eada13b3af850d1f2dfd4921fae78c3b5ad015c1280e78a51eea400c5a8653c5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

terms.html
Size

113KB
MD5

810ac39becbec81615abea096afb1c70
SHA1

a3e312f101b595c57dc010a2bb490ebe64fe9c34
SHA256

eada13b3af850d1f2dfd4921fae78c3b5ad015c1280e78a51eea400c5a8653c5
SHA512

ceaf1c9c260da58b2b0917f6c2c78f01bc7ae1941646658c4f7f82d7459aac612baa0028ae57b2bf09d1f90d671bc04e7f2f97f33782980e19d268430d89cbd1
SSDEEP

1536:LpOBlp4J5kuhM9MuBMNsGwRBnYmyTK8WFNPflFxiNjaJcq:cKhmOx2fHiMX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000018d58555c91b09e256ebfd489b63457362316233b04ccd89619a18b165d4217000000000e8000000002000020000000c3a1086657d27ba4c3400d763162c06751cdff1db258a570c28c40da127b404f200000001e37e09ab481e6c760faafd8ffd322de13dd139889bd88fdd06700a98e5e0f3740000000424f6ac7f380a0b5148f9d7ace204f559634e5568802bc787a2dc9ab1c17622c70bbe3a3d299d6249a77e1fbccfeac4c4c0186081e41e83d5050cd4c7072d1e7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000081e5a314e6bc0acac054d6a8625918b1768694fff3ca52d35426e63e6b2ed42c000000000e8000000002000020000000c1e5439cccc335ff6cc4f723e7fb49f2ef6851b5625e3a95eff9412ce51be63890000000d34c511535b92de8692142408c70c911ed60d685d869f6605259e20164d4dd4b1ea25f1c7e1bba7f8d4e66618625cf4f22e4926cff1e4d580ec16cf97e665b9cd6de942a22053a0e2a8d746fe2979f25fa4d94d39909f082880dfb0d87f97fc24b26d0a0fdbb747c6357eed42c03df408c7ec0e2abc159ce75e19dd6a86f90b19be6c37d3aa16e5e9ed31a4bd5abf4a5400000007ea142831f837b304fa2cda0649231649520c6c833cdee5b15b944457d236d5160c09b6b848b25e66290920d3317aef49623f44b12b5925b421c80f46dd5d60d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303319bbbeaada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFE43C51-16B1-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\terms.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
6f32c7254acd5e197a73dcfa6efb9737

SHA1
cb6b1018061bdd808bf3c2d5d7fc2b88ecfa61ac

SHA256
a9fe042a6841ed1bc9cfd74fa7f6ec691e58e0ebea87179f21df59e3dea96968

SHA512
d966aacdd47bf020cac66e60ee86233a2786f5fa0cadcf8512fee2543cb79d79a9c25880c560f1636d0c1833fa03e826a41040f360b05951a11ca1bd71680738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1a46fbf5db0ecbb40d891a7b9b5e033

SHA1
93501852d5d8b5c2e98c4a6feda495fdb0a962a9

SHA256
cbd618dee4643cda5f070dc26c1ac36c37c4e08400c20140b4f7321a83f8e439

SHA512
7899116fe0519edb8900122e029897bafb99db31a58aa505c164cc5fd6cc8326fe3fc6c753ee91f31401cdbab0ad0d27f5418b228af08cada77d9633135b3e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ed45aac8de3122f045f9a7302d5d42

SHA1
4a4d7df2d8a0ddb44474fccad216916cab829a97

SHA256
d0fb4811e57094a24074580a911698bd2f70db1aaf5d904e59d89b85aef5e6bd

SHA512
ff13e48db27bf808aa8523ee8747ce935839d0cfc04446591b6daabca07284eff312bb935007c982ba484caa6d18b99caa4de4544ec1289f1693324edfa1d945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9531d6f7ed0c5075b0a24fc8a02c9b01

SHA1
5909d61bc9f6020a41c36ccd82cbf5485e68265f

SHA256
8b469380bf0b4583f2bee9b7f24221a0b01df7ce94038c7cffd3d55e597d9af5

SHA512
c9ae7f8431fe17ace3a249e2a864eca2602a275f342d2f8ff3ddb81a4f7322f3df0abf41432a699cdec37a11a5f2264973108fa5e5a358479816e28cdb09ceec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fa12d8769a95164c5225d0c3f88b41e

SHA1
0707cff1baf16b3fe5354b734180274725c4811c

SHA256
e89bdd67cb573396d3eec149539aaba0c558f97a6123e5b447123a51f7375165

SHA512
62d284b197c97862f545d5dd2b2bc5f01849070adc0264e539bcd54f8f54f19a185931e54378332478f50907d6dbe6b4e3a09fdc109da432b444971dd8f6a8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e9db90fb348990ca7c18dce9e71841e

SHA1
2c1ac2c97e965467b5351b379650b6093ff2cba3

SHA256
0981e62bbba0e1d6a3b7c7f4b9a988a54432b6f30cc2ce2bdce743a94a5ea1ba

SHA512
bccf2cbec27e67edaa3222a8aaee80ae028d6bda6cae57ffa7568cf383dc09a1b947afbc14abb5e7444e1584cb9ef10399360cb3ee8f42baada2e5c99a919ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa898e91838bd3207615b58489be3ef7

SHA1
cec696577bb8c3714b5d70f926493607d9af3114

SHA256
d5b687f321811a6b1d8b92a74c5b331234278614c39731681dd0c9a4ef5e72d6

SHA512
4efd2f853c6be72be1900c519106276b5dabbfa4d4dfc65f9c7d17b6b8470541ec6e759db847e8b17e3965fba319c729826fef93038dc186431fbcc3997f8b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e36ed77d2e1b3b7547d24d40d95eee3

SHA1
978d3e9d0dcf5ea9fed6379fdf58e5c3f820588b

SHA256
f1d3d86bb3c2cb7e466e008cf65e18e369cafa857ddc2206f94164d0aee03e99

SHA512
0bab5a1db00c4e1bdba03ebdeff5c37ef5579157333d5d9173c1717ec423062ba938b9509be824f35ec4b67ee9c35e954def89a55480229162fcaaf927c51353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda843597295c10944cc8d62262e8761

SHA1
0b1535c6f9b3bef5632603ce66134edcde326165

SHA256
82beec0b9b14308d87de66a570c9bd43078cd42863e434f063b0c754a5b16004

SHA512
5c148c42e46335b2ceb2fcea36c4cc3f9c2f91dca88967c46c7525ded3b730f44f0be68f3588a1bfc5dbe0061463f0c7f593153d4aa83fd873c046fbdfa09c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3f04a26d52bde02a791d1e4c49e6005

SHA1
2a54dcdb2e75b17d8d6d0ded27c22aaaf129ecb8

SHA256
8a272712ae8b73defbc7c7a56962b3b9e6f38c8159f5f0bc5fd39255badb3424

SHA512
0c46abfc668211c1469b6fcbcb31e44a24d0491f481a8c66342082cfd48f065b565cb8e80d5b2f122ea7bb1f2371e6b389ff3a29b46de8072c19012bf928344d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d1b132d3480f618c307b5f862bf6e7c

SHA1
0de67394c496a51f7a6c54a7eaac0cb3d1e48713

SHA256
c2ba5ffc90d03fcf0122f9f30e6673ea2a1078e69d709dfb7697b47ca62ff635

SHA512
8fcf906a4b63e84ef3925a576f0d5258c3aeeadfce50c3a4f0967699e6f5464c916ac27256385296276a054cbfaba826163b14c54f02a3cf9246f73030fe3d8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf23ed9087d52187d9a3e9680c0098ad

SHA1
3b4a68a3cc62fe716a2ad098e198ae1c61981e60

SHA256
e92781400e58218c899b290e5a7e5973f9fe54979399eb00e472a7a6d4a43586

SHA512
a2e5cddb4feb773b8d6592148150ec41a558569bce91c1de280b8e53217d639e5ed03c625d9f6bf1f07ae35675d10c1a6852041b16d36af7f063b63afc481ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8695eeb090ace9cd6dc526f55ed1d80c

SHA1
96f62642f1f6a64a8b0f4658eb7c86b62ae02d4b

SHA256
b4d655819c1ec7215e9119033d38c00235dc1939ce23fa7a54ea8ffdadc13712

SHA512
ea8d9c6dd25e08c660413cf6874f1c829f92afd4304da78bfc51a6b598329f2a7cc3af20fd3f860f4ca9e6e84138f694e91e84fcaaf63125214f1a7bb3b8677b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab104A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar104B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF3EF15D3C6D09EF21.TMP

Filesize
16KB

MD5
0896a875860a25a001d2133e200a03e0

SHA1
20b7642aeb3bc1f11c66d7df6ce0c384e17948eb

SHA256
31bf1738ad48ec239c302b56bc0960e9e9df8ebddec386fec2334c2539a5f81e

SHA512
6443c79e1937355193f0b17c4a07b3a51a304550458e36f338a22a907cda8f86b35012247852799c91c33f0a77ad2c04a805649aca4fdb9b95bec780603ecd85

Download Submit