ea7e74d01bd206d44c8967a88846c3b29e3d8960925ac130b5b9adbe4643e57c

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shukusen/help/help.html
Size

16KB
MD5

3e371d4dbe1e13aaf308a3b658574aef
SHA1

63ee1c064ef6ad18dc8e2fcf3fe3c4a12ed7954d
SHA256

6ce5323b3ce94a22d176f9059840475d0c77443f03f75cf19b2a6f7524336ddc
SHA512

eb126daf0317c1e6ceba12b268662c84a877f0559fcf2f68f714fbacc71e79909b0ca5e58d953f8271a5d180524f5d246faff6e6f3c70dc63e2d98662ef6a061
SSDEEP

192:Tm744lX7pVWQOZMJHUVOP3jsVaPqVGbsQ2A4CAM:Tm744lX7pVWQM94sVaPq5A4CAM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e4b4b1a66aa9672a1ffe1d339b3e79210675b3fb03499f3af516f94cd34ac435000000000e80000000020000200000007c3bcf620b9141f76cf73e3b0524de81b2a0186f6b8f896c0f560b11714f329920000000e345e244a171698277654c1ef34452b18571b12f07bd5c98ac0df830a2307ad84000000086c65e1ee26681fbae2e2698ac3488a790c101f14af85fc56ba0914643e67c97882315f4065c70c869926a6ce325c0e8c10490e529c23092cc2eea39dd3568bd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423001921"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D051F9A1-1C63-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f4c15626129e09a3f7dff7919020f6305d696b4655ae273aa49edb615f67262f000000000e80000000020000200000000421ea97d4f705b2cca115d9e9b70c5bd140607a468468128702244dedb61fd89000000067cfbed1fd322a43248319355eea167c380739801415a4db1d6cc4163f15ec72dc15addea88e629c5e80b49835e58c2d84ad6e7c1183f64e6ee01df04678be0a5dd1f68c72edc8bd20af7812587c110976e9a991e3e518eb90877dd5f20ce126d3ca2368c46faacb70d96d3f3b75c12fbfc39e13a3e62bfd8e839ba98e950280541e421c7ea70ee7ab309c3551b9c4754000000048d8881ee64c1b63a9ad37ffb3433c3d02c196a0a921176937059491d25d93a420b9444a11a49ea582bd13738b7019b9f5d92cb067c4e76f2de81e11c11ea17f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d027f2a470b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2052 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2052 iexplore.exe
2052 iexplore.exe
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE
3060 IEXPLORE.EXE

pid	process
2052	iexplore.exe

pid	process
2052	iexplore.exe
2052	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2052 wrote to memory of 3060	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3060	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3060	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3060	2052	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Shukusen\help\help.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
09520767647b560ce76f7d5f62bf76a1

SHA1
4daf9835e393fd7ed55fe1c1c587c2509fc84c85

SHA256
6ae591ac5c4ce820e3e594ed1b81bb82c4a40442745cd0da8eec4c09cf7eab53

SHA512
cd8f485d309874bf8d26b9596a8475e720f6ac37403c94095dd55cb2b2216e2bf9c20b1a82b1547cd012d377066e8bfc957ba20d1f5be14df333f524964c0c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5534c619f9297913a033b16d440ca759

SHA1
36cf0ba411fe9e980c58157c5ec6ca7762976185

SHA256
16a21c486f7b6a5a8039722a1bb674683bb738737c2150c4e4b796ee1cbe9b1a

SHA512
b66da47d5f6fe697963fc536f580779f2956d97b8ef22bbbc29042e4d62471f368242abe8923247c0d1ae3eb5dafdd3decaf889a4a1e758f65bb0a0b8ae4a803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c77648a8c29cdcffe797d2d553714d25

SHA1
8929bb70311dc035e83fd961e66343f8ec86f65b

SHA256
e2037212e4248df6f20334c8a2563922c8941d336f83b32807459f24fae9caba

SHA512
136c8468853111086eb13f6850bb0ed8aa7b3e5b3690d11951ad323f9971c73050ecf5bb398201bff949e9ff5b899fecbca6b59282c973ee9914d18032209766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0c9bd226b68e8b090110197b08ebbe58

SHA1
119168af46287390af636a06e0b53959c37b404b

SHA256
aa3859f3aab46c8129e9a6b98f763a58cf7ccaabeff4c2c07891beb97a820d2a

SHA512
b8870b249276b248386f55b0d47d937f27aa866a96b59f8ef856fd26d887b04be1a3106211b7bb9ac890b54948c52ca7203942576c3287bfbbb5628b0ee7d455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9736d064aeee02adbc12aa7fc74c2baa

SHA1
c12e66603ad8d2005230bcabdf379c5c728d9061

SHA256
c60801486d80937d3deadf52c242f6cf91e7c31181885e8f9f119c69bf450ad1

SHA512
4fd96ccde0f019fa5c9ec4d1330ab28ed9687b64910fb7a3d0a87bb864ce62c7d152c3150e7e35f4f6c579322830f6c5fd98b6ac2ad09300d269239b372b0314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
80a5e2d469215527719993e33f7fdc23

SHA1
593e7d9b79553c3ff0c08fa845ed2e224e1ad495

SHA256
52b27bb780004ef41fe3a2755981e6c24a357dc906d9d5881c83c54da9cae86d

SHA512
69f2b479837bcbb3f7c33496fde83c596a6af1caf5a96bc5c66f744ba7287e181e7b002a6232b90e8dd53a6185a92c8f359e5344b7c8d368ff9845e63eab52e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2aa3cbed12ec8d649de4253badd3c1a4

SHA1
9c188b57dbd5eeb7924ce82033881f090ab726ae

SHA256
c8d8268f3893aa092e4b411cfa657ed24717ad4f06cca92bc3dcdbbdabb80e5a

SHA512
e88d2c37c9472884f7b1803049a82813e22ca458449f8e396cf2a2c27305011d1ec667af5314f82c94b4ddb2cbd2c61e2075857689b81c40c82af40b732ef492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
13da74979f68e31a222b89456cba60ef

SHA1
37b3b14d84eb15687d3f82a5f0deae20675f87c0

SHA256
df5c613d9476053cccee22b479181258c675c1343ab0cd731be5e757702d27d4

SHA512
40ba6a9bf2ec12c4de7d7502ba2c31cb3b1fff8da68440e2167c539082f29a878d9613ded12433b0a430d3c9262d7fac35e4fc6b646668e188cf3c1b92f1b3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5f88bd772774b7a94d433c43d408004e

SHA1
12d051bb267fedf4df9371a993a8fb3422ff97c7

SHA256
5ddfffbe08ce6fe422c77addb7c69462ee493bb9fc78c40111fbf81c79984a9f

SHA512
1f999fcd239b2e1216524d26d044ad3e47fc33c5a49cb78639ec80adadcbd33d0c33e27a839989e017fb931fe9c92c7f28cdca7c7c815bf8e9388f825192a0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fa35748d314681da86db6f6cc22c0e3a

SHA1
8b457d27d7ca101744d657bc7312892c8fa4e9ed

SHA256
b6162f58a1db1d1ab9edd1ede1f7bf573baef237b5f3018ad5106ccf0620811d

SHA512
a2b97ae8b6d99ae282ff511294f9c284916450c4d2ccdf7db785ede5e9064db685d8dba3f85a2f437ff7c359994ddb82459a96748b23dcb609eb9dde2ed049e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
77455378187358091d4860a574c01b33

SHA1
43d39ce4755e006bf1d8dcccd115d35359d99d74

SHA256
3745d475b8aaa3955b0838e1335cbe9f146a382f3ea73cb2bc3ae35b2bff762b

SHA512
c5c930f5a18ce33194e0daccb4ab9634d842a2a7215c8169f2875086fd80c013a89ac845bdef10f89ef42e8b314a9fdf7f95894cb32c62c0fdc669b07342a793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
edf8419c06a0d95c25d0fd8f61c52163

SHA1
9ac56b3da6570551c80db4e454bd37677408a80d

SHA256
42107c67d3629c99497fec26c57b8877569458bb92290ddd6b3b93d767568a4b

SHA512
9e418d38b5e49dbdb594eff38d891a31830f2fd9f4dd1e038318057eaccfea5cd8309ec83c64105a2ca398d9304eac6d69e9cb7e798ca48cfdcc4ff99d632929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f43320bb5cf95fe69993fce89c4af7c3

SHA1
3d481165efecc863e39d616040ac6a9504c28405

SHA256
645961a19036fa37c5f6d6afef81e1f38406b535cbdd47debf7fbfaccf69faa5

SHA512
f6913f6198c9503a59a43f6e3b61672f1b012f9a77c206e805d73e56dd24f6964f5ea93d8e74ed5822e635153c5ec544f97ab84dfabb8a3a109089a3aa6ce5d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
45329cff8fd58be8a2a4422ec4157082

SHA1
ef591221489139eefb5fe7a286b5a5dfedb5506e

SHA256
e6f492d545d8b8cf52d402c5daab213b525290b14e16881fd997e45d54b4812d

SHA512
b0f976891bb33dfbc1c647d81840ac7f72436c941a3b0968b960229f68bb5934be1ffe358d29d34139df5f0ac642e6820b887aa2f7a81ec1779d1870e2847929

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23C9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar242A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit