1e8d9549c48831fa6cda54485e61338f92ed3d5058222602082d9517c31a83db

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4.html
Size

5KB
MD5

ea47b888fcff3909ac3cbce4a5b18f31
SHA1

2dfcca3efc5cdad9f52a14fb5d972b40a989b643
SHA256

c3ecd752b7da83a350ee4d7fcfda2f697405006004206e5bd10ffc738b45b0b2
SHA512

f291dde1e52ecc6ed6c2766bcfbfe337cd8f7d97dd634093f46469859fd8c51c546431aa71321cb4abd9ebb5642aa940e394c9b11ac64a93b0601b84e94478ed
SSDEEP

96:kRfRITHfEP0jWTA1EkcxG8ktRlyDEMAhBa8kVJK9F6nb4hPQGh/hBATSBvkYqPHi:12HEj8PFJjGXS/QWi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000005d1698d05155fce86612477093a88ad11be30aef4a2aef73c21008ab27c9500d000000000e800000000200002000000063d947f9b478b6f076c5e2b768666e74e56c561b220e6bb9a35cd4a527b23c2e20000000626f673cb81f007cb05fa6bbac05773c5764d49c2ad916783ce8b0cdc9c49fef40000000156e469b70eac8dd8cf2460f51df789f327bc66cdbc6079778886b98276a7251d0f90cb894b79f7dabd9bb554421b82de139a81a5c4d382245917564c4a83403	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403259776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E87A221-68D6-11EE-8AA1-FAEDD45E79E3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c300000000020000000000106600000001000020000000f3b70c96b676a6d35b5f1247bffd3344c9b686974bafc5564af7a8317fadd133000000000e80000000020000200000000c6d2d57c34b94edc3ad32c40049f0ee55b1a9efa06c3deec2b1408a5e0481d790000000c67399f682f0547eed1cbe0f7ac6ff3a29aa063ad8a124d47350a6f70fc8dff0e9a933fc32ca7b9959f9e3a67392bbc0d01a12807f3823d5ee8c41452999706155b4a854422ce4f56d0c6e918f28bb9bf6070f68d12c900382a0fb83f97c2d87c0ea1582b1c09fce995f77b823cfe76d2796b4e64b2957aba35dc4e51e2a712f1090a2483a416c5a48d7e15801dbad5740000000492a7f0977ee33ce9cfdbe924998d68b56e20833b7ca1e5d338f1d90b068f613667b21c0f0b5a7a0df06ae7a10b8b990012071e32aff6f1a05fb95217a45335a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00618ae5e2fcd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1728	1064	iexplore.exe	28
PID 1064 wrote to memory of 1728	1064	iexplore.exe	28
PID 1064 wrote to memory of 1728	1064	iexplore.exe	28
PID 1064 wrote to memory of 1728	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4c283c3dbdfeb5579174785bdfc855e

SHA1
29254662252ae9173ca995003e6a7512c2e3446f

SHA256
a5380271a20e4e3be045a23f663e1a03856d1ab954d56821638f6004b9014cb0

SHA512
8c5bdb6927c3a6fd31e26d811e2ea3f3f6ab3533f8f664326ddc7918c6ad75efe8ff19c7df0db833cc7e8c97c1744c2120872b8b11102e0434babd893e600dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e13f118199f10d2f844af7b139e627

SHA1
b6ada1144ff7c5e42565d9b98b5b3a64051ae461

SHA256
303536eaf2a642b82f9aa4c99027e19a172b3ba74d30be6167c71a8d68ae729d

SHA512
da1dc6c9173300cb1efb2dc6b5d0ff955ff1f2031d936773df676317da2725d8893f09351a4ab0e37d5861eb9b3a3995be6cef6595092944173eff8ae713b9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
262a17990cb6140710b777bf562fe615

SHA1
cc82b9526005f1c8d592a2184ca21d0d5dd0ad58

SHA256
3006881fc5b334376fbcbfe8fdd1c683c4ee96bbb752e7b3401d2b8768bc988f

SHA512
1e1a9e0544d81d97f6e41ea6c8786e7f111cf36a27fea04ebc67cc1ca94acaafa8a679ba85588a5411b2a973d436c795b1a3c89d71b1d9a2a8c763cd4ed63452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f3fc40074241d165e146d3756ca3fe

SHA1
4aa87218c713e0ef337489d581a772557b9fc1d9

SHA256
97051f01722dc31572fc9c7e052da74a7bcc3e58673b72766ca348ea275b30f1

SHA512
3ed610d7637abb7374bcb3b9c835f0634da5a9c003507e34b40733eaddc6fdacb006bc0cb5c1fd8e35c69c7ff7b50e34c76c06491672bfd13d72d0e85c4eba30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd6bdc3865c31e747649d88d5059d34

SHA1
88de8e01afe059d7a087b4956d7d3c5f90d5c9ba

SHA256
35068bb8f0e0d9e36899f72b0e7e8a817189f5a84591b53b0df15b02557a2fba

SHA512
98ef834ff2c0315320e4c9dcdd1188f777357d793ba27ac2d36174e683de88fd0c9df12575be7015faa54cf6cdb6404bc9a8c2db193ba2be76648932016e4d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a58b95b1abed6b1f4d797df6fbd0a0

SHA1
9792c22781255a369a4fc111fc7aeee68be8efcd

SHA256
b07366b4df910532bddff4396928f9fb685cbc583a5f73205ebee7617a34298a

SHA512
4291d086d1766d82fe5d67d56e31ca3e2c9d31be926db7667ef664f005100daf15357833860dddbfd6236b4308e5b85d89aefddfad91aab200e2f232a2fbd742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e5238b5625575f5c0c6278dd239e11

SHA1
1b8cba5ac2548e09ab8ce6b46edd9d47fd082e3f

SHA256
50c0e91d85e72f6460249e68467356d097ba3c8cab46cd15614940d16e457b44

SHA512
00ba8835eeaa757e6e42ac52fbeb12b09334840b99a6b7b5a17ec5925ab03843c42c754291330ac961bbe4c3c0e3bb647f4b52b71bb725ed85d53ce2c78ea7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53aec7d4f34f1bd2c846567624056ea0

SHA1
422b625926b7ca95f965103315f4b193bfb79cdb

SHA256
a204b1be37e7d00e196b6cc60454b416e5f59123a8818c9d62dcb16c32444610

SHA512
a9c30349dcd98d6261683bdb3989e38062e57808b4166ca15bec3068702fd43cc4ef2b1401ee9b540e2c2d59a5265b15a56802eee024b6706c8720fcca7eec12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6f4813f47935cf2bd2e59e1db57b659

SHA1
938c0b48561e186914031cdbdead43ffd974bdab

SHA256
58508cb988a132cc1cbf22255038eaf5ed7def1c8d7767dc6e0e2abed684ad73

SHA512
40248b1f0357870d6fa2669172b2825389aa27b783f07fbbca8e78bef997366aded5a442e6786ac01c9f22a0c2012eadb948f26dda6025187b8a056d0a41e040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0074415e19ab46af963ed650f5a0222

SHA1
9d8498a3e55154470c555245d86e60c13766ec9b

SHA256
10fa795371dc7d80760bd15dd00705d70210d34fa83addecda83fd40e72fdcc8

SHA512
25ec05fc92637f7e889f76d732678b2ab6ff930380d1998ff878131f9d19eb1ac9198a1ee8d5a5e92e122dca54a7bbf122535fbcf24175151d0cfa0a8b5eff22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E55.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EA6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit