956a9103ec0dd79cacb900b1
SHA1

66cae627732e3b9ca5629c6602cbb0008d2f060a
SHA256

c290c23603f87fbe231893280e241d256314577cd475f2c5667a6f49b9ec61b4
SHA512

0e4a94c5f3515c19f8e3b190e9ae73bf935c2828a3a119640f72d051acb5457f49fba024f175368f21b9c365765068b27363407de5ae366601250f73d6f65669
SSDEEP

1536:8KeWraVN5d8LbnVJoqYVrK4DsYCgmyyp7MPuAPV5SPz8P4QPfrPa8P8R4DJFPWTh:8KeunLM+NVllTrHy5dLKR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7970C431-04E5-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07ce34ef298da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a1c7a0e5614614894a84242c34fa393cdbe480664ee39ad2e98059676623a7cb000000000e80000000020000200000009603b5fbbb96af3bd57742dc524af4669411f1ee3dcc50e6fa1f5b39efc756cf90000000f5bb352e9633fc9fd3c6d586c8aa3d15ffdb29f0321fc3f30781cf8e4c919654da8f62d996befd6f424b7c8a1da0bb3b71486fcb31b8bc4f345615d603d41a39c86cec236340cb40ee2c8604f2f3b5f3d70412f86c4cf3bd0cf8d439e50e228b069626c0689ef10891376685930ef9f1bf6faeefb9c710dc071b59eecebe72cbd0ab420e84e83dd943ade4b8130b86434000000092aae2fbe6e4409b312742d44cef4b33a8ba59a290ef142d3e3b581042641d61c3bfe0c6595fa01365d5b02bd3e30933fb23cc4e37c5d27774fbb8f87bb5cf06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008fe19ff6dee4a6195c6db7dc301b3ae9eb9d3594657711dca342f3226a903a8c000000000e80000000020000200000003ca6a2f42befca11c5da319131acdc814b24f5fb06301bdd65badf3de452b32f2000000029ad97d36e627bbf93b80cf360380d30663bdffac45debbf7810ca068a2e361d40000000adbd0aff9833f8ceaff87da3c74c6745ca12b5977a5da3a7a55485d6572376131bca07798e5c42183a6c941ab6639259fe70f9a3ea673e69d10d48d429fbad62	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2112 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2112 iexplore.exe
2112 iexplore.exe
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE
2204 IEXPLORE.EXE

pid	process
2112	iexplore.exe

pid	process
2112	iexplore.exe
2112	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2112 wrote to memory of 2204	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2204	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2204	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2204	2112	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\solaris.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0599971a8b9dad549bc22bfa65bd667c

SHA1
b6f0e2914c1d932de84f0c56ba5134463ea9798c

SHA256
cb370740f068c2530a744927bf166ffc767c3a50d6652d5abd7807455e742e42

SHA512
4f2daa5278c82b4c985875723ea8d63200f632adb681f15c2afe7ff65f50d9a5ae3dc411232f35a793a74b40b3bed9716d7f04c037823c96c98a5171dbee5420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4570b0b51a57b0e381f07c89c8a9cfb8

SHA1
b3fd7531497afa83a5897e148a6f25164711db63

SHA256
6514026277c1d0e8b87386ed99a1249917510325e926c814ec0b7ddb412c8e86

SHA512
415f86acf3a06e3e963d03e3676b90be91a81c72b5f41f9a87f24ca50a9a882712303c5bb631d4c1d539111000b56807b61eb5ba3b0d50cbd4bf8ffed1475407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6020ce7a211f309bb4e206945665d86f

SHA1
884dccbc01d4706dc83d44a2976ad92e74fc4b95

SHA256
8acf31587987cecffbfb9dc182719afad4e6c5092a95cf51f82d9324dca2aeec

SHA512
35dc1c325350e92e0b2c5bccb467331a8cedd9d494d3c7c0afd241c6732bf775b598a77ff9a625dad13a220b38c37c5fa9bb4851cfea4a3b5094eb44c0b0276f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2c9621c8d2128606939b39cfe97433cc

SHA1
d40edaded165ffa0366ca3af70125b50ddd1e935

SHA256
868aa82d5b1d0df13a224ba71bc6e60a08c795539c0a166f5b90a288312ace55

SHA512
ac86b18e5d3d098e59bd20f31922558bf3b75cb0300724141f88c040c0763f06347e271ef859dc668127d826176973b500edbfc8304cdd64ecd9872b855cc907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a00104a891d196ebef24d39748ed7aa2

SHA1
c91ec8000affe2ac84ddd0c87a3d9662f8ef5efe

SHA256
59e02b809aa56dd096f8267b39ffa8d932c2a8693f68be1de47d1ea6c4659b5b

SHA512
4110c0eb1a083421e6aad8338fd150e209751dd42804172db96505b3edabb9c4f3401c1bccb68f6d719b07ef3c3575c4c54e35afd52f2b9049a6ae60a8942b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bc4960a009adc13f1122ed8a5093756b

SHA1
16051c653f93fa31c501289d443d7b9d82ce4fab

SHA256
d8856303dca204af659f12224d71c7d7503826fe501957c9851d1dc8527e089c

SHA512
6eab1ec0f7dcf4f7a22eeeecba1cffd9066c29e2e3b9b31997d3f51aa9fc641fbc3249a8df79d6b391694e33a52a45c3379ad9eddad04509ab5f9e407d9eadad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8a798f8192dad06b7c001c9a6d0d767c

SHA1
72becfcd388a0b1d500087d87c33ecab9ccde64e

SHA256
04c8be22619e09406f58a2f63a3a86dfcec3012315ee9204af784ad7c1b0e6ed

SHA512
d1e8db36acc28d31a67a1ec757559f63d7441d32509afbe1a6683df0736f58971c3c1dd99c7e662ec7b8ef8e67b7d389456aa9b9f4678ac46a1b24d5207a02d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9abe208cb8008ba9634fead927696bb2

SHA1
e8c10a8d3bb2e4a394c6bc062a1a4881f377d5e9

SHA256
50ca5eb5051ed8c84bc836ec91ce86e81b6709a07eae96ede8964c6ad6fd08de

SHA512
6338f1094dbe5dec9edd1b45b01c14416756231e4a357e33872b071e67f042c0b06e31b7e32df60fd0c9e87dc30122927fa68fc6463851d88379e6666e42424d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5bfbcc7ae8e25ef51e17b37b16608b7c

SHA1
d77b7c7215defbeba7f88616fbf31cd8fcfada47

SHA256
69dca522123b0c67a55bae2825abc673ac3b4cd16889e2073e574cc349c979f9

SHA512
ef56d339ba6225f61bd9fe2270a149fffb142ecd494edd945c710113a66082b3b0bde9ba7996fc47b7595d33ecacde42c8084380c404121c2432009de0a02e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
84ce933cb32bd09ceea5a25c6a17bccb

SHA1
6b53cd151e0c338acc280798f9301658128c2deb

SHA256
ad72e3ea1b0bfde1f6cd0b92ebbd4c7cc0347d23e4d5a4a0ec6d1973b4e18535

SHA512
9fe4466dc3bbf0fc19d9278870615816438f18f1702c2742aa9f9289fa273482245a22cf35ed5a1735f80b1a1cdb5eb60466e52fb6f85aa6113b97cce3d768ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1258.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1337.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1483.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit