a2898288b942252fdecc43555f6ebd05e6d3074978b5a17bee3ac4ab0c21650a

Analysis

max time kernel
117s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40329855aea97707b58f665412c2843f.html
Size

2KB
MD5

40329855aea97707b58f665412c2843f
SHA1

f8f31fb2d6d7e928a84d2e9028bdcf3efc5d1de9
SHA256

a2898288b942252fdecc43555f6ebd05e6d3074978b5a17bee3ac4ab0c21650a
SHA512

91755d62ae3c24105b976e83a10b67c1270306791125ecb9519537ed012d7fa1e081a3baff8d97798efc1ae2633fd477ac7769dbed6234a85e9a6a26c2f67f7b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000029cd149ef1d252d658bab93daa251abda0a322982cd4d22a2643cd316dcfc8b0000000000e8000000002000020000000f1be955e349068afa9ca6f989fd9810f027173fb041cb5e2ffe3cc59e5a5d0de900000003cb52a8282d919247792531a9975dc9a4e4f81d0c2329d47052773075d7ca1ef5269fb7f9924acf13525581ae90a096852c1fc78982f9aa63dd08536281e51c6ae88ad6055b41217c84b1ced795b9b297b58a9c8c42a86290e7eb38255dba14972de2e82a43171b9e40b65d930ef508cfdbc318707ba001e23962274a5c80b36dbb97a654bc41dd51f40c6f470c3a49e40000000416d1e1818296fd22f2c2ad96a2cebbbcc3e22d77d8bc937d4526e2993d126d8f046f230c4b0f2bae9f6b2e56577e5feca88636f5d0fe157eeb43b65b277ddce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410513479"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E509CE11-AACE-11EE-82E6-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b96ec1db3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cc590bb0fc47b96e15237861c9dee29c130ee6725ba6bc5a3193dd887d829a93000000000e8000000002000020000000a6873760d09484044c95ac257f89b7e0dc7c8032d917fde9ef06772c77681d3b2000000009aeed0c211f9412a34a14c7f470432bc9ef20b57349b4806d4f9d2555aadd1340000000c2e733a2137b1389fa51368b984d030f1c079b1ed1b93aff58ed8beb01b63f2f4b187e9bc0a878ecc9c1f29193271c340fb9be6cbf9acda2a3f5649f8cb5a638	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2728	2708	iexplore.exe	29
PID 2708 wrote to memory of 2728	2708	iexplore.exe	29
PID 2708 wrote to memory of 2728	2708	iexplore.exe	29
PID 2708 wrote to memory of 2728	2708	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40329855aea97707b58f665412c2843f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b047baeac076b714908fb700d41fee16

SHA1
5d6e1cc14510eae3825d1d65b32e2107b1609eb8

SHA256
cf1a7bf5f27df5c020ddf81d647fb170af86b7e2fa40acec75fdb15883b49761

SHA512
1a6ee996201db9bd936c20f0fe8cd2870e117076082c9c28610125dca26d958f82658cfed8c4bfb6c7242aa238d3e56287d491620eb2e04b63359efd3a6e4470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35fcf99a647a5ff0c1ef1b11ea4936b6

SHA1
a38246613544b3b2073bd90b685a36045a5925ff

SHA256
1ef2cd31648729eafeecc101aee2a0b4d6fd8d69c920036ec1e145d8447f4041

SHA512
630973290a43c5dbe0cb41cc5dbccaa87670b11fbec48a821403da27f58554d9681aaaa7d0f2fb3309f2663ef8922b6a8382f0df31e0feb56f7aa4078b850bdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e56ae9ff5fd2d52be64e2aa7332c960

SHA1
f4621400b0de098298f45fdee94b520adcb15164

SHA256
ca86fd6e3569acd50de7eb6615e753a8366cc1f4bda0f8c2b62ff58a94dbcac7

SHA512
a1c819cd071a6d2f2649d057867669515d546a34a6a42b6b97387c886668eb09db882e593e70b54d5208fef966d43774126284edfa6b687f4ccd265318252267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0fab9e4b9c761e7cfc0d129a177884

SHA1
52b29f7951ea44bd1d68758bf309e5567255e8d6

SHA256
29cfecfddfc1b9e8416a302f58fc3f85a26333fd8cb4b9d9606c5cdd6517c768

SHA512
b525fbef3b900e74b260a0080f010c220221d11bb86c85afc35fcb3acd8ffdeab364f82f201ab13d6de98f34269f07ced809eafdac899cc74bc8a99c3b719442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8655f99da582d823a99304ba36304aa0

SHA1
1ae27f95ddd03844912b730b8dfbd41359a4ac24

SHA256
eec1bb21b8fb802f1389228322b2194bdc23cfce44bf4b8e7b40bba94684d48a

SHA512
a734492c1f13eb4729338ebb3e46b1771b45c2811ecc52fc5ce318854f96cf4a1fd8c4e663cc8eacbce00056a14b36d8092699af03bbb03c19bc99a8e59300e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892eb786438d8c2622d905f4863c65be

SHA1
e26af76061eab1d48ceb196b34368bbd18fb5a09

SHA256
949a5a31125e41bcb41bd8e9bcc8e351276e676fcf88d557b58554d469ee4e0d

SHA512
b1c2b294756d47a8b27eadd8f672203c83adc3daffa804cc3ff482a080dc8cd6999bd2d136372520b7847b3f753300726d155c4ed46d9814791e8ea445e7c83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55f4c9ef695f4e163a0b64c8bf4be402

SHA1
1f7b3c1bd78fb141fc4b435f32e7a76b1e27e6c1

SHA256
946397dd47dd26c0915768575ae0c84dcd017d67ee9025258b174e34e8b058d7

SHA512
0611ea0347e9f19db140f67e11213dce443bbfdd5d27485fe55497b913dff1af368a3a6a09de9157194667062a6a500072b5893da903cee5b88a7649f3e1db41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f11bdb18fea13148023c85c00f0ca084

SHA1
dc7ab35013e52e3292a0f4b0e95e278102973049

SHA256
7ec26254b9cf850b23c3e6bd4535d572951a061aab1692e6061ad83a66e4a4b0

SHA512
1a4e1bb28bc9fa68aaeb9df268635e3e0ce82a6b50090702dbd59afaa2cc84406a3939e9791c7147ab38d177c77eb81950d297da3e59613c46f8032934c60d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c1429a2edc345a8fa8802fb269b99e

SHA1
f1267e44e7617bf04127fdc96d0ddfc5c2e9e292

SHA256
3e1835b8034d6a110dd3ea022428f4cffe01ac55484024208bb7a2178db06263

SHA512
f1ddee806e182692ad77d1bbb94f2de52715149f527413466d39106b03d6223a2c294a6053b0cd3380972349941a0912e6c49426ea34d39a26eda014cd3c6950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc6e9bae165771c310b407df97981ec

SHA1
b9071ee11b88db08dc86ac37c711bd3195596129

SHA256
dd990ffd261f3312d57baa0a56711ce8b6df116ed84b810ed4964f4634a174cc

SHA512
1ca4c0cf6c61f571849a531858a56e474a77dbd27634c335f5489f6b22ae57888b8680de6bf3f928c556e4282b380b96dc843259f3f6773b97dcaab51a2d7f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c52f614abcdf9f8898cb9c23ef75bd

SHA1
67f5c5f4de7554bdbb349038acf5d07ee9520621

SHA256
b98856902f12121e33f2b56a653dbe484aa3ab5f4313c7dbdf56bd1363926b33

SHA512
8f5b2e9f2754ce1009c83008c735b9c7943bfe461362c7f35ddcec988e4f2780d0d5d365b0bdaedb8d70a34374a9413806efb72d86aaca806dee08fcaa5de88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F9E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit