4ff024e4be702575722dc4984e01f842a94c137b8b3ad9a09df45be9da383791

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39444eb82dc4127d06479436f5909c06.html
Size

2KB
MD5

39444eb82dc4127d06479436f5909c06
SHA1

0a7fab0bf4fc25dac189b265e74399f2cb503b01
SHA256

4ff024e4be702575722dc4984e01f842a94c137b8b3ad9a09df45be9da383791
SHA512

0658eb8b513c29f2abb5f0687eab8a85fb68440cb0310f3278613d9debfa4b91816abc78ecd8c8b20bc0dc926a421bda13c879fa6519f6c9cf5df6bd929f6aa8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000044f4a8577d0b25f7814f789e823ce646003c7d0127164038fca327c19d5682fe000000000e8000000002000020000000ff9c7fb8bc356828a79fe3934301c44e723bb9cf324c07b2893d5fbab0ef0d29200000001ad5862487190e8fa1b3a3be3b762e66884569aa2f2d6a8810e6ef8fb16f66a24000000054e3cc20cf03ecabe6b790dc1093460b711fb0b8cc5dad0535db417a89dc3e0c4a74653ee7a60fa0333759b6bce6f9ec01cfbf5bb0ab847e9657a357ef13cd42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300aed6e0344da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411080288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000917ec18e76736ea1343b719d138140ae7299791488151f956d1998d687b61652000000000e800000000200002000000099a5e276428e0b23705110f95ffdc4734705967ef6a1e0114b51e7d0cf7bd69b90000000a65496f8a249584a0736dbd2dd0309970d27b2c93e7b2ab1e4fb165fff42c0c0b45359714cb801c2f06aa6279a4b70cb6c19b26b3a4e382d788bfcf0847d225334c293719801a9a1ad6af6764660bbf32c4d4d7b21008368683df749a2de678103f3014b4793878e8ecaeba1d9918dd5fa26f586b4ee7201b907d3335c9c1fcedf4f4330cb27558c8317f80f3be77ff640000000b0eed8fd68aa521ec906d75eb01425c0714ff2dcadbcf61766687d292e244ffc0e084e1a588cde92dd887bfacd20f53c455ca1aee1b40126d4f039a089ce221c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A7599B1-AFF6-11EE-9E34-CE9B5D0C5DE4} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1600	2148	iexplore.exe	15
PID 2148 wrote to memory of 1600	2148	iexplore.exe	15
PID 2148 wrote to memory of 1600	2148	iexplore.exe	15
PID 2148 wrote to memory of 1600	2148	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39444eb82dc4127d06479436f5909c06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c43ad4245bfbfda0a929396adb948fd

SHA1
ca4b8e410aebda4abeacfa78e1b8dc19e97a5edf

SHA256
955a5890e00c05f963b9bf99af4500aadc9abaf8587608378af5351d2f929ec6

SHA512
98871f5fd32814b89afba55cfc74ed464e2b9e0abb4582cc69ca0365c741f4ba99322825ee585d16cd023f20b9dbdb86412b4c8a9f5e37ad7f9e27db298487d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a59c433456e01324c6b3894c9f28f121

SHA1
44ca5beb3acf37ca8f6cb04e4ba9c5982cabd7aa

SHA256
cb0fc12f399e03d22fd7d9e7192ada2fa7b09108741602734f989558c7cf2a3c

SHA512
9053bcb7566165ef2512e2112cf00809d87a5cfd233619ae92ccd4da268813af4b9d8b5432656aaf99a3c3bbdcbc97ae24b9d7cdfde28fae55fe81b05f0af77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1366998d21e6d1a78ebb774540b5685c

SHA1
dbf6bf6ff78105efd05f5308354e8546c2bcc6fb

SHA256
937f3f66a2a8222be85c0a433f0e215e0b59aa9a4293afb5c3cd34287b9e07fd

SHA512
ce6da551805249c30134ecccc0d2117d4961e519f32db8aa8602431a8886aed17d34830095e3873e476a01e7de464daa4c0a3218b14f9e0be8740d62a570e863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f01f7c516574de9bb72f1c8f5e6e5f33

SHA1
51a5489dc2a15e53776a621a7253968de8a541a1

SHA256
2dd4264201df19b3cf347125b8987fdfda654a584ff53416094890f4cf83171d

SHA512
15e44c47828110647aa9bad8c2b8b1bc9ddc310a4bc69cb305f00d83b8f41a289ca8ee0a16d4ab0e383500e2e21af2998b6e2f0631d9c58fd3df6da93c8f9e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73697b522a07d0e98f3eb0fd05f1318

SHA1
8494a7cba510f910acb37defadf1e3d4148ecf9b

SHA256
0b4b22dc6d0e547ceb9f602888a351f55c362d0ae5b2c14235c237e3a57bd09e

SHA512
5ef85701b40555dca8bf76648d53644e876b837edc518813cbbda7b7129788ad9754a56ebb2460257c68ca5cb01f38e21dcdde630ddd1de85a9f0ebe6edfcd3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
901fc625ecc213235a6c6bdae84fed5c

SHA1
10b1881b6288ea1941ea13b808edd65306aa3ed7

SHA256
754675b0d07f53fd09b7392867140aa4a811add40f207d771b686df4812d7a48

SHA512
7b7c5f138ef4a5c6118b5fe477989f34e49c3fe50c490e5010ccaddbfc1fc7e5d0ef075a5d2368418834b8d58f32c25a9fde727666c142a71cc82ce7ab2e784b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ea51b7b1158ebec370af2edac2c8bb

SHA1
b33848edfb6018af4431012104e974c1540bb813

SHA256
7ba28c9f6903f9de48cbc908eed30f1cbc0d1b2985ba9ab35cd0693cd66e29e1

SHA512
de36c45cb0d7293b3f075ab0d87f53ab8e4a6df36ccbea023883766867c2abd58b6d8eb480fcfa98145f4ba004998f1cdca3369f49ed6d894d3015e22dd1bdfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0940279e8ca64a94f19c0f905fe7b996

SHA1
6e958b179fac3b082fd283718413e5135f7bae41

SHA256
23ad2f49ce79b86714204bf1cd6fdc9937bd9ec9717d1921e434c5150fbe2eb5

SHA512
2ae31741f32dd5f57239a76475712e928e411aff9f9ef76bf801a0569ae3d4dd1201e0f84901b19a61cca59bad59e2f63fd965aed1b4e424aa0dd8dcc526b4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
352de82e47fce1b1166d985665e39cd7

SHA1
28f56ce9380c79f81ffde04e13ede75698b79ebb

SHA256
992a1d5e30f9939614b4c1e0d3fc38a810b1648d08971ab803dd4ffb3c0137ca

SHA512
4b28dd94a762bffbec0b2bbaf8e9e3d1ede860bbd5b45ad25f5019546f94a602f3b92af1889e0eb50c235d9fbd1d9e30845b42db5ee8354794961591213d6bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b5b8fee88a1ab8820ea6bfa5f6b8208

SHA1
f2496b4ec9d0cdfff53994f48562e931f93eb8d8

SHA256
d4001a9643f706ed874dba2533f5d5a623adcf5c47c7781e5942a9993e14b9ea

SHA512
a827618323b579b1ab1981ebf67bb455d352646be0a4a32017569d066ef02bb7e5254cbd01ea59bcb537f4d63038cc2c15aac97b6ab8abc239b6c3f4b7cb4b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ed5873b1de539cdc27bc438fc1231c5

SHA1
2fc882fc38c793ca3d77cc52773df0fbd50b0b40

SHA256
cd7cade64ec0f93cbeb4d418588eab5ee3017ca6667f4f7892b8e00bd9a5af0e

SHA512
1789bd42cd48020388a77448bfaefe5ad2a973491b6b0bdb78375cdf5af79242d11328e320c98f07b29097f4c1cd31efc989641f1011b6e5b0a87da57677d8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar327C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit