e0fa08a1c107aa0970b825768866125503060bf684d8d97d12b1cc2520f39c18

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40ee8bd94693484b27c2dc3796da8946.html
Size

39KB
MD5

40ee8bd94693484b27c2dc3796da8946
SHA1

75d284baaef29b336e2cd8402309728b667ce847
SHA256

e0fa08a1c107aa0970b825768866125503060bf684d8d97d12b1cc2520f39c18
SHA512

9465757853e86d8e1a5c47d38aadfd6402c19545d60ea7daddb283850238d2e32572639b5b54ef01e438fda8c18d0bd713564c6eef3350ad34e05c4ace977342
SSDEEP

768:bxkf4ldxnhkFpDceMGUsQbyyi7oIaGe0dV+CUEr:dkf4lznhupDcUQbyyi7oIaGe0dUCUEr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21868E31-AB03-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e7aeac9a081ccf43d5bc5d5e9e575a5484275920613a37c55ca8481d226405e6000000000e8000000002000020000000aec62b18c9d508caf40949c7bcb2078ac076d03918c5a37fb274d1ce88e7086e9000000050d06353f7c42bc8069f4aa4ee9f4047971b5e4f9273670e5d38212f1bd1d82d48138805e7607770b8e514cc438b189b319531d8be1b8d49427ff0f0cb348b52915a09cff7d54eea0fa538a18e9904fe3a9f1a3c0d59ef2f6202825d47617be9ee091cb0b1ccbdef5cdbf1f556e381b87c1d20c822b5545e56b786eaf72f3bd2ce779d2cea3ba1571c6cd324266a6313400000006f0e237ab0e46812250ce89aaf2d62e6afa7be69a33144650117cc812540d882568712f5b9b13f0b4130bdb87e45ba5c1d95ad6b05f085aca347281eb7dc3240	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004cae5598280ebaa92f0aa008934509e41d0b65b90e11386a11b54b48546fd341000000000e80000000020000200000002cb4cfb26e39c042e0fa186bc77389be7cc1b1a07df04411834a67a75124fe0020000000f94f863cfa63891e8a2a330d14eff3b7738fd28173f84c10f6eee581a9683c30400000004187be7193708c9a157385aebd63e20091f41185b622e0734f33173af98a0e292d8915104274558579c666d2ea4e7bb4c8d62d2f55e18c330e91786590316efa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03852fb0f3fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410535920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2704	2456	iexplore.exe	28
PID 2456 wrote to memory of 2704	2456	iexplore.exe	28
PID 2456 wrote to memory of 2704	2456	iexplore.exe	28
PID 2456 wrote to memory of 2704	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40ee8bd94693484b27c2dc3796da8946.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcba57a3c17f72ef33b2faee9793f2fb

SHA1
e52db58ef89fa57e168eea70c51d2ca760616929

SHA256
72c4ac4dbdd31dfe770dd1d2ccf8c0dd0b1f97087561fad76726aa79b68f28a4

SHA512
d00bcd6836bbc32adc9566df45a6da23e2f816ec122a020dfdbd27ed8665739f677454e22ef2443c39f08754d6903c040e2fe007f17e6728b03d919bd055a342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1687878660c8a5149ff9270704544f06

SHA1
0ac09646456395e2ed60b0520a27dddef8a3f292

SHA256
3b3e54879f365a7fb47e8fd38aecbe53faa356dcbf517326cd3d04e8bb520944

SHA512
90eef5d3088e9c1cebf5baf8d0846302bec2df1cb89f3dff833395272bfa9e15dd7a01e2a4a235f8abc270d5e7a72d63a9f40e88a13e5acd2f9e293c27577b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c9a706a984d7120bf6caa1c1e3c5a6

SHA1
13c7abec7c178d660c198c8d874e61773d83e315

SHA256
409cb234cfb89cfffe7ef19fb20f5f5b03370dafe7f99866ffcd52e7da739d9a

SHA512
e4de192d1f57cfe819c6b357224c0d23eb7adaf9742631c25a75df3cea530c3b513612ae1209f1d24541e6a44890ffd8702a1ced75277edc97715f87409e8793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ddb059a08e2863570d08ac5f4e14bd8

SHA1
e5d7725faa2cd7c455306d0cce401cf8c386c42c

SHA256
68ca27426f9098d1089d362e3bfbc76bdb4fe14818ebd42d20a5c488f8e5c4e9

SHA512
7beba9919239525338aff3d9e642469341c7f256643f0b7d6b5bdd753b41ddfdc13c73fb1c79a7b3e8791a0076ca300fff8701be50322b1c2678201947bcc191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ba8065eff5ee69ee6e4d703fc0c587

SHA1
f6667833ceb45664a6611d863443ccd2b22ea42e

SHA256
e5afe4847ed798bed5ccf10187d01ff4b68494ce39a40810a0547657292b1744

SHA512
a7c688ac3e24285a295999790239a55e90c896d1ccb6b721694364baaee5c6a03ab20b8fa8031b79d3359d47df4de8e2c2da71e87f5448512f2b361c5b0d5947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537d509a2ab9168be615be86c96f0ff7

SHA1
eb1622528a64c8a560a804427ba92606b4d5bb83

SHA256
76c7ee9c8fc98561346ff4587870a25a9258cfff3baae5fecd2c140e59bbb759

SHA512
c58381e80a4fa2c18bf9bbac2a1216ac663e92104c497bf40bad0a65bcc72149b06722c8ce647b74829ed984b1b2ec942f3c65cafbda46fe1bb8009017ad80ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89FC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit