4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8398b1f229e0d80c65e262ae92085a90.html
Size

1KB
MD5

8398b1f229e0d80c65e262ae92085a90
SHA1

5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d
SHA256

4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5
SHA512

113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6F8C521-9F05-11EE-A00E-42DF7B237CB2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409217687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3024 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3024 iexplore.exe
3024 iexplore.exe
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE

pid	process
3024	iexplore.exe

pid	process
3024	iexplore.exe
3024	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3024 wrote to memory of 2404	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2404	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2404	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2404	3024	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8398b1f229e0d80c65e262ae92085a90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65addde8d93a44c706a8e017e4ba59ba

SHA1
4ebc795d04a2046c0165bad3648057954f7676bf

SHA256
32514a2a89409c7e887240b85fbbdc3204a5772d9a7e4082e59eb7192e026529

SHA512
78ced1ef997454367b5577e784c892be369652c9b487945ed0509b92f26f09c3b07b30a50dc85ced3b35a349488f7c981370b39cf24878a15f8c4de07af0a303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0ff17aa42255a75c0611bbb2c91067

SHA1
ee19bbef225148069c0f0601569d38ffe53e90a1

SHA256
c18d2334527ec6bcf834a76a53a3bf5296e069611ec96b8e40b09d14a0310352

SHA512
0de74c4313a229e9aff93f370f351276c411f71ec1f8ecb38e8553e26aa6873821356eeb95c8b876ec954d8d0b0ca654d4aa5bb3fa8df6c7bbd0113d4b1bb579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bdb45e2762e4a53c64a57d2c09871a

SHA1
e6e62a355cc086c966defe023208aeec6f320665

SHA256
992723e45c5101a6b0bb05f198efd643a6f92ba1f22579c87b04c5b13452e34c

SHA512
913f6908dbc2884412486926181f1cde97897aee040830d2f3de4048e85cc9cef23ad4d152fd58d7275941904860db5dcd7abdc19d3e3efc8163b84d9c791824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac7edcea2e15d93925a1006189abccaf

SHA1
d74015a5f1a9b731961a90dbbda1c3b003a57f84

SHA256
225fcc5bcbd69a29d05df58e10e4d34dfa31da149870bcc85f9b2e5ab3418295

SHA512
db1aadfe8b607222b7bef27f44fade1f6e5a279cea9343fff18504c9a417799461d1b8570b31856994a59a512c47a14ac3af54413c0d223910a1bb95f600bfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac1e48335e4a39bcd2455940c3681b8

SHA1
31bf1f04be4e8c199877da6a4cb5e1c49e201efb

SHA256
a0baf754abb2bc67dc09c7d6e212b6373fad0e9cffae481266539df9266f9c81

SHA512
76261f8d1d646795586a814a04e1d97c4932086233739e571e5621e8bd9fec0768f4b7ba5db980bcd6aeff5946b5b7b24640202a08a95c13152b9c82010a6bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db991842eb76c466ce103a1eb4410cb6

SHA1
8dbb27bf49b67a3fbb69a2814c894e89071f3147

SHA256
f0694f0205aff442d26b8066c011f4b800b82cb2e580cabde553fc633ba6a2cb

SHA512
133a535916c6e6f0781d470c6e6dbeb2e307f55511872d29fc20d64a55ad3b09db943ee8132d3936f0ee69299a020b3c02b42d03db9a3e232e95eed121155b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a721e6245c164cb0ef09d85f598d6168

SHA1
88c7db0248065b5bda9a538b869e6781dfdce76f

SHA256
9469ea98e85b48c71445a8598f08de725bc26d43ea36f8fe2f3873f9ab9f322c

SHA512
0d1bcf7c9a950a2e0723d551a0ca434aa5cc3bc9854494b01322cb8fce616b263b994b331a714f7412ca19464e16382e092c0769839906a2767fd8908d2d2c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a3224b8165b484238d1acf9d9d6aa65

SHA1
22eac23d5ac5c77b57ba9824c4945c9b1f63790a

SHA256
5fc0f32f56cf2e1795cf321b68a924c535ef283144df9d0e0a0dd512962052c2

SHA512
7222e8427e7fcf4e4d54278bce4e72e042c7a44eea51c3d04e76b97b443408552d2dc5af863bb9c2e41c001af9ea491887581bf5f908062c463ec84b7d8da3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747884d252392bef3b6163f80ea72e55

SHA1
f886ba7e3ec110c91beeeb176df5201d314f3765

SHA256
2ac91442e1450cb9b881f1087023d8c0b26eaf8838e33a070ce9d2573ee7deb3

SHA512
9c30652df333c29edc2bdc2a621787645412e9a77c6616052d1ec15b6e51d305d891d8ba2783cbc0574ddfb5b88684dca966707871acdc3dd7d032f49e2fe779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a39cf94adb0c7f7ef10d61bc31e27f7

SHA1
4a2926ce1588d53d7eccfc93ef771a325bc56f36

SHA256
cf30ca204ee45f01bf1a86a56324f7574a07dd6df04df72f383c1e71689d8640

SHA512
5af5fbde057eb0072ccf52edc1beae23fd9ec67fa72b7c8b9c6a9a3457a50ca1225e359fdaed728c8dcb3edd39546a54c95eee772394e1c162161773a12d4970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4EED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F6D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit