6c0a4d9ab2e39a3035a2248d5f181661225810e02ebb9e5f99ecf36b84b351e5

Analysis

max time kernel
117s
max time network
156s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

404.html
Size

479B
MD5

57dd7bfa6c07bfe5eeada45d4bdd78ec
SHA1

395c6ad5c3ae0e8ea47281f5007c369551b32ad7
SHA256

c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5
SHA512

c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D63BC3C0-8A80-11EE-8303-46198EF603F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f77aad8d1eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406961512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd669200000000020000000000106600000001000020000000deef20b078d4fe25a813586f66282fa02500374a22f13e3a605d1812e67348f1000000000e8000000002000020000000a551260eb69070341c9514cef635313354b0fa89b993e323a06a463f2133ec0c2000000014f155d6a7cb69bcca4c4644159801d3d316a8aaba722fbce9e8963c94b42a6640000000c5f688ce07996be27176052e4df20e7638b220150f2b5d20abe0d02280387f9c11698761d2c03414a490b872fee6cb489b2353e24b21a75008b7d65cd47e6671	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000004ade0f4dca4605dc673de5fbc3f549ae74f50292aeb22fc9924f7b96c08eccb5000000000e8000000002000020000000f1fb3828fdd28e37323b0126d10ccb666c634d6326a02085658ea8a03f3acd119000000090eb1b5a3dfb0cd15b66fd999a2fcd7d075f8755066309265353ddcc020060ba433a2dafcdcfc9d11b31b38f245fc84fd9a11cf104dc7835cd205f96e291476f29c46e547956a6d70df94605b08ea6a8f066bf96dc9cbf97a02de1341cba9be133b304a54701efc4d4e87b26feab065e1f2a23715c05f207ce6f44d694a893b176c45e9523155d0f3ce5fdfdc18fa604400000001324b89fd6176ab5f2e35cfcea44f5ca5b15892d4d05771132ac988b5f53020b0974a39724c20d38117562d5c8189931b57136e87edc5727186b9e7ab8875fd0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1200 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1200 iexplore.exe
1200 iexplore.exe
2640 IEXPLORE.EXE
2640 IEXPLORE.EXE
2640 IEXPLORE.EXE
2640 IEXPLORE.EXE

pid	process
1200	iexplore.exe

pid	process
1200	iexplore.exe
1200	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1200 wrote to memory of 2640	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2640	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2640	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 2640	1200	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\404.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee1b663265b7d38cfd7a056454251eb9

SHA1
3637dd40106543e06f4afff092a66088dbc1c366

SHA256
ec75a5a9aa5657930433cc32c2132d0f2aba1e6f96bb9be83f4837f0f3318d4a

SHA512
eb047565647d22779db191b3eba9152735bda89a83c354109b70e49a8230a934387a28ebcee66019ca1bcee836468b1223a1d91e0d1179c3e74584b9a81a76d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be38fb325e0e134d0bea2d7111ff0d36

SHA1
46963aeb39bd4dd2412d4aec69847711d402a0b4

SHA256
5ea4f1ccd5e3a816777f7a2995f20228e1ac7510eb506882d993ce2bd3073929

SHA512
67f127bfdfe8f4f5f57d4f4bbc45d71e3ddc3615ee0c3e677f73fd2bb0273387bf9b5807cd699ce48910c02fa079bcd1efe70adf6450bdd227567ea727c4b62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dbd34283e909f2827c51e8c5f3e4083

SHA1
43c3948aa7cd947df02ee986ee9b8fece7ca4feb

SHA256
bc1a26c0a6fd065597aae9f854cec18b0b892925722637d246a9995fb50636d9

SHA512
dd22f8455b9e79d3308918955932a59e91a6f91f950e530c6761f0900e76db2c5a6cc4ad396471426ee4692aa03e492fd3e6d0d730beb1ff99b8275cf62021a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c50d4213bc43b4052a0b0c13efdad75d

SHA1
662f7fd5413c4c0be53cadf7086e5d74aaf9ca77

SHA256
aa4a77c8c6e6dd88494ae59594ff23645eb2a2eab8016f76c802ea66ca2e3af9

SHA512
17d282d528e328b6ebb9dff22c284def45938cae6a6407634dfb5361b6c08ad7cbf00ea0073f2d2e1085cff1171855e4a1630e28433cb5c72ff93d6da0621c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba1b6e52d946231ea8aa49707e751b14

SHA1
c183f49fd0d45a277dd19703d87d6b4e8280b496

SHA256
70837253bf9e9d2ae4cab1eb99e4420fe8aad4d486f1c346a2d974788b9226e6

SHA512
bd17effff44232825b300ca94763d09d9ceaf672bee6843b6a564dfec382fdea8cbf206ea70dfc1adbcccf60804863deb991f2fa0fce2262a9cd5f4fe5fbb717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b3c308eba77922cc64c86cb5d305fd1

SHA1
708dbdde4ca2143ec39ad955a553a32f62cd2aa9

SHA256
bc12d682039c22e306c0cd38bfcb17e8ed849bfa99215d2ba1ce2dc958894e86

SHA512
a7e5f22d6d99f43b23e1d41b273f8e0094e3af48f2b8be8a787ab234c52abe2c32c023b6985ac084b269552d596477a3594ba861209cc3b9b0fc449893a171f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9c891f98938ee8ab2b51d81bb056f09

SHA1
416848ad4b6fb1db341123cbe5abec7791e586b9

SHA256
4b90bb830af2dd303b29b2e3b5514cf3622dfa1ed5b127757d4ad43194afe427

SHA512
7b34998a3f224be12003b88f858bb99a26cf00f0b44916381674a8905f6b2c2feda593d3cb56fad09ac63b68055d4be7d3731e89eb3e51fc1bbb36575b559f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de117b144f7f6cdc9634ebe23b012f9

SHA1
cc0362500377959fb48070a0f9a96deed7a8b07f

SHA256
16ede3e3c1a382146f364105d7bfc20a675118d902d8dfa790d03e34eca0303e

SHA512
0d32b906b42ea568be6334df0a08dd5b457cda5713017816e65289c2e3710b01a3d02bdef616200cd48add653a17fa9c36a973c72ca84146d6451a1d41b82638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a22d08f323b80dbdddb51e1d2bd677f

SHA1
9987634f6f4834d1a64feee6a02921302499fa86

SHA256
7ef3924a72443a4fb2d185f1b48af6147496aaaa2a23e3a57c169e860691fa34

SHA512
41cc79345d506fc72db37ebbc03ab85ea97bacc8d2051dc4d52bb7a74b020d077c7c06ea130d53344ccb2f52abb07da9d8dfbc8c95488deb3c209aa72fa7da9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f1944a8b14179ef068980275c8695a

SHA1
5b1a1af661c9c1be8038309bea475294082fbc64

SHA256
99e4314533b6db288f4df33cdde7241420e94117b669697726b0875cb725c7cf

SHA512
de5752768c9f8c0a23232f0683315e73ccdb617fdb5a0d593a0b5867014c9c954575d4d5198811c58aa82e7f4b56d86912261923b86fbf2ff519938cb8595596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cccf4738c6fb6da7ab020939659146bc

SHA1
839cf081d53b8c4142aa5f133643c4351fa04848

SHA256
e0a7543fe510366f24b9cbb787802996c87fcf3580fb61f9c49c04eb295b15b2

SHA512
99423c1bf6a3302afca517d9355e0a662cbb88ca29a4e3918c5a4163a0217bf1fe5a1bfd7ef8ad9e7d35fe74b3a8aee5beb2e86611a8dce2b2723d722485bf21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd7c71cb8c936f03c1b5abf820016d0

SHA1
44ea2430555940b166fd0b3430f8e8ec608f7e06

SHA256
52213ac2b02c0cd517f5c9757f78c384af3f63b96e81864613dd9c537cfd7d5e

SHA512
63b1d5f6fb40c892e3f00b44ab41929d98f029645051a802010b0534cd70b09e8145716f0326ebe7a361b81b7e2abe18693c96a84baa1fdea959a3f6935eac3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bdd4f4c3e7b4295366fe988820816da

SHA1
74a09f12ff76f7b8da5c4536ab22bd6c81b4d4b0

SHA256
a5fa7c34dad426afa6a7fe022410fd1416cbfeee5bf9b0a9d338c0c31f1e4c58

SHA512
c95137a1f801f4458246d34ecda6e979a0c7197c1b95b265f2031a697ff494215a5f2481a1927198c71cbf8224de5b387f0f72ffdafba8b5badac3adcf8e6cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE0C0.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B82.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit