7231e42fa5795e34af15e1049e598c829f872d4dfe57d7ec64d9cf82e2fe3e9e

Analysis

max time kernel
118s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40fcd8ec17e75aeb58564f8022c843f7.html
Size

35KB
MD5

40fcd8ec17e75aeb58564f8022c843f7
SHA1

c2579d5d8b23aa4142992c568bacb9e2b89c9c1a
SHA256

7231e42fa5795e34af15e1049e598c829f872d4dfe57d7ec64d9cf82e2fe3e9e
SHA512

90196cadec6bd68721e81032cf6541b191055cd54fc380119fa5b851aa3cdb29cfed9c6c83ba82722198b6b2dcee5c40246351aa47e53e7a95a48fe0365d561b
SSDEEP

384:1iH1mpUPkF1FH5546TE2v9fQ6Kj3n+e3nO+KlePwwu6kNSBjrH58uIiShVH:c1mpUq54WE2v9fQ6YUetdzkhVH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b2d940a10b0db839a597d31ed1b443daff33ccb65139fe7b0afba17aaf1e28d5000000000e8000000002000020000000e7ece8c6e33272ced36f027eaea05f7f1d3b7c7ee910f7f4ecfa5261057ea0de200000004d1dfa4b4281b2118a2de91a450479199895329451390110d8d5a8888ebfb8864000000016faae68a711cdb59629473f4703d257683d5d467dd8b56c442f06317721c634a5dec72a11450496598b9d39db7d9ff013a49eb07509c6357daaef1eba04d611	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410536944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D7DF141-AB05-11EE-AD67-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b053d652123fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d9840ced9e344123b47ab5c0bf7bebaa5c09c7da0fc519c9f87623457343d9b0000000000e8000000002000020000000e1f548c535878870d70f4c0e5f49a8e76327e306b56dea231bffe299a40a1163900000005fd708249bdf1850ca23251a002d8ef0c5b9d81507a83dc8bf994e87ee1a3bfc24b20c5d5cf983bc08e343979ee28abcce02d4229170bf9320f39bf7836d3daf77ae536b71465dde6d31d6a53be1ebb1a52488c5a29f73a5f0e6e4fb1c89dd83f3ba45b6bc135c99882d246ee248ebd71860556881e73194df52517de66a8ea41479a37e6ca1fdbef68edf978e14517f4000000029eaaacf027ec3e977c41eeb49b3526cf544d1445d8546476fd12812176f82bd663e037e745e8901f9e18e254e87c833e85f3f16ef1e56529c88a4b206927e9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1352	2116	iexplore.exe	28
PID 2116 wrote to memory of 1352	2116	iexplore.exe	28
PID 2116 wrote to memory of 1352	2116	iexplore.exe	28
PID 2116 wrote to memory of 1352	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40fcd8ec17e75aeb58564f8022c843f7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49acfd5b1c5f763177f309ae306fded1

SHA1
1928401358a18ef31f64bdf80209c75a21b49af1

SHA256
f77a57a9044940f8e9ae71901c486cbcbf8acb597faaf689f3faa3cf7e2271e9

SHA512
8f18aac35117e0a62c03db2b5ce9f0b08b82cf74fcde5e428f2bbea8db47116e9e95a14591d5dc2e0dc357e6d258a6a44f41c821dc6d93f77413593ecd13886a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8837425a572aab8e65f5445f21e61f74

SHA1
e469f64ec090a7e2a742606be734a57294813b16

SHA256
8742c0a66e842b563d7254c9b45fab6ec980d9e0b074d95e2ff93eeb28742a90

SHA512
ba4a9ccdb9dd8afa5bbe11f321d11bb479c956024b205bcc495f6ce9716b2d77504085d694d7f9cb114db4d585642663f50b6ffd5e13630ef09fd5ed184f334f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a3e11e9f4fa76b8e901261ea979ac03

SHA1
75b888749540be60f4354dce2615ffd29ddced3c

SHA256
617f117c4571bd39e79ed57a7b4ffc321b492fdaf44a714e62de415610dc39b5

SHA512
b5f93f2c7f516d3ce921759d2d3f32960fe2ed3b66187a30f39584e2289330a8c57d9aee6b0f57a87a7503d51a61764e60cfd134bd598fcb939c5fb3d9925551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9d1d7933536f6af4e153d81e356a0e4

SHA1
55a9a0c00262f91f8ebdc6b31d653d751a7094d0

SHA256
cb2122caa311ceb82ca158b65ad3c7ab8dd04ab9e8e684ecdfa5e57c8f21679a

SHA512
ce2f582bc6ee127af47abe026bc6052a2725a508a7282134ce837910659d13c8daf5d7e5cc3e79c97c931bad247d78b6a8a425c6a040f9490dae8f7319081e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f394c36065cd83e62745579b02c50fb2

SHA1
a2d7e25ebfd6f86b5e978e7c0c552a176a5815a5

SHA256
aa056835131237cdd886fbe8e32378667085009a04b12a73836f83d635615ca0

SHA512
5f534f22875d534bfcb871ab522714dab7e16577b473fbb09a36b3746770f062092fcfbc86bd13bf378553e6575d1aec9bc79175ba6062df91f83f89a23f9a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034e9dfcd7d54cc074ef7bdcf9b083e5

SHA1
6cc3a76a7503342305f9963a9f014e687fd383f3

SHA256
489f61de4977c8d56fe34f661edcdcc989b451d01a53d3c238923735a7313eb8

SHA512
e4c63607b3176f05f6a01042ae2bee39577888ef219bf46a7367a0547443090841a1ceaec97bc6df2e5e99d1f493af83846411e63bd4b98fc92eaa95f59de826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f5f0d6283e2893ea6ab4cc1d01df5b

SHA1
4b9bb7b1033d5ea58390085d2024262714f336b0

SHA256
d901dfea65fe65d78a71a4151ddb912c2e8cc35fadc02528c116c018ae840632

SHA512
3abbaa9768656a1e91e7df8522e51294732ecb52e8d85a9aa5a5d6ac71ff4aeeeaa393076ed631196f06166fd7ed6c5463559c7462dbe24a1d531e4ba8db5d44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defafcd5e8d99db2fd2e397207aea5a5

SHA1
e2497f0464dbba00a9c41e0503dcb80daea46921

SHA256
e93ecb420d84ecb41ba97fb365dd512fad0b83532178cadb1fd71ca57d2b04e1

SHA512
25ae17037bb83336bb06295f6bbd43d066f908ffe14f1695edc4f93e822a487f69df1c48bdbfb5d75f6c1fed63cd23bd41f899923c1b3e5d76d6a9b35be0bd72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0843540db3d2bb17ca380de9c821bd17

SHA1
0f7872b1460bd8f9510f19624455f009af429216

SHA256
a22208b4c624e75ee8e73507294656fbd572bd81033518f3ff0cb689b7f6af8b

SHA512
0065eb56dd360117a58dd2b1879bb251d392bd1ea6418e876f3895f02bfa00a97e06e4f3551c901e99b7f2013d2d36711c8515a60369628d79ebefef42f85aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e457e3da5b2c866a548f80573cfbb2

SHA1
7a19157739c5907b1a91f2c20797671e0ca417f5

SHA256
2cc3af9efca7c211cdb347b17deb930ab93f81047bcc22a2aadc94c2d07b72d7

SHA512
adde084251652316d693c1a28030df4764371bf1950c8db2c46e035e18369ab08d4e9d80cb2501066c0574979bdd5e09fcfc42cea17a95564be50a42b5e89a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AD6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BBB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit