b796cf5d0a8d9f0bdfeefad98a849ee888ee4df5c719f92172221e9bf77ef496

Analysis

max time kernel
13s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

421635dfe9ab8ed97a8e0e9dd631b9dc.html
Size

4KB
MD5

421635dfe9ab8ed97a8e0e9dd631b9dc
SHA1

9627bd7cf1c931d8513c8657fd61d3466b40adcf
SHA256

b796cf5d0a8d9f0bdfeefad98a849ee888ee4df5c719f92172221e9bf77ef496
SHA512

19500da88a833dbae44b922940081547422133690e9b1209edb62f76e65d10caf282c097332691db1b987af573887f0f1e7fbef7016897fc699321ef8419438b
SSDEEP

96:E2xCP3wzqb7bfCeouSgHdW0yssSTDSZY9CQCdddddddddBMcZia81X0ZnT7LxBKu:E2sP3wzqJouSgH00MSTDSZYVUIaY8jxh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B80C0C11-AB51-11EE-8221-D669B05BD432} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2704	3024	iexplore.exe	21
PID 3024 wrote to memory of 2704	3024	iexplore.exe	21
PID 3024 wrote to memory of 2704	3024	iexplore.exe	21
PID 3024 wrote to memory of 2704	3024	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\421635dfe9ab8ed97a8e0e9dd631b9dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
70b6d9afee318591127008e7525136c1

SHA1
fc732b5ac067f9ed4380c997016210867aa36adb

SHA256
62a8c215075261830aa75bccf617e10aea959289ee07f84576699f681b0b55f7

SHA512
7fd369def6812568bb0f78cfd9e14098eefa852feb3f94dee50dd1b6c05e5b0828acd2b60a17ba5e9d861fda7b39fb7c345af23f1aa6608c6c389b1ab405fc12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58927f6ee5168bdc3fc255b886f9f63

SHA1
24f9fbd2206d491d12436dc5cd73d86c6224ea2c

SHA256
c04b5e45ae2234191ed5059e3e91991090ba38f37235b2238210db2f1fc28f9d

SHA512
7442310990c48676908d789aa22534a069108718bf61f96088c414b43d9241028609cec8376a4039340b94946f37772e2af3d9ae2a43f8cb4ec5f1c9f2da1a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3347ce8bb887bd8a7944dd85bbda8fb3

SHA1
8149ec95506a3aab4241ab675eebe122272dae74

SHA256
1d1e6dcb6cdc7df710938b01ebfc8594b49edd7fa54887dd200dc463dad6b79b

SHA512
10bea289474f08f300742b21e43d438dd8e979aa0939f7da049c458d76f4433f2e82068e56a97d6047651fef69bb0f57e26f4640355f0b3fac6202aac3c325f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f8331a9a2034fa57df78c6175f75e1

SHA1
2dc3a1d2bc1845eb3f54274445fb22ab9ec4f664

SHA256
0b7f46f0d573281507227d362b87e4b8377d038383f1785b21868ba49a1e4d84

SHA512
fb42271610634e0f759662cd1c3329cea5105341acd9281c34ae44bcd88d680b51c685347e08e5153656122e72b3b77b956bf78500d585a1f955835d5f732ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c5d33c5be31b50d199da654990f305

SHA1
7b5b5afed9b0c06784b6e9677886080edd03e40c

SHA256
7c25292eaa90938e7b33ac3b53e1c2553406b800c0969e3482c88cd4c0aa9034

SHA512
ae3ddf65b83d8ff8d694d03c8673329dde06f6cfcf819e3d0864780cccd21aacfe2926357471f0d7422638f64338c1d67edec6394148bb07fafdabb9ff016eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22aa7a319b78cf14d6b0aa9cc048f6eb

SHA1
5575d45b18eceda254dd5fb284304996b9df6137

SHA256
4c788d39458be69cb6b0a9c2cbb4c5568da86f3851e437b1c6bf434a57343683

SHA512
b737b4ee03e72702e0ed4c5ddfa0e571affd1743c9ca142c326e55c696189a7ab0461924001a6ed935c733870d978d6f5c4fcd06e776326e8e1fe62a72fa5caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbbbda9f087b57fb2c2d6dcd9e3d996f

SHA1
2aa0228ab404c7d674df3c1e9a11e3ae70785d7d

SHA256
d4277ddaeaad47d6ae1086a701c0378e0d14b4714066e8b82ae166c70fdd2540

SHA512
1c3b5804a350ffb21885f5007984954eda26ede5a4d952bb39348b3ea3276d0c94ca687ac35c24a6698bd40331974c8c7ee09959f5f1a75d053655e9f875ff47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d08a8cbe1a27ff23e9ba28faf90e73

SHA1
c7454ee7d6ec6ffee8f880c74245ed49416868db

SHA256
35e6e22aec75d01e065dce7a74eecc495de2a12737f77950b784f917d4b61d9a

SHA512
895aa9cfd1ff1cf3cc9de075e805030c4d9f18583a4ad591cf9803681d7d3ae823a13dd59a5bc71a7ba91f71e848d233317578b1d7bc215f61536175a8187e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a66a8f36ece693fd2d055b291e63ea

SHA1
50ba19507943ac880959df03f7445b009ea41bbf

SHA256
c8e2d3a349d5a4f00d74a0b501c9893ce27528a976d988e7106c111c689d49a7

SHA512
2d9221b163f09eea450d70e7f70f6338218b408e1fb987e228ec81a78390ea788f309334faf7201c661d450fd5e2df2ebeb97b18cc3136de95091e8c3b1212c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca89fe3395fdbe7997a083b247e62d91

SHA1
b672c91c756770dd2691d848862224fb2d39b177

SHA256
026db23ff1ebfcabf3781c9f96d3869211997cf3196d0857de27e88d4b5ecd71

SHA512
73c29466fcaa2f3da280db0b1cef01e501e4487aaa436ec48bba9c414a9beeeebe1e42b12a7df6d3a0c4a9b8bab74d88c0293b6bfde79d3b9263e395c9d74fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bfd062b9b016188a88f5944f2658e24

SHA1
75dfe9ba81ef2b99433ca019aa3474b0e485daf6

SHA256
a27c70ab5add5d88f4868b9d2efe05129ba76bdf72847bd5cf2b44c4b5d6270a

SHA512
a5b6b188a7aa888375170ef8fc0630c1151f5716484b0283c1dc8a32c50c575a070fcc99727b83ef614ceea2f83e3a8793abbefefbb15ae553eba951bc4919de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c9ddc1783f2cf70b5e54d98880be799

SHA1
6729e75ccbe07335541d16b62608a063e7c5b550

SHA256
993cd6af79d284f9c9d6be6c615e306031d1a5ac17e3e67212e10e5f65fd1499

SHA512
b7ef720542eb8739bd94392253fd282ee3601bd9b716ccdbd69756a69c9bb3b53e83fb79f4461813bcb6435da189d98cff1d4b6c07815a86cd125739ba1413a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9061edaa293db80b89afb0ac47c72c6b

SHA1
6a6dc932dad81a1e39a3c7e31392715ac428488b

SHA256
f205628d525f6643d3843f28a854b87dac7c86ddbe4e7408938bd9c315338ac8

SHA512
37f79ede8abbc620e02354aaef06f629cfc6d2c711007827a1b579fbcf5ff7859c2d2e2c148c8a1c4f53215018b8a2fd8ef29c998ec03f8d2d4f18313f038bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BC7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit