259e1a39cd92372fa101ca89db61784dc606132834d328054587f322f2361ed7

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4051cf5db05a55bad89b7d4ea6398837.html
Size

44KB
MD5

4051cf5db05a55bad89b7d4ea6398837
SHA1

52e1d4ec7d0098f61bb6d4744de2562000079d76
SHA256

259e1a39cd92372fa101ca89db61784dc606132834d328054587f322f2361ed7
SHA512

14a1919cfe6c4424b3fedd565641ddae305eb418760847b82a50d8364a468c5ef4251d5458f47987432e257697e4fc043adaa0d1610942128991f053fa38082f
SSDEEP

384:3BbOBn4B4RuK8eEevNKTnusiA6XDXrt3WHBauz9l:3tOWK3fvNKCA6XDXxWEuz9l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007c463d928605b6cf18791002fab0cf9f84ef309df98cd750744270396d3356da000000000e800000000200002000000041ed27f6a7a004565666eb5262896b0d3e72d1ae519868d88f5ef59b29153e55200000008f16550517b972a4f62d565b096854b3645c9df973e49649d25ac47ab1faac7740000000d7cdd7034579816a867cb28fc37a8820f543efb4159cf021d2588239f73f46849d3f41598ea91b8da3af0207e6571e407c91c716e3fd6fad68e58ff666212945	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f099c0fce33eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27943921-AAD7-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410517027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000dc4a4471727ffd5e12b23d6d13879d1af648bb7152d68eeb03f0e4406e9aea2c000000000e800000000200002000000029b01edf9096172617aad060c1a9048310f585125222212289021e2835d98ab090000000e2abe5ae3f452bc85a72d4db48d529b762ada8a2570c7875d810297967101174059b06d7fb647405b4f2712e2f02fc137c5bf0c174aebc1e8b6521b98e648af33f88610afce9d9b108ef7bbdca838c8d0c5603af352db624fcb11946c6abf587827941839be3ac154df48f0f4a814811e563b37efca3671cb3efae08ad184c2a6fc8f991ee07d65aee80b105590043a640000000a7fa4fe85a77a26d3d9e7be45a95cf48fa3635dc6da200907f81583fa87dfa25a0525ba01ee58f21fe4edc736f9474d15de69d01ece11e072136530c37a4ca61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1616	iexplore.exe
1616	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2128	1616	iexplore.exe	16
PID 1616 wrote to memory of 2128	1616	iexplore.exe	16
PID 1616 wrote to memory of 2128	1616	iexplore.exe	16
PID 1616 wrote to memory of 2128	1616	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4051cf5db05a55bad89b7d4ea6398837.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8211e4b88a6361b24e55907054a15449

SHA1
9fbb2abc770b42117aa7b14e345ef18a5e4fe897

SHA256
55b6c36b95bd652801b50203c029ae5781a4bac556d296a508a055c9b8574b4d

SHA512
11bb44163b66b9c09af18c5398c1d95fe2afcb263d65e2529094b6e4233794badc421326423152c15532f7f04eadc9d319a4e2c3167af9dd8560114919180340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9c6233bde759130802e9dd696f65099

SHA1
f25f5cc022a20cbffb3346be8297b569a961a531

SHA256
3efc6af319c8aba6c0c4b40eb18a26afbcdc7eca87afc87ad1b47e4d20d2b191

SHA512
9ad1cc74beba61f05cfb9dfe5d3721c7f7a9cc17213e0269bb492d1e8beae389ce61ac9650c1bcd974affd091ed07b03fc46544364f33cf3a020eafe1af2aaad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a87db4d034b6150cc7293379584f3d59

SHA1
e9ecec20d3d56974eb57931a41914b4643b41b49

SHA256
50ec711461a6808bc58351ccd6d2dcf5745c91f30a1a98151685c0630f30e4e5

SHA512
c464f58301620d5c495e8c73c62b992c6bd7f8e669e8f49388e543f73895968e171a7e96544074edbb9e748fdf39a3ae5b6a9d7a585240be53f8d3a876d12040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b389a484329f0481004bd0b1b7dc8fcc

SHA1
c02c8f4b5f028f3d7449a60af9012c601bc1c364

SHA256
cec03cd6f1b97355e69ebbe349004631550dbc6571014dfe54ea2ec525dcd88b

SHA512
037482633238a8b371273ca31171c14355fe7c7c1d6da2fe924c204060a0944b9535dfec4eb1ac45b98bd2f3185d91a4c338d14207c271f12eba3e15b6967119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759559853d5ed285c46923bd91e0ee79

SHA1
4f7123eef4e823f971c4bd363b181825e3f811fb

SHA256
63ab5e48360f1a7b7d2052e5d7c45303f7cef574b0d333e9b225b487e19e82fc

SHA512
5aa4abd3f817df792c3451ff3f0d1ded83ff131d37ed2006527b8f4b1c342f79052376c97c2968e949bd0222e2fedc69c553d0d2a83066bc74cf605390f1b534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ad036b959e5b2e02379815e6af5ef5

SHA1
e49a8eed20af1ced3d7665e60a440255e235f1c3

SHA256
6a71615667d2567a1fe9ab79ae1bab72bd713cba2382666e1042b0da0104e634

SHA512
20fb3c13defdb29cfb272fe830ad89632522aff0ba26ddadc3be07392c820c0b402622d9b127111d2e33057b9997fe671b79f97b78a1c4105dd9ab508539b696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd05e523bbc44f0ac792c9e706e698d9

SHA1
b373767fd2959d771d4822fddd6c13fb1621a589

SHA256
b2f2708d96e2e7af4e50e83cce56ac2ee355d753c4d01fb20634a66808bf36a8

SHA512
ccf08304738d218b46de4b72086dde5de842fe9282991cd512da302ed84969ec6d62a4054dc0bcd5919f5298a48e59dcfe7c9f7ee6ec7c40b6e8c19c086d6a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
671c584ec7e3923559b65f149dcea2d3

SHA1
8dc9edf35a2e2fb34889bd4ff5da2e310f4bd15c

SHA256
7619ae8cdc604e2679c80f86a107da4e52f010b5aab2d335f711cf84b5272be4

SHA512
079136d231792d3ded7554830f51e6d46c3052fd8ce94320a3db2c593540358734b51b0e1ea20c54cb128e12c1ac27c58366cc8db844e8b43b024406de409773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a06583b4c263bc699f6a75b14a13ea57

SHA1
5df1ee28cbd3a6d203189c40a2fb41cf8f71c288

SHA256
4189ab3e0d43c5eef193412ad86b579a3f8075b577f5d26416521d830ab22184

SHA512
de30237c3d94299ecb17967624b93e3bb019d7c90ed92e8df11d13c2e1e23a0a52c6fc8df1ddc444d79c3e64710344016088e1655d659beea8049fe808ab2e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f8f6b2d374621cda21a743c7aa1540

SHA1
7c9a00725c5d8185ce47c2fb459d77540ff5e2b3

SHA256
8ccb618ec0f460682954e140ec1db368d6d74a307b976f6cd800cfa362607d9a

SHA512
c87f8fa241059c86a2bfeb5dc5c0020f26b6399bb0f50d81ecca9440d5061a4bbf94366616ea3e0a15bf766efd81195217136476762eae10812007eb968ab354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a8c95a8f73eaaad1fd3c105d78c439

SHA1
15c1110ac20aae1c205afac92162015143245932

SHA256
a288a461abfb076b23832879d10c476a1393a6b0ec19d36f3e2b80ae19d59b4b

SHA512
5033ae0d685bd59ed688ebd31406d9159966508957e8528c9f48b3e06abd35952dd18fbb37b2294ea2e674d2e08451307d3c66311986675d69cd3dda1b561977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebe27069e069b98c3ba19a34b666a1b4

SHA1
19fdc46b108840f532b53a46e361126661ddc4d6

SHA256
f6333087f5e6ec18e60bff0a7e1ec95cbdda029dbfd3b1d3e82d3653d7b794e7

SHA512
f57dc6806f41c225f3d051a8a4e6168e6532ef9892ec412a6a16013828144b69fcb09fcc04927030b959effac755b9e7fff4085260cf998c1d80e48c57fa112c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
184d7e6918f86804336d283536e2ec8b

SHA1
0de7e2d02adc46d3a290819be59bfa0ed1e5d98c

SHA256
8f36eeb126e42b78244b278a9850c19009252fbe1a2aa1395cdbd43fea79c7d3

SHA512
4e0e20681c354bba95c4d9773ac5534fb102707a763fd195dad6768a72357701901b46231202b8d892ee77844babd9998e7a4cf6a549ec2ab50d17d13d48e29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f1bbec474e526ed51bbe9e4d3440fd

SHA1
3ecfa6981ae0c6f988343bb159a4d210d9b73ad8

SHA256
6cf2f37288cb06206aa09421c880411013632a3f37cce028d683a511bc8759fd

SHA512
e482b2efd89253bc3270617a9fb8c8ca260723c12ea5dce8e7d48d35969b38352d8d8afb463e711b23c286cc7bc9815430d34b0917e01cb83b3946a26ac4c063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61E4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit