1e8d9549c48831fa6cda54485e61338f92ed3d5058222602082d9517c31a83db

Analysis

max time kernel
138s
max time network
166s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4.html
Size

4KB
MD5

cd3bd81c014c5943341cf536513c0e44
SHA1

7ead817904553be9e5c3c9c492916c3d25c7f2c4
SHA256

917dcff2a6c2ebe4c2f2ffb84224924c1964ce15e02ec2b1f81c2155726b84de
SHA512

37f4fd312ef6da9b7e7e8905e965885984b342d6f9badeff859c4e307434a8152435395b42e588f7b29cded08d252f2b9438195824aa1c489deda9dab0ba4b4c
SSDEEP

96:uXfUSzJwpsgqM13EWNzuvT4RM00tS3Zx7ag4UCNpTGzt0ilcFUvA5epJYh0PE6Pf:3ks79F4wBJc0PNAP+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08f76fbe2fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403259813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{251BE051-68D6-11EE-AE69-EEDB236BE57B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000074291235b0c51de2cac860f96469d7dba99ce1a5d801012f3ea69f021adeef9000000000e8000000002000020000000eaa646da2424aca571de0522a91a603322c6e7fe7dd032a8416115c41db59679900000003c7c048a54457c2f2192f9f57970ed21cb1cdf9ba11169975a32cbd9a9cd4592ce7f75d6690261fbaefb615a1f6ea718d5ed41d8a1a1f47766f7ca76430a5de038a47d940b68235c677ee0cc7852352c5c76b31b99d800539499eb2e31e89e76998cf1623d59ff1b585bd5a9d15d9a4fff614c9af81414ac4f59b4b81a06cfba2756f5ae0c882232c04b27f27df4756f400000008f230b903e199731f00a545a62cda785d282f07c656e005e421826a9e0fc54f6640e1e6304886dc0a19b3d7e876f5e19d21e00aab629be6fefbf10b224f5c1e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c30000000002000000000010660000000100002000000025ce0c1dd2b2aa260152b7678f3d30bf239084c2fda4b1fe6ea7f1fa3cb5fc17000000000e800000000200002000000031b4d28240d0e5b6299fa1308a0c44b1c65f8a7715bb87d1cc0d654b49fb39ab20000000d69489e37a1c642625091820012e292ee4361f4f3acf684449c1ee8caf3f86a740000000166234c44d7f49fc62926d98754dd3863da7933e66dbed32300a73f82eb545a971651907232fc525fbcc9b0b71c54f2c598a066e1e794f49e2e6b5de277f5504	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2272	1852	iexplore.exe	28
PID 1852 wrote to memory of 2272	1852	iexplore.exe	28
PID 1852 wrote to memory of 2272	1852	iexplore.exe	28
PID 1852 wrote to memory of 2272	1852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de9db7503fff6225001d47da37c5544

SHA1
79d5ef821f1224bc9a29d96e10b1236f01636c00

SHA256
54611aeed0da92a6501a2bd7dd2d094ce88a2fb58675fb0fb69202632de1e9fe

SHA512
c110cb5a4d468cac43a6c16e6c0714de490d990524590e782fd9817d0d772187091aca95dd7480141ef4aaa5ec593fb3f4adc5cd5d847f454a213c72af28521e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4930fcd8de7a024d230909892298dd54

SHA1
18200a2ed92ddeb063d505910aafa87bf63862a8

SHA256
8d7dc5ff4b93dbaeb92d8e85cebf80c78831aab830f43964edbfcede06573cb6

SHA512
cc673dd2b3ed4a5e31f26d7670666a1a5dcfd278cea1875c66a8597b0e6e454fbecd9ad005a2c3e19f90c50d431a557bcef4dd31b7a6851a483f4f887ec10249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
359937bfe130ca4351d4f9e537e8e900

SHA1
f68a69267b661922f6d8c9ca63b982987b321f53

SHA256
aba5cbcd7eefcdfcfd0b53ef380c2d9ba0920f840080e616db4d0580c53797aa

SHA512
d47c9dd91f8335818e52175e7522772e714fd6a4f90e5ba31aa5cbf145405a127e3a6eff55fe39479336f9743a6c6aefc41b04c39a594edd86b26948b475df3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16044ab35d000b8d34cb5a85633060b9

SHA1
0749cabf0aa406bfea90210d3d985fbcdb83694d

SHA256
f40a770e6bcca81eb97cad9623cdcc004976c75d9f96ffbe2f5a440065ae3a14

SHA512
792452d201c699f0f801c7af25f784e31aa5b54ac3afee3ad9677eecd11194116b5f4128d60fbce4963bf3da86cefc5db09dbcbd9f0e55b2e686128b9173b4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b96163d5879f758f919abd420b740f

SHA1
15dc6c179f9755777167d2d3fba8701936997db5

SHA256
628d0f5980be8568a063e15ad2c120a7f5d816b088f616fb3b0ce0a4bee72ec7

SHA512
49151b7af8a1e1bc5a367741bd82690d67c56ba0894d0fe7284d08357674edc1bcbbc7f32f8058e0343ca885c9e61c69f5771a656689fe3acae5b5072dd3d6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b06d53da85c4cba5d2679d8be7515a

SHA1
38a9252bd6c7cfd2f9992ddc3156e34f7e3ab821

SHA256
669652d8e85628d089971b382954bb0f2e47fcd3d311291670a59f16f0163863

SHA512
bc5d1742e7a4707030fdc4dd68d784dc585dce716fd36ae115157ba79f632cd75a8007c4447503d9f38ccfbb8a1d48c4927014a67475a632a50c9816352ed7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de901791c0c4ad605bb6757038bd2103

SHA1
0f420e24bef13a4b3e6ed46797b845ca7788dea2

SHA256
8e3dd53dd2eb0fcbf454ec94c938006366228c065b26f873cb85dbd2c95eb4b6

SHA512
28480b9440f911b7207f74a12fc09ddc133be067253700dcfded9732bc3f65cc6936d8b5300a6779aef0b75acb33f64925101f65b9e1bc54bd535b7aff90038c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5886f3ada1e7ba4ec46560182957cc

SHA1
8f0502b0d895fa4ea724b63fcb0de0014fd11164

SHA256
879107583ace9e96036b29757c600c09e66753cb44641a80e95dca2b04b82331

SHA512
06a5d2290e9b4a9aeeef26640a7a070bc9d200f35dd0e42c6f365bee7667701bc95363b1d0a9f50e723036450965cdeddedfe5dea3e12583016057cfd8174fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69800b307b501f12c3bdcfdfb10c299f

SHA1
ce251f99edbbdaa677fd63ea0b47be2760151c69

SHA256
d26e79bf2d6dd6eeb13b2e5a90308ecb794b7b8271cedc74984b0b7d5184f75e

SHA512
3a456abbe3224837ad8fd6e0e2fece0a3f53c306635dc1f007d84a7cdb99fcf313e14c753c3dfe216681f3e87ead5bae13c56b5f6a22b50dcd30a8bfffa6cfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3911965d2e1c13af56d92b813d46b2f9

SHA1
b3a1b0d3f5f61a0ef4ac583a923bb5feeb546031

SHA256
892be9c2e1e6402ff34232317b4247e653f1e57a3faaa8f293aa8bfdba35b5ff

SHA512
51a4fc9a98d691b6d530063f087396e42586a19bb0a4f09bb71c01dc6b0e8c06cd4e4ee38bc3a14a6e1337055fe624c04e9f347f430497e0c49b5a166bd0721c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE208.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2C7.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit