0e9ee42b33d2ddd4d0c3c49181f02c7c22f64e478b363e1b7281f1296e73ae8f

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Worklog/Worklog/HTMLPage1.htm
Size

207B
MD5

ad59b31d499eea250f72495e7642ef77
SHA1

fef12d784f9f1ffa4c6977c738bbd2e3b401faf8
SHA256

bbfea887ce39bd9e888e7e2ec5d673bef40d188930974479cfd804928b3dfeb9
SHA512

f617b124fd8e20fcbda6f95f60c4fdcaafad3bf054f4535b118239e15bb5eb93c6dccc6ca910ed04285d4593494ffd4f98cf147764f52a2a1c38d75f0f1d491d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e9e14d242f073bdde3e651c4a41c0afd0d478da01fe92ea89c0318ebf9348268000000000e80000000020000200000001a7a7b883591498b85aca257433ce99153df41d1009a1fdafdc0c486996a61ce20000000729b7815084a54fa613b36d759712e0ec6552291b1e96b0752d97784bdcbf3cc40000000a4e5798c22beb27cee95ed47391870f09258addf6681b869cceb4b43d0e51790a0c16a99273a3bf9f21928a2244820cb42d771ccd8bc04d96ee7aef665273853	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000f87588125acd2a8004cd2c563ba65c8538fb1211925fbace7a08fa148fc70752000000000e8000000002000020000000ea5e56acbe5316dd3ed778e0067e606614ba3f9a3d72e1bdbe44d262a375381e9000000011167aebb09f1991992680250173892fcb460ad510d820c3bf9b25d420abb3e8909f53671f6891c50a5e34d46d86c2e58b38eda6204bb2c4a28239a8df93a60e2ef1ee21eaf3343971c5fbc9a355c1971374083aa75d35bafb19cb7f39e591e365fac2916203833922d23af6f41cdfe2e8344302b31238a6e79ed0d63d6a2f356b80dbf1c014d82d7914fbedef42604c400000007aad5bf16996a3aeadf8e3c731dd5dbe60624fef2c22874946770f388db1b25e9bb6256d59944df265a7a746779158ffdec5efb0278f4ac653c4e2a7a2d3f8de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF7E0EB1-45FE-11EF-9A68-F6314D1D8E10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427576458"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4082fb930bdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2340	2408	iexplore.exe	28
PID 2408 wrote to memory of 2340	2408	iexplore.exe	28
PID 2408 wrote to memory of 2340	2408	iexplore.exe	28
PID 2408 wrote to memory of 2340	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Worklog\Worklog\HTMLPage1.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
781c730e8d761a53322112ef792c5331

SHA1
4726a3b94872706cabe8bc3ff4f857ac75dbc477

SHA256
347a0f9e479a2309f7cedf44526035252bc92ee6f6b2a3c7cf3e69589f2e41ee

SHA512
cab9b8eaf18a0a88ef5af967b73e1e0f3636087786c4c50895cfb5748a92f384b096e42ca1b7703c236a5af4f059acd48ffb6ec5e4223dcf083e214f1c7c9de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58a2e13041ef2334dbd30c578a6d3f9

SHA1
131d1063eccca4ed2266494d140a57fdd4e8f361

SHA256
19eb6cb1a62a6b5c00f22a99b7241befa3b85f58ef5c93cf29089f3195f5e27a

SHA512
0f0aaf6a5556d6c17259de8d5ab27e855400b3b00da968b86186c730fc4f98db4cc0ad246a2b2d5c94bf358ca7d6e142403b7df65a8f59cb3a64fbfc4aad01d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
278a1a3406bbcfb7b2027e6d99f5fc8a

SHA1
763a5353cc38fb0479c3148e2bb9f152c5851ffc

SHA256
b1aa9731d0f88063c0f3f0bc1818188457b42b9c5cfdd233281adb0157a6d865

SHA512
f81d0bc29dd0a8a28aef679910667ca047eca1c93cf43c753af44a6363cf1133146c14c5cf3f218ff1f01770d1ea66cda2eb02b98a828ac133aca99cbdcf32d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abba3212db013c60374776d1d3208e45

SHA1
dcda677342fa62f1932b4d8e14d468c7838c4096

SHA256
1252eea8f25e19d0f6ac8061debc74698cc23d201b6a69c64d29bb2bb75a818f

SHA512
52ed803aca800a9b2efaab4120d8b371b9019b57e791b5ec186ea04a616a4b617ac3700a6e9a55b5f55ae068496a01d7ee8c1ce304fb23db4b4cd6099d142bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8488636cd9d55ce1d881f80b9ec59ed4

SHA1
d87d94158a1efef1f04e2e4440ea4270f78a84b4

SHA256
693030d8a01c218f701a8957dec382e99abc6bf4ce80009025cd08880d0fdb8f

SHA512
30a7a5fa4e5fffdc7e91d0e540f8a7bd5f31e9872a5dff59d320b06b49dd11dcf404ac6f6db9367beb6672993090c91d6e01e48c80f1f3948833848b2eda707a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbeb050a1b8e1e64c74ef196e725a9c8

SHA1
292fbee390981d22802d2217f933939a51d13661

SHA256
2660fc94cddbbac1b40780ffcae92c1213a55b9204696dd9ecb96cdadb83c793

SHA512
a57e757487b76619ee7931d9ecb4aab27ee02eea20ca39efdbd917f67e7bb9aa18a95b63f83c92128a451760b52e1373a7a7663f8e6045e3c0ff4e16970fc4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779f152b858505d2965044fcb601d078

SHA1
adddf0e6c2da9ecc214983c8711c4683f61429a3

SHA256
35b92edb33abcc37ebcb8c29d2da6afa1d20b60972d912882058111750eeafc0

SHA512
624e728e394e9786705fefcc47b5c8b29b858320944f8baa7b97712cdb6427968fc3b54c50a298a391cda57270df0459ee27248af07fa62805e46ca9a3aa930b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25897b68f67968237487b2f41a903714

SHA1
a39f0dc40e629fe8ff0f6cdb4157feca311890ad

SHA256
ac0e1d8723928f59ab33fd71cb75b33504f57bb6994aa8119df42d43dfe78459

SHA512
b9b69ed2194e7783a34b505e61c90d71aee27bac0d80080533ca72ea5571319a4cf4fa9d93f13061f1c2c27a8294cc25247cbc148373e896284337e9a05fa3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
197c783acf2575e5883e45c835f6cb3e

SHA1
5cccedf81a71123910d7f18785e9832af564ee58

SHA256
87b60f96ffa7f2306b6f5ef7d6debb391a44af34dfcf9274dea5bc3b0c351492

SHA512
e592530da851d9848d0bad48ecfdb74043ad2c3b50dc00970089cd4d770548d5aec7e4b4d392ff9caabe937e99e8da764172580f6c3c96da687afd95a6240f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acdf0e651ab3c88498f7653e29647e4

SHA1
4cf86e1f1a2ab5448a92c8ace8142102705e4cc9

SHA256
95174f78616f7cc6478edafd02a12617611195794eec049fd1d4d57e73d092c7

SHA512
41d088bf0c54cd13d60e81410829f692407d947bb99adbdc42512d04c280dcade02cc2ff1707e83f37e42b490794fc389e7ff3856fd6e4ecc5b7a5a1be283f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1f20bc9f2a471ebad205ad4388b7122

SHA1
aab386f0b55323ec5b5d037eab51f389eb1907fd

SHA256
d7cfeda47b18002d9830795347ab5a9b721a04155d701f2e45b2d48465af9ab9

SHA512
d00daa44a713c6f22fd6a57ec7683f9dab60ed300258dac8214f15cd70a696334a49ecd1cbc99258a23b89be104db1d1486dc22b87eae76011ad3a1deef72001

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB05D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit