c942d4c2e7cfbea1d242d4fccf30db93d21d95a6ebdd64c89e04a2e364193250

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40e3d1a10753a87a82e797f2769d1a83.html
Size

4KB
MD5

40e3d1a10753a87a82e797f2769d1a83
SHA1

d436273bf343848e73bacc9bb5030f56503fd22b
SHA256

c942d4c2e7cfbea1d242d4fccf30db93d21d95a6ebdd64c89e04a2e364193250
SHA512

2bcd98232dd7a81f7c0606a0b36acfc1f4abc0d5333d420d1f2b6631b706c3d3305c378ea5926006c5f4147d51194614d0137d0a62aee095cbb9d6949a3ed3f5
SSDEEP

96:2avJRmele4bdaVzpRPk34000diFk3yzpEa4000Da4VnrVqVuU5:2avJRzLbdaVdF000diZdo000U

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000834b0778148bbd88739f9c71b83dfec020982e7b8e46006bd944c0da801acb78000000000e80000000020000200000009b5c788083b95edbcab8d08750d2ef881716126c868df546c4841159e5b4af1f2000000096c1b0bc81d3d90084ea1709c6af074ebded3922ac1013e790bd210e1be31dc04000000008d49a300f2fbc6c263e5dfb6ddd5602be107db9c928346399f65e4168095ba86540fc7d9cc7f1b1df287a3ba363659acc859701a9b02270423c67b2d04e46ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFA779B1-AAFE-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2075a8b40b3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008895811a9d6474cb456c447c2e76375af282d6c02bda78a4a9397c72014883fa000000000e80000000020000200000008fe296e971efd50d71b295ff7d8e2701226cab1140ec5c0e868fdbf6f81e64139000000029dd8b83c31a34880f84c69d770e66de8272b38c7c84baf4a9654fe6f90f5a3ff8b725ba2c235d02fc9aa9d6e1330749215c373e897422339a12251d5dee229b483467cb16e29a0a8fefd80858aa1f492eabd5777e82bc3770c4e95166b7a125d68950a4c4c9e1c83b6682699833939332d4f0d64828fc35c09fbbb8f2e512fb7d954b6f9fe8029a30bbd5cfc0d557db40000000075a7383556665867a0dac9576d5b9cb5db1185083ef3937565b25cc53223d68116d579f0647ae983dd6ead49b84ab4c4dc614f320b9a7330c950b679eed8c40	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410534084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2880	1720	iexplore.exe	28
PID 1720 wrote to memory of 2880	1720	iexplore.exe	28
PID 1720 wrote to memory of 2880	1720	iexplore.exe	28
PID 1720 wrote to memory of 2880	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40e3d1a10753a87a82e797f2769d1a83.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
068b96b53c235846de7e3e64be7711fd

SHA1
2098d07984dcbbec7d33f1167ae646fa5e04a442

SHA256
7ee5cc314deeb30506c1caea76bd9245498b4569904e028af26075bef8026164

SHA512
30fb44af1959f759998c7212fb23aad9351d210e3a5705c9c4e2b7c7b7d71cced86d5c55ba61083b544299ad5fbeb5f393b1c9c654507528ce9cbf0d4680b3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581555ff5f54e719161e449490f775f4

SHA1
218c7ce105480e4c8fe9e9a510bccc36a17ea0ec

SHA256
2d9cf19065364730b0e0bd2ea3385d75e2214c754d34030d00b73c6f2adb249b

SHA512
081706264ad745dd938b46d5bfa02a9270b81ebb8d1a80a64e995536e30ef3a7fe366ef529fbb06c0da444d6054cf7fbe1e4d4393afaa6bd5d8bdcad2f618477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c044275a7a374554cba0ba82ad4eb630

SHA1
5a3839d791a3e9e925a6c13c07b0f4d69b4aa7c5

SHA256
d0b3439b003280d28b3b1d2cb719dd4dbbbf3b3d2a451016a31f023d645fa486

SHA512
8d915e1a86c4d691c1ecc94f52a187834e19a24abf268634ff7967120e4b6eeaa14037cae189c49cd8942872708e5818b1a12d566f623e3a78e22c6d85517e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59897810a2861b8f33c15fe9a39ee40c

SHA1
a2fd4bcb32a81a03d691a05c5d12171b3751a3c4

SHA256
4bd33a10eff397fa08f227cde534cc89603c00f289cfe4cd62588816e016b7db

SHA512
c336e935506581ad6c700ef18c632af2e4dbcbe564ef8e787d00c7ab6bd742dc0067c1a1da33691cc19175bb07a840beeb4c809e22bfc211c3b836a9a80f2398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc600c551342a5f739219cdc090cb1d

SHA1
aa76858efd6c3ae1e93e7451b7961647e2cf5ca6

SHA256
20d01f8cff3b673937953d88dd3963ea33e9f4e7ed11cf8cac14bdeba5513ff2

SHA512
b200448281028bb05ee2d727f86061edf00645745e748aaa6ee1e3ef881190dedb8b205df5392604adaf24f83347128b3a47eb2bf020e24eadf3cfaed626528b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b10cd2a0d32e9544f0c933b7e795273c

SHA1
454e6a6f4e8838e54e2b43a9667e6a94292784fc

SHA256
134e20305eb5675eb910194c06d552b33bf43b954af059e6f933742b7db58ff4

SHA512
fb1a7cddfc628cd9f616c0a8f3d5fa43d33f1069af804ef519d1b04d7f3dcd8bcb4567064741934f5401ed621e2da6e26d8a839821322877dbe3d45754973998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c09984e6b9564b1ce27194e110dd05b

SHA1
8fd394124dde752d8ed725ef74947254e8a0eb42

SHA256
460766001cda79bc352a1874015482c52132bb0313334e4744ead336ea0a10ac

SHA512
5e75eeda524e4d5eceed9a98390a1dbbbbc6793af01f546cfbccedbb522a31614f1353ac3c7fcbb64b743f9e33eef106a19b62d59de17e5854045b105364ac0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A89.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BF3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit