073d00e55f493e9714eff8499548d912afdd2ce83eb81ff7deeeacf8a4caead5

Analysis

max time kernel
138s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40fed83b0a819d876de6a981851329e5.html
Size

15KB
MD5

40fed83b0a819d876de6a981851329e5
SHA1

a853ab43ddd146e8bc616bc97743a7331f967231
SHA256

073d00e55f493e9714eff8499548d912afdd2ce83eb81ff7deeeacf8a4caead5
SHA512

f75891e27a659737c3a1ca621cd32954bb3856b7cac1839957e303f26e0d9bf5f69e1fa608e47e17946630fad5754407a3a6c009b48d6e68e66300148b586759
SSDEEP

384:F8bg68DlpuiduF2CFjN6iHLsumBcheSkP7Ifx:xDlY2CxMWszCbke

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000062de39443cf68a4468830d6a426582aa3309bc0aa2ea5cb0f86ddd8038f1ecbe000000000e8000000002000020000000dfd8e46aca47f22542e2b2ba95d9bd492c79150b5e60cb6caf170a24f9557ed02000000046c34307a190c2729025ba779a7c686929405b95135246338c5abf20742afc5e40000000892f69fbbbb2c645fa497b6f73085d362eeefa3fc58d729dbd3e990717e85ae824d5dd9a4e0ea18e93ca83f025316b33778b122d533ce23ea9d97e70f59af6e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F45BA911-AB05-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410537144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20186acb123fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003b4273f91c348b13eaff4f4c50be68f6f6aea63b3504219e77d2884f4df09d82000000000e8000000002000020000000a8fa85fb0ea9591bdc01f40c9c0705461cae047cd7bb07904ac1be7a91c5863e900000008ac64161201d74ec8663e4717d078cfd8a5816ddc0899938c971fe29ed60d983e9133220e9550de63e90b34a2440f9493c05fac54a8e2686235d2c67c2c3f70f0f9bb4556a29aa4ed65fb4bcb276f729df9b0256c1ed3cdc5d1ebe1d67856fb7da81c67417c57bbb837fcd40bcecb4f789f741c56c84f403393c257f00e34c0606c2459687d7785d35a3ed364a4edcc540000000aa9a77032d3032ea9fe18c95bc72b37c85c27801daf3ee9feea973e8249855679f4a758db2576f599f0e35eb8f3372951f17df3c4cf7b64a9baf1ff031c5c547	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2380	2980	iexplore.exe	28
PID 2980 wrote to memory of 2380	2980	iexplore.exe	28
PID 2980 wrote to memory of 2380	2980	iexplore.exe	28
PID 2980 wrote to memory of 2380	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40fed83b0a819d876de6a981851329e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681c528989cbdf70be7c3fc1bfa8669d

SHA1
37bba5ac46f7f46cb03553937fac28886da02c76

SHA256
da1789bb46bbbcecc3808189e665b1a9ff75997ebca73ab11db3453f442f577b

SHA512
c64d838e0bb04a2599932f98c66423910141baadf8d42495d44014747101e6ac36e185858f1971060902dfb885fa941a0689f4bae6cb2a85de8e5b66df7d3950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c69b027338fbb7318c017276659f597e

SHA1
14ad754c298bda2c240fa2da82146b26137e1d11

SHA256
70682e01c347e7f98659cb86a0d1f61af62d63230ed3355afdc5320ead64cfcb

SHA512
204f7c91e314fb3a0459857bc91e3e39a35b6e7dffaedb566ed4e4aefc4dc7b03a7c5716b187feea8088b5149abf7523bdcc977e18498a77f9f18198f120dd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaa6894db0bbc339e84128ac663fbf79

SHA1
790564ffe63ee8ac39436eec3d7444cc6eaae4e6

SHA256
65d17a65d48b17c70ce1772c3dda7a47318c3c7560c5cd5fef004db4224dfb4e

SHA512
beae02d31941eeff6b2e0d78aa428c44883ce1aaf1410c6eb1dd7bcf6a8e74c125f2c6ad3da866894ee4f2722f0a222c7b5cc7d1bcebf48b7248f4b98cd3aeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
866c116740ebcbf233fd3737047551af

SHA1
e0279b23d6f457218355108fa6c5f1ae96c91511

SHA256
5cced93f9df9d5bc7767f15d796c8af4b057d4d3637c02d0416d1d15b5296b55

SHA512
0aeff8c38879a62311167fb0a800b97900f962bc1c9f2a47e4cb85b9f0b7db89895f7e75a78ef94b8f6aac854f6e0ae9335b53fd8eec9a02cc78874a5992f1b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f169dd25fc5e02b2716b72075f1bd7

SHA1
cdcc96c03e97e9a01f166545bb0f9f300fb449da

SHA256
b38e3baa292e160bc1a3fdff6ba93e52176aebb3bcd79f0b3591f6589fa64df1

SHA512
5a4d9d563122f0592a16a77b07478306ed74a95956c8f3c283f084384841826c1bd3276e77129a1e3e286e18f4797e0584261e511461e4a12dbf318f05b5904d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e9e1aa875da629a7473a86d80385387

SHA1
6faf3dc5b3c54d1563829b5a65d7228161eac1df

SHA256
b18a47cf4a5e0846e862443f0f043ad02b920eb9ec579bec6c8b5a2f6cdf5fc9

SHA512
159855bfa10d9d90737b75fcc1abc901e3708d3f6c78ae24e5f090d609fa33c9d62f7bfe6fcc4f73ee22b7645e0822357560b245ff083b4db57ddf8aa1fb7ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3158281224fe8bc38fbb5bba913360da

SHA1
f942c99456ede8d5b0513862efebf66c6debfd8b

SHA256
2920b95a8632cf803ab8e5629708c478855484d3af856cc53409804b122127c8

SHA512
2ecbce4a19a24bd1d9a20067716c753e99a7b9c49e641e2e13e4fd005713d93a8a3e9257f1b6920f14c19a4fe9303cc55db73e653193e7b59bf40d45bb096b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf413a934c6a0893aef013d155719fec

SHA1
f3dd1ff1beb6ca626600656d9ea0a2d35a5fee95

SHA256
22f98257f66d88f2236dbfa7645690e5a1085d4da10885a9b71adb50416a5c41

SHA512
7e29b6f51c85f3c4fd8a7a23db935c9e3cb20e44e470dc66059e0fc4733f3f61e7e1abcfe849756a2bc03d7281fdcd087306883db4119ff93b636d6fe6f224cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbbb28e86963aed87358f4808edbff7c

SHA1
c68749c98163d035fcf3e0db677c5d8927c08385

SHA256
434dd26aedfe1a13ca011e9167a971574af63501827b77fa618b24e6f17eb101

SHA512
bd70073dd021ba3c7170e7ef6f8731f514a58744e2da7518ec940ec6c3ae90fc0109d0a1f4ed14b125d60108489c5059934ba07ed366b768820126dec3bb45ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d246efe9029d18312bc543b22517139

SHA1
b41327d5230b500badb1afacd204e6cf4424b246

SHA256
deb029ae23ce7a7bbf5de66826a12472c1c1beacaa09d6b39be354e3c463dbca

SHA512
2f05a7ca0d74bc6a014350390d026dac3cb78e5f0a42cc4623229676902dedd444796efa05655a257b6e2cefca7753926de6b2fb1aab06eed8073ee57052b974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da186b29895a9c0f47192acb940bb0a

SHA1
524560da8793d297e4062c7fe18d1b4e77c84c54

SHA256
73e6f8ab6b8e0d905cf3fad6026a7ef672f917134cfbdf7dc12060e893309dbd

SHA512
61c5a6966b954f9933fec6793d85139b52776963168842f41f90841985138ea8b7fd9619a20727c9c51c1c417cf56436404b56ca2a2b7eb2f80934bba83ecbf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5203f6b7c964423a45e4895aaa8492f2

SHA1
e443627b7601ec0e31b847227a730849dc7c8b70

SHA256
7d93cb747fdd3872b6c1193361ef7c76c3cbdc7c31dd43afd8dfaced5fc5329c

SHA512
973595de5054e80fdc4accbf7a7cc26a179820ea320061d54d589fe74504f73961f5e41bca7b5b627780184499265fba664e56d46e5c0d2dd2698fcd57a9095e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC72.tmp

Filesize
24KB

MD5
3973164abf630939a1935910abe543d8

SHA1
dc535294fb54c81b46a3c886d4a56d2a52c110b0

SHA256
50e12993ec8ff2547c6c67a60051dba142937e46966e249919ff26b55f59eef9

SHA512
081e358d65b0439f9817cf1d59b90f45859b788aa18f829f11d3727643a37ea4fc6d587e4ad0a01b2b7917122dc235c7a582147d4ba9a6d86b982fa536982279

Download Submit