7972cec783353a27b83e4d0a1898c987b56277ef2ad52a298006b4bbcfb37bd1

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4090ce1c403b65c6d8cf3f05c6839202.html
Size

1KB
MD5

4090ce1c403b65c6d8cf3f05c6839202
SHA1

3b92d402a76e65a78e8d3fe105c7905355639b9f
SHA256

7972cec783353a27b83e4d0a1898c987b56277ef2ad52a298006b4bbcfb37bd1
SHA512

5890be3dc5fdb6d49fa49ad7f52883aa0c36e8d35bdfd247916ae576997457cbe2176a083b186fc3b7d25873bbd46cdde5f8c100e46f1a2f4f03fb3207b25a95

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410524488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{880CF831-AAE8-11EE-A29D-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2196	2192	iexplore.exe	28
PID 2192 wrote to memory of 2196	2192	iexplore.exe	28
PID 2192 wrote to memory of 2196	2192	iexplore.exe	28
PID 2192 wrote to memory of 2196	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4090ce1c403b65c6d8cf3f05c6839202.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21640dc82c036184251bccb0dfa9533c

SHA1
a86d7437895c81fe0eed94fc0e03d0a25bef48fd

SHA256
7989c0e5b7dcf09f00e8fbd5db626c48da81da988bfd710148bae3e867e611e1

SHA512
1ef06e3c78392d5fe14c7bb0182c7908a42647eb46af78275a250a8b370334369d1782831527d9519d964e0d8b08b6166205cef92b3ac5badf18db6c262c068e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bfea9405e4b6716269c119da8ac0fd3

SHA1
26359dcda4c64b947859583cbb7f0928f63c74f3

SHA256
4888c5dbd0a53c1247410109c36093c4fd7c4901efcfea1100ca56771a8a6a65

SHA512
d3c8700a61a0fea71c68ee916c430c5084a1780eef6784048948de614fd4058111dbf3430cb7508e6ee4dd9ed61cb84f07c3dbe9e3a937ef27a689d7d7700510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7423a88e7b906e1fd54c1fde578f5968

SHA1
23fea0eb4f8f043952a388e59aee68e81017766d

SHA256
a8dee6108513891782dcdf3f29c6b53388c2a897b56fc44c82a50e830b70c066

SHA512
3f6c0438129b06534e6e326a19a7e2dc10177928c9b9d14084aa54cc0b4034af935b9362eaa55596fddf3cbfc1be9a85322f164cbf5ef4298ca1af5bf88d6ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e599314c1dadbe5c2cc04b47ddd9564d

SHA1
b8f7508c9e30bf758dc3645da3cc4739b10560dc

SHA256
f7d2a6a9706fffbcb7887e657ad174495451d6f663d5eef771fa84c5e34473c0

SHA512
2cf970b0582ff0220976efc90a78bd407eeb357589961b514d3007c829603015562d7f98152e115d7de3683e4efa9cc16bf1fbfcd951a62f29dc44fa39e606a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
146dc0c5cf44fbf3d1e22855f49665ae

SHA1
2efa4b7b6f2112c5b0ff5ec875baccd52cd571af

SHA256
a4d02ed7f593bf75924dbbab831b63599b5af013dc66216d683ae82cf773ea0a

SHA512
48da00bcf3b216d5c96637f0cfcdbff1a5109c794008ed61bd2a910baad234b9bfaf5710c99e5d6f58ecd60c923285bef00e3b955403b3e6f59f19ea100adb6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9a8de154dfb5d3284e2737f2ac19ec

SHA1
7d4e89dbf26563bd6ed2eaa8087c81f15e5b7131

SHA256
c8f870c58e485042528a0c09c042f21805a8875c4a0aae9fafa8f54d1f984f85

SHA512
512864fa4e9bd52f208910d0fc2c4bea8722378d5a9b6b3a017a07736afe18a9160134f2df8d7d8a63e600c7c4bdb14857b85be14f9c1858ea3ac46eaec59dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9469aaae2109478fa3d6185ec9486c2d

SHA1
5a1eedf1264c29c757934a04df762e928d03e4b9

SHA256
b67ba0d4e548dd9cf05bd8f1cdceddb974b3034216ee2321e874541252ed37b3

SHA512
0d4b22754ddda55b71060333450bc1c81d014dfd83510acef80bd131eae9dcba0152c8d24387020277404f0dd68c26701897c52b0b3a12e664fbee47ab637781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448c2ef8f986afef0c54614ca216043a

SHA1
dfb11e75b52d6367a53b6261e7494ed0e7062cb6

SHA256
aa53d5f317e022b0d939427601d492ae6bb779096ff226a0f36649259d7f2f09

SHA512
b761911f449beabf94339d0d303dce21dd4af29ef462caba67a2ec48e7ce4ceaee9a9241d36bcd16e24cf7a526149bb0dcf2040ca134248de7ffd6f677d68548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c96afb66cf7c4cb5c1ec6d524cf7bfb1

SHA1
1b52fcb937d7cc70c6fd43a6efa47c98721ed11f

SHA256
9ef06a9cffc7a66a3af8da4dc72dd62e35753ea2d5ea5c5f4e18dca06886ba25

SHA512
5d50a0d06b0a0e9b5250cde5adb1d41b32ee3d97c7ac864a9e5c96df0132ed93780557a268f388b843ff49a13193b3cc1e340e5149241621dd5be13e5a8c101b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DE2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E71.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit