80c533d7110b0f89c9450d5df848f5e2d748667800a8f3e8874577f4d064c4dd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

preciouspearll.html
Size

16KB
MD5

8679638fa0ed3f6fce808218d55027b9
SHA1

8383dd4782cd8d6b41e5d48c137773d5322a969d
SHA256

80c533d7110b0f89c9450d5df848f5e2d748667800a8f3e8874577f4d064c4dd
SHA512

97e9193898d4fcea9df82438543785b103af9e6e5aebc49e214c29c679156c3c527b803a4c1d2861db05902ff17cc26ecdbac3cc408be23c8e1eec5af8dd6323
SSDEEP

384:fhKuCOT4C6ChCPChxCpC4CBCM3j2RI++kC/CyCICFCPCgCkCsCJCJC2CqCfC6C2p:5nCfC6ChCPChxCpC4CBCM3j2D+kC/CyW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000124396eb79d1d94aab2c5b4720f51a0d000000000200000000001066000000010000200000002ea5a7a5dd4324c1f433805f674b17d3e9e06244ce1cc2db4e8651e9703418e7000000000e800000000200002000000095f0f7208442cb5a1e42dd3910512237110fb89f23ddaa54ff0b6a25ace2157e9000000039fd0ce2674b46dba3108b8d232d0e4378ba625cad2cd937ee69040b7dabede73d061b6eba3dff12cc9f49309e65e2d8bc70ad8966423e9e73f5d6c98a5b37578e5f33dcf90b9674108c27dd3401cbe0ae2ddbed8fe89409c579d4fc35114e92d057210b39202c0fc56f459de7dcdfef08074009c2116efbd0cb86a3409f671514622af5f18ee9b679d04068c47df3ac40000000e24c99b509dec448ff04e79688ee846fe951968e861b7506842c943baed138524740aac8fa6b1e377f5730f9d9971bc5fa78ecd2ff6aad859292874e26297cc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000124396eb79d1d94aab2c5b4720f51a0d0000000002000000000010660000000100002000000067d2d3e584ad254aa9c58892b80bdaaec4542d9206521e105991e806fb41af04000000000e8000000002000020000000752493e164c91671af01b6617e0df41d049d1285d46e61ba3e4c749f30c76891200000003135ba93007351580bc13cfbd401e0185fff24ddb25ad29eaaa51a5e4b631d8a40000000bd8b6ae95913cf41e103f1a9a1f5a1b9564bc8311eed182a8469fcf7e985a9a560cbd3edebca2927e47aa1e30d6378b2be069e045dd6f123bad6847812679dea	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8059696ec1c9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95103721-35B4-11EF-9A4D-7A846B3196C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2480	2924	iexplore.exe	28
PID 2924 wrote to memory of 2480	2924	iexplore.exe	28
PID 2924 wrote to memory of 2480	2924	iexplore.exe	28
PID 2924 wrote to memory of 2480	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\preciouspearll.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08dfeefa167de7a671edad7cbaf7c0d

SHA1
8c8b37f8eba641b541fdea0966798569e0c71f97

SHA256
fd84730da15b629171c6f459a29a968d312a3782c23c092c66bcdd1d0d9c25b8

SHA512
52bd544656e2e47b363cdd19205ccd67d1681bf76d98a4f3e27a87fd3d76ceca87aa5056ab07d68806babb164f98413cf1d081af23ab32fb83bdf8ef29fa0962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74bfdff1bc5fccbcb8218da2443a2dcf

SHA1
124ee387c0735345911eda52b41b2cc398100702

SHA256
8078a9d851d7f23a3e990070dbf057e8d2aa7ac88c1ac9874d42eaed5a6f219c

SHA512
64aa276aec286b6142c507a03868d1e1b2a9ea5d30a364a6c83b3ebbdf1a9a1fc1a072dd1be0875e37b9df2060213d3aeacb788d75322a71a07f82cbd7bc0b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3856d9d987500518320149d903f28701

SHA1
575d4865746c2b5e0d060dba74e8ca2fdba73ae0

SHA256
124650f6da606b47f1a6dd976be5bc50ea757f40c8b21f0b21de6a1a80802cf6

SHA512
e24052b64f3c63a134848cbc1ba447f628cd6f82eb6a52945d5b90ad45dd55e7b0e806a47a24d4fa98473f8adc44ea760211f788b250f85f821674e6fb9b4625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99d90dfd4e611289cd1639201c046a8e

SHA1
7c4af14501dc83281f4db7fdf1b147ea35364bd7

SHA256
ce3a8782460677b9ce65ad5f4b047530d534a41e7aaa09626c1f234d50eeaf24

SHA512
5fd9af22c793911e9b1f311354562f61b55a99c0c2c748efd2f6462ce5b607fc053f0917079ebff31a329caec4a376448ff1441f06393327aab18984e0cea76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f33142db607c866ed6acadde080803

SHA1
fb97456ad2894b5f517cd3b0d5cce41c1d3a23e8

SHA256
047a05aacf7822d080bda8c0050f16b4671e41ae04706563f6d449eb6257be4e

SHA512
9ab7b7bfee1ee46666d493c108476d9d7df984c90ef5c57708a8d0dce2bafbc815a2918f09233f629846487a680aaefd66a7c06ac349d1cfa54fd5a442eea938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c053e8ea9b329c32561ec6751650fd77

SHA1
d93bf1164c879f9ece2670741aa7998061b3a110

SHA256
271d7432dfee874b6c0c57d83e0d329feedec1df4e4140304c112c2ee2697767

SHA512
45571cb85b9fe64ca01239cf465a1388775ba80829e1c39d47f6879c29fd352bbb226ae9b2fe6b2ac4973d263ac89606f139c67bfc15c89cca3d4630d5ba7e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1fa6d587d4669678dc0b2d3fbcfe16b

SHA1
82a1eef9dffaf4670eff562d4373e3504b296afa

SHA256
877244c69a8d5be2e38e2b7a3a651de0c3c6ab61879e2064154395c35a3857e8

SHA512
f59c6fdb77dc32f93d5a5850b292dd761b8064507eede57a220d16f6ccde683f9ca245a9e0de492a03cf9a91abea7065cbb3c9f35b4669456f9b71e55e16cdd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
146edb65bb227dffa1951e794edfb528

SHA1
19378fab8bf721388fc8163c07142ae09bee3f72

SHA256
e34e6ebe4f88c65c3fc2ee8035709491767298a688267f6833fc35649b68dd65

SHA512
19694700b2f0cbf4ec86a07fe18cecee048851838c017b9693eef27cf49edc8586871532d015a8e2115c9b79a081ceee6f166d8db1e419e6d09aad091e2326c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdf7a14361479f783717ea996a2e4117

SHA1
303b3531e33998b53499571796cd125046514303

SHA256
92afa0953231ed457d239c375dd49d4638db06a43e6a472a0ccb62935ece5d8c

SHA512
b763b0a618ea3ab656cda9c80a822405d4179f61abbaf46158e720c3124212e734e614c9c1a7e075a56990fdbe8e0dc70fa0567ffc9021e17d8b6a21b1298b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc65d412e7c833c0d13dacedd0db3b86

SHA1
6398dba6354534aa812954228b5437fd6fe8fe89

SHA256
6ca5018df64c92984bb1ab84310d9c45b6208de6afc0287c4b283eef4c41cfb7

SHA512
9378d4267158830d9705bd872a515f457ac790d8839f37c8e548c966404c384c9f5226108de7fc8a9ed715bb0f8b48b4738c2493223cb9698e9b67f19737023a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3382.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3381.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar354D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF6F344C57FD0E4CC3.TMP

Filesize
16KB

MD5
b524dc6debb3b7e34b42eb96da237390

SHA1
91414801d3fdc2ea40f9bf0b308a5be3be473f79

SHA256
bd8688f8391089291aaf9206173928b76379caa4d12c0b28b95c5333dad60df8

SHA512
24427368a9c70dd1070295e41c0a459c5164e0471cef44f2033124e445c0186b63f057d08818dc875e2d3da9129cd30fb08e8c63913dc3dec1a83c8939ba35c7

Download Submit