dfb3e7269fa3f635affa63fc01eee6ed4b323ec42871688fb7ccb98c07eff239

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40919718c9e62608f22b95b8d51c5c10.html
Size

23KB
MD5

40919718c9e62608f22b95b8d51c5c10
SHA1

45ce064759cccaf57042771b8971a83945f9d56f
SHA256

dfb3e7269fa3f635affa63fc01eee6ed4b323ec42871688fb7ccb98c07eff239
SHA512

f9d866299954a4def5081bdc713986304cea9d4d6eff9d18ed3babeb31ec991b0afb35dee08a3d22f25c951302ed3af1cf7c5bf59ca785ef121bfd4b2976daf8
SSDEEP

384:LnA4ywTj6pNEegztvukeKXXTu8wVLPAZMKL24UTpNyOcn8tvG5nTDuU5esT8a:r19jLtWkek3O73Kc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000eb1df27b9d9142af01cffd93f9f3b496d1fe7dbf91b75aa37758f5bc4f68bbbf000000000e80000000020000200000002a51102054b3b539114a82e31de94dae64a12b9101519ed23ae7e8512a0235719000000098237773d83a409aaa1263318ec50ca670f8a9167ea96c1e0f7b50e09741ae099b655143e2834766dd7cbc84d3efa9b7e8bc72cc48147708cc6482969f11fc71141e02d68a1413bab475bfec5bde28d0900bf2ed339197d6f9886386b65cb2bfe70c9578596c3c955be646bc76122bdcbd33d0230ca0a877fe86aaacd8b87944c25f0feede9f06d1545297f7a6ebc6fb400000009620cf8ad4bc9a7b89023580ef26f9cce52ce64b8325c009d4550d95ee12de7b4459cec89056c8d52f298fa645284e53f9053ea6a1fa37ffb4dd8c782c63b5e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cc1db2dd4efbd475169da4ddcf515518ee0ff50eb0ec0c1a423e0258e7f9a847000000000e8000000002000020000000f58bced41874f85a6a54f1471f23e491f55f6c5da4f060b5b7fe413df083947720000000295242fd2a117eb314f461c76ad69f13788e88b3b1d404fa7615d91b1c3befdf40000000dfabed90ad6d3df96e561f173e1ed03773757d96748fc0ad68d515eb95b2d6ff4d415d453b565df2c4a844e8e1f65865bfd6687457e28335361fbd1a38eae9c7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20297b94f53eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410524583"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF270C71-AAE8-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2780	3028	iexplore.exe	28
PID 3028 wrote to memory of 2780	3028	iexplore.exe	28
PID 3028 wrote to memory of 2780	3028	iexplore.exe	28
PID 3028 wrote to memory of 2780	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40919718c9e62608f22b95b8d51c5c10.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872be3d25aeb673b1d0b6c1133148804

SHA1
e00fa998ac093f7f2d918f7d0307bf961ded4ab3

SHA256
4e9f58088f7eff4573c6144f0417f40dab336c1808fb68cea1e9ad3f7e00031a

SHA512
89dc67a7caa993a40dc0a133c075220ce31fd5287c43c9e3cfee3a6b3ff9b1e005f29314d3267fd374d5d1203b004879dec77d0b8d4464c110916cdf41c5aa6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ebff7d0d3573d4fe760a8900c82cc7

SHA1
de526677e11c8c762a4923592193e694e988404d

SHA256
d50e1a0ef342ffdb3ff06347dbefd23768dc7c4adfc1f1823eb0c46418e37c7b

SHA512
f07796c712584aa62993b64c87212425e3b65a3326e22a07a471945e51c4b9c15374385885a6342098a41730d0bf84d2aa12a8ef76375134ff9fa1fe04fdea10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d40d978c84257195dfb0b14aefadca3

SHA1
ffe3cc5a92ffd4969c975e1f2a01cfa1c11dcc09

SHA256
12b2e318ed9d6e1eabfc1bda5484c94201c0be971a9fae71c7e9cb7284a51c12

SHA512
543bca9d00f8e85cf1bcc6ef296ffa2907fdfab12bef020e3136e6a9aad0626f144a581a235a2d1bd272e836ef9268cd036d53f70cab5a48f286bfd70396a41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a6b422a4944eba0f8002d2dd9b959c3

SHA1
72c018fa62a637a024b26068a3dcd72be3fbc2ff

SHA256
f6381ac9c7a0eefc8fe50eb7a032145010a1cc6e5f43e55f1bedc20d06034b53

SHA512
db43a67db3a77de63bb12bac3f279d88a93492557f37890edbc7944b99600acb0ec3c5827f68e3d254018fe3bedccbb5b326d77c81f09aeff6d4ea9e0e2dcec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c86425e88bf99f54a67eba43472e5e

SHA1
9141516903872928aaa0ab6659e91c532d4cef6b

SHA256
ff38b26d306245d9211079e6e7860178b2b4ed0e598c4f57f0be555fc7302eec

SHA512
e79c236ca30f345d3d0170b13f36a1303355c71a9c8519b1d5cd52a6c1d60255c35460f050ed5f7846b21a8404e51512308cb29c599c2b8d7cfccb613d991475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe4c60f32c14b70ee5875b1352660a4

SHA1
1d842c1e2792af33a9c8eb92a9c96c460e7bca70

SHA256
9fcaf8ffb5494327035e891136a41805739e2789245c35ed3e97b410f29eb6b4

SHA512
2d98cd97463e0ac7ae1b5359d00c265051ac46ad8e959e37af9b05c48f735bbbd10239f4716e42961192591a854339f70eddd3c71cfe3e357aa4dad721e06091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76907f6945239d5365bb8ee5cfac7291

SHA1
82ec22efab25733e052e586bd1ac8f3807e20fe2

SHA256
78076cbdc3cfe493dea2afbda2cb2b743b2af1c98dd3343f23a30322cb7e1012

SHA512
f1a4f0b32704ed502c89a6883f26a7f1f5b147bdcfb229e5a0b0e94a7bb35aaaaa26a2433f9faebf59c5fbf6294100de4835e4ee41c2a781204c8ee32dae559b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f20460c0a7177303439d8db89e8f990c

SHA1
b13bec8608f313a83d33b93896ed0dd291457355

SHA256
728131bd80425dc3cacca40092497ee9ac8efd37aaea45b5f62786868881d1a8

SHA512
96d4189055bddc3fa0a1cc4b7f3df923824f3ab7bff06594788eadf365d11bb4adec58b9a3f570ed0da63a407a46c6f032394317ead0beec214e350722a8ecda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d55e42a3616f7f6e4e7155024378cc1

SHA1
33cd52a222446b68da3101c6f3db2418f1270adb

SHA256
adaa531a4506a03554925266a2c6df8f4e5d1002d574e36132058e48e851c846

SHA512
f3a31b5125b9595aef90475feb96619c527c5f1edc13ae95b652a98cfbbde67cacb549063cf4a20d2594b1e40601659df338f42ce981b0214742e4db938f47fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0c05d48c7a74d86dd8346a909119e0

SHA1
5b868ea1c80f63e98ff4da05d799983101e9e1b8

SHA256
35abcc379ae896b96abfb6de21340aa7469b012f8735d962d8e21edbeb9e9803

SHA512
01cc2f1a5c7b63d0e33c1a10bb65c21cdc8ccda952aa68fe66d98dc8fdc558df4246d69aee12b9f34189dbb009c9ae8e29def4fac97682cd0597e1977ad6244d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F9E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8462.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit