a699116bd3391ad8e4315fb57b84c89757525750d5a876549ed17a4a46b4eca6

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40aac4cb4ad459d1c403b32befa45410.html
Size

1KB
MD5

40aac4cb4ad459d1c403b32befa45410
SHA1

89c86259253696422fbe38e090860f96771288aa
SHA256

a699116bd3391ad8e4315fb57b84c89757525750d5a876549ed17a4a46b4eca6
SHA512

e7f64f2b4eb09dad4f578c3c621a6672b433f7c77b531fba0d91151734862a750847c982112b88f0833d5d395e62f58b691b16486972b297b26f78ee575b3c2b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0308f26fc3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50D59B91-AAEF-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410527403"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000255c5bbd9ade68f26f2b77c12bafcb5b911aa53881a82a803eac23d22215a367000000000e800000000200002000000062fa43e06b4b29c56a99cc6ec2fce3998075a96202b73b8e3bbd8438bba4cafb2000000032f02e2a4b15c76838a780f2c88a960cab186bd69446c67522612aeac2ddcf2340000000d91a05187a075376eea32d02eb546c840ed70ccb2b7276c9a4c162ee36af8238de2c48dbf9d8ca53bc6931a85dbe04f1b9125733d01f0b75b4c8e462cf0cfcd7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000662301e4f8d5f89d02c960129ce200d52e776c406a5f83be71aef3a9bbc3d056000000000e80000000020000200000003069996a2fe3d7e628d9757182b23b5430259246ec1c176d2b4fac3593abb114900000007fafcc38daa7b20caf1827871140dc903f6c1298c2f82fb095ab6ce1225c6f5382a215619505e18517359d56b40b704f191fc63732b9738a0221b28ddc14ff366a64b9f774f5ebac897f0b3a06cc046f8924c02dc2a033e870584956b77d61330313f1bf042d78011fe1a2cfda799210bb785e43d5bed369b7af8a852a2cf8e73b0c18114f810d0f6c8eea4e372e876640000000a7390ddc478a1ea89e72adf8bc9167026e7ad84aff5a2fcd9400b6a61b49ee59a95bdc616e2db56663a92c8f7f5ba43b0a7f8eb77b81681c8d33609bff98bd63	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28
PID 3012 wrote to memory of 2788	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40aac4cb4ad459d1c403b32befa45410.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b2040a7a1af586b68d1af84c300518

SHA1
b752e1e1635f4b3919f4a1d78e44e553ca24665f

SHA256
b4ccbe0943f852110833adf5c094f6f1c4125af9ff23d3c041819ec50f8b2529

SHA512
548d6f2902583bb8f1a98153a5f85c7a4d5582c4e18819c4a3b7e955e935dac89119ee311b9398ff33c8ffc9e097bf17689f4d2c89d70fecbc93d574f3accddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb635eb0a645eb39a9dd91061d6422c

SHA1
36ac0ca46b906f8fd92473dfa970c08ba1f7fa0a

SHA256
bc8ebe32414a4fea58dd94b2ca7a223f15323793c85be220dbba069fb117dfad

SHA512
13bf18b8b8f87853fa5ae833ebae9ff36dafd0f5b620d14a9aa3ae71d9c7f614345b2c8dea5406ad2d4acec2d6d08e335e6230a76f0a0ec6d09ca6b582b0d346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
686cffc8c1e9df7658acbb70dbf869ef

SHA1
705b63dc916393ec50d4a113471afb8a775283a2

SHA256
684563e0460c6495626020b05ae1f2722c24914922b9c062db5abba4ae171f25

SHA512
08d5f19a353309c97cedfe89c56596ebbd6d87adb8957bb4862bae02da60cf1880de6c53257820402f825bae262e43a067b227727ebbbbdba46f6335935d3271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c272b5bcf8983b4b5f0826f0c7af7d7a

SHA1
66cf3e22c944c91b9f94529afde340f84977a70d

SHA256
8b160967a8d5beaf6f239a66578c1d3b2351081f6ae7ff072389dab9a7881406

SHA512
da79eec647cfdc107b196986ea6a050ff072aebb6d57c38307af342bd2f908f14f0a423806d97adfb8136c20f34dd5d65a633fcc86921ae1dd41e2efbc759815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7b5e3bcf89f0c6dfbdce1a3669f2d3

SHA1
2761b0a9f057ad2d79fe4f684479ad018954d743

SHA256
943657ef893d5b77094cb1511e4c628688a7b9a80646fcfe186272d7ae863d29

SHA512
00608f9ea39a89cbfc51cbbbfab9045455f2ed7f36b5a7770598b60b46802dea0f5e19aec82a7b48ec01a169e948aecb916517fe642e8f90d0d3867d62770e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
501db3665ce003220121471d133038ba

SHA1
4901b429df5223785f27f63a407e624e26414d4a

SHA256
803aabf60b30eda90da6a4954e805ccf22b09af87acd7b872b2604cd9e8add99

SHA512
cf254a93b3801da86e310dd027e7de797d1feaf3eee83d6db69f6ebb86ab77594cfd564741b8aaad4fe7be14efe10c7c7eec91e83351461468f3296c4753426c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6994c473f9ee0b46cc4b51fb9e3ec44e

SHA1
ef4ed398afae54c3744ea8f8c9970e90403945da

SHA256
83b9a0d0286b1b275db68c46622be269d7698c693746a310e30bcf8617589f87

SHA512
7b4ca9241326f86869a2c32071a9283eb676ad75b04fca764801a73ca869511b7914f4e4141e184cdbda2524d4f194151532ddc9ed59bc4bdb807e2dea1038dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4a20eec186b71762d1e0ba8faa662f2

SHA1
052265f4ad95ada8b7e9242b7435e5157ae46ffd

SHA256
273f8114e50266efdfacd293f386ab19b065c94970be90288e4325907e10a860

SHA512
658c9bead70fc02990b95375c4e8fad50b4ea8e55ab3ee9c5a0b53f028483bd9bc0bc5df6854eaa306f48cc81f21936c766234521f05b8ce9db621cdf3ebb3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96B7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9821.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit