6755561366487edaed65587e11baa90d027a2e7ae3582fc52902d8b69555d199

Analysis

max time kernel
144s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41f5510bed722b18e14e1c75bf8ef227.html
Size

36KB
MD5

41f5510bed722b18e14e1c75bf8ef227
SHA1

0e71a8f2d31c78308faac487de92651565a26e3a
SHA256

6755561366487edaed65587e11baa90d027a2e7ae3582fc52902d8b69555d199
SHA512

11ea97adb2efe3f0f5d0304fb31930f5f9f317f5c5c9a6b90400095257215eb689b9a74c8352ac16a6a4e8c11139c748a7e3830c7c9a382dd5ab3c2ec2ead43d
SSDEEP

768:EE5Zn6f3+ey8h5dc1dPuCZHhAK7TA8DJuD0Xl2dhM0jOnZCjCF2SPyl:EE5tiy8h5dzU2KbDQHjinZCjCil

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000046871ea24360dc708c562b8df298013eda4a0ea8f60589256fd3aa4d27da2866000000000e800000000200002000000061e3bce66db5e5a9b7fc2dbca458030aefb4b0e2e156115893758f96f97d2a5b90000000f849cd3865888dd066f8785abf53f21002d3e206b8d0787d63f3f5cc06137fef93eaedd3e08656e1e6751b6477d526d628840dca41f0ecede92c9fe7a4c641708052d528b4cabaf53e38c6ec45d52d34766ab4d67c3ed1ddb5c083fc23ddd88ef208245d679f8a8c3c11916aca7973e80bb85391e867a6213e060e3bed317d16abfee44592ec84fd0f26eff6ffadf4a84000000069aec077a6af37298f42cc802db1f5ba7bf43d51f99f5c153a00da76d35ab3bc8e9b31d409dcf747ad8adff9ef045f3758ee794f0926abdfa6e701364f30f91c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F3CA9A1-AB48-11EE-8E99-56B3956C75C7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410565767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000086782b65654762aa9f23ccc6ff9994eb7aaa433a3ecc52af9a5896f0ade15401000000000e8000000002000020000000e8b024b187fd65c43bf74459460912d3ad80d90df4db60c3779008d37db45db3200000006e4a5cec1bf431f05ad92d64f704f30c21f1070d4044784673e1120d5fe1f12d40000000b71cebe8909e9bf56fce90ded00031af8f6ef3034cf562532ce6008882d053f15cb131110c281587e41dc7fff2c27be8c1ac88c60ffccf9c6c137d54414d2e55	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d37574553fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2248	2080	iexplore.exe	28
PID 2080 wrote to memory of 2248	2080	iexplore.exe	28
PID 2080 wrote to memory of 2248	2080	iexplore.exe	28
PID 2080 wrote to memory of 2248	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41f5510bed722b18e14e1c75bf8ef227.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1d0c58b9598f329620fc4e72e12234fa

SHA1
99cf995def589abf01fe2829a03eda1f11985db0

SHA256
a20efe64a2e8b208ec375a8a674e2bd5cbf16c775a80bdf5cbeb13490974a399

SHA512
b0f19bb4ab81384c38ce8740024fd29a4d921809d6cfde54424176d6df035300ce6fb3434727b5244dae20dc78999546d7d5d194ddc9334947f7746f2f4930bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
20f6e3ad43d325f9e380d1602b23f1b4

SHA1
eaccb112be0c6b13a7d95dce0d19f743b082f3ce

SHA256
e622ed7d0ffb6459442d27213cfabf66741b9f4ba85238549b29f317ce46b35a

SHA512
e58cde5e906d9813dbc85c3e704280c62067132b722fb6c562d341eb427897209411794ad2340085d764b44000293c7ba702a3366841492598c9f2060561da1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa5761f836c6db4e0ce14547ebed7d6

SHA1
e438dfcb9dbe78a165deef246a82825f0c44a78b

SHA256
2d250eae7c818886f9abc6723cb7135a3217cfb49471c630bce3139d0805cba8

SHA512
40f786f1e3d003214584ab5d9d96c8665683bbd8506036d48b1888ef240eab061f0179c9780827f34261c686aa4384614217fc5c4cb7a8882a5d183f6e910518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d70524e1c0392f26e3ea4cceae41678

SHA1
a46bb2bf46fbb9c377530424cc20b02101451a0a

SHA256
61d616b824b41e4e8561c23562e7ca988f686e30d45e39b4d09f2cc15d001ca5

SHA512
7dbb4cf9767250a45cecb7194ba06a05857400b9a723ae2a9102e5c7ef907d47239c90b52549ee2b08325f9a95e9717ab2a62592314fd72efab8c2db74a84a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa40ee000cde36eeb5408dc1c9f3bdfc

SHA1
4e3257e5bf88b09e4c4736ebdbf5771c273c0f34

SHA256
ea1b86f38b5c508735d514a4fd5897fb3b9de63401b016d39aae80516e329058

SHA512
9ae066f61ed3ab2d4c9e45d90ac7d380b27363865c09d59099334db29bbedd910e1d1c94fb81c37aa60a7ef231737b718216dcfec7c68a3eb65472e2b113d5a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9b46f81393edcef267644398db4004

SHA1
ff3833b969d38b5ffbbd205f02146c8f03befe38

SHA256
b7bd187dc1c7f523954bdfc135ff7003bc0490fad951a1fba762629d5eb80d8e

SHA512
d4fe1593b13ef9c1a4aafdbb8a480dc40b460b7b912af2a6826dbdb3238254185c3d0467665847a7d7e405692f3564f06139bceb0068661f3c345318bc8a2b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d50e6c5e9ca1fda1889b817d16d32dd

SHA1
9e9ac87b2e47f71429e2ab1b039bec2a5a3209df

SHA256
7640c7d42b626941023bd2177c1dc2588ca4469966fd545a31bde8cbb8ebdfcd

SHA512
5c61790249e2e1dc69a53b89a5562aee5f26a870bc10e0feb61910d81f371434f34e32bdbc4b22470c9eac5180b29894ebfc25f1afbc083dee93cd949554d297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64c0a1b1dab2bbf44c5660455a61de78

SHA1
26cc0361d637fd266f5830eb639ed690c02af4b1

SHA256
588d9750c06b6f70fbc628ab7e81740afd0b4eadad431949cb852d4ff6632ba1

SHA512
1e02c67933c733d5c4c0ecb6bbb45ce0448cb1b165090a0507f06eac6664d885291908040ba0d0c913cff329f92f36e6a17ff2b8bf204ff74587375a56bb84ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c6fcd3aafb94668388af632cd9f23f5

SHA1
154402a03f6079a277f99f1c322c63fd9b6e6476

SHA256
0c712f1da87c2cc3f06858c02267415a6751a2dcd7e3cb9f9b0917ac69b58bf0

SHA512
fc187a61015aa438c0abf73a64c670324b460ea1c873debc18a2c8565cac4d274165858e097d3cec18d45aa52bac9008a82a6558f31a742467134bf31e1640c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9a3a3e09255ad43ab323db511e2f3b

SHA1
3d7adaa65afa7a0355420000b800c766c47d8196

SHA256
4bd39461635c67cbcfbadc381bb29412c6df9450f8738f87bdb4eb7898593460

SHA512
c513fa2ff0ff1b73a5ac4f63f326b448d050031708eda893399c5eb79a6fbec0a230a7bc518a31838b9560e28ecc7770ea51d8925a43dd6c213b346f2ac97aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197909941ef1102079fcc67d49ae24f5

SHA1
2285c2c5cf43cd1c4355813c40d2baff4d29646d

SHA256
8c4b68e4a8149f9b1f16d5c830dfdaf19e2d57331fe26061491f7faad6e98538

SHA512
f3e9dd401cf313e313e9f00fb9b04b2bac8cc9666eab7698c7a068aaf99d212e57c5f2c8a9ab09ce958f6e9eb5b811823e45001809f33fa0821ed06c200f1a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3785.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3798.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit