dd4e6a967394343a6021c6f3a33d1213a6717964b8795e2183d2c1ba49e81c0d

Analysis

max time kernel
144s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4100ad8d7354d65230c49c15e4183d14.html
Size

6KB
MD5

4100ad8d7354d65230c49c15e4183d14
SHA1

8ba0e29dbf0172ec296c3310245f9ea129894e37
SHA256

dd4e6a967394343a6021c6f3a33d1213a6717964b8795e2183d2c1ba49e81c0d
SHA512

b8e2a675c14c683417b16f0980ab68f4e820566860f90cfded2cdc327f1eee37a19836f845b670dc82bcb9374e442bcb3fb22d4dd10d89556828fc7eceb8a51d
SSDEEP

96:uzVs+ux7iFLLY1k9o84d12ef7CSTURv/6/NcEZ7ru7f:csz7iFAYS/i4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46ED5341-AB06-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000088d67f089332de8cd014da807644bec9c5300ff5f49b72ed6f6133d5d7cf0681000000000e8000000002000020000000334616483ff74a244f35bf4fc1f856e81a5d11c07a8b3f0f0e4e365c7dd995ff200000002259859ec8758b6e81b11fb4f4383d1949a65cda145afca06df7d15aaa35d1a14000000083ef8684ef2c97269c915b4aa56127f5e95a7b0ab04d0c75d5dc6394d88031f30a83095992f31669543ca3c25fcb6a4d03db0fd6cb77ae2a5fdedd5be764ea96	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000001472223f347243c144f04ef574b76f64ebca2237765b64e6b6a3fca4d544023d000000000e8000000002000020000000e8d90c14046ce0a20c17422b41ff47a8149e80b1cb042af39dd03789cb8e739590000000c76729a52682c14bb95a85d7a70e0ed95117c56d155870d63b84ebafa17f56cdceaeb3d786db9a4e7b970bcc4d4777e862c7053cf90e7e69d3ac76ce2d612e81cb018e746eb8b67fc0aea09a010a26832f6a8c86583a4731dd44e10ff7a56bae5e7ce82402312bdc267c2bfe4628052afe9552c6cfb93f9fc46fa9323f117062122323d79ace50aab39180fa84f504d64000000073f1676e3a5590325d97cd03f65e9d87898bd0d5740e405ed62e637d44c396169b4fc0445720512f4fc3f0d2552331dba3675b415c6a22a27401fac8ee7cdcb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410537272"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a47634133fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2208	1720	iexplore.exe	27
PID 1720 wrote to memory of 2208	1720	iexplore.exe	27
PID 1720 wrote to memory of 2208	1720	iexplore.exe	27
PID 1720 wrote to memory of 2208	1720	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4100ad8d7354d65230c49c15e4183d14.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c10a5e57048a225d0dcd8910a6aa36

SHA1
81ba949046eef59837082818d9448c432fe28e04

SHA256
3b1ee478e921e7caf8418325e757cb8bd83baf8429c4e3f1e0404606dd12552a

SHA512
82df86f94fe39c9714c424e742e594001ae1544cc0a3e8bf3d04c3e4a5d273ad68c4172ae360ba463aee43ddd6472ebd9d90d6fc91567853ce35fda046e69e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c81970baf6093d52896dce2b1d776af8

SHA1
878a966051c0842af4e018092ed098975b9d5fc7

SHA256
af296980529f8ee62e3ea7b5190324e8fe637c420403eacaf81ea502eda525ff

SHA512
267fa510340e91e6742b7230ae66c9abf6e00c629b04089cdc07e200713a8cdbd19f80b9ba4c1ca8328abd7d1f39c9f160d7e328516d97b5dcbf1c57f4bd9f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edcbd58d9d3a90367eb01f1465e8f037

SHA1
14594814b07ecffded1718874f5b640a21f5b687

SHA256
d846f48905e885c2b5b326dffca1fe49dcdace49c341f01919e699adf71a2d4b

SHA512
8543c2fafc8889e25bfa9afbd6f6a5202da4767151cda6925b51a8d666824e2c440ceecb5a8284411f3b329eafd61e7f9691157ad681b6b6f76cc67bbfd69ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1818dd536780e719cdf13de31c080bd

SHA1
8f828e749e4ef3ee6a74ede2beca18069fa26146

SHA256
411b1ad1b90eee085e0f62b4bc73d02edac1d7af007d2984b1da6fb098cb06c8

SHA512
643b42042e524c6da057df10f69a9b5caa8c25aa158ebfc7da0d43688dfb52d772c5c7002908465ce080767435f2642c21cdedabfe2b89ac47409b62abbf48fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b79264c04391a5a52024916a69bce7d2

SHA1
e872fb24b50a2befff73525180e6dab511cd702d

SHA256
1f16ce9c22900085cc282bdc2b7d7847890d7d807ef89b544d728c0917c8f072

SHA512
2d9f0ee179426c0dc1c41f105e240146a4ffdb0eb486368e0a54e7a0a056d9ade15700b5a7b772dbce5e9f9808eeaeda00062390f3d969e57d76cfa7572a0a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD470.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD520.tmp

Filesize
102KB

MD5
1ecf0cdbd7446e3c55b8f0129cc81a40

SHA1
ed6267f967bae05e5a4ae93e0ffe3998fe14c9a8

SHA256
41cc7d177a3a915e7de61d0132d26e7911592902e4b0a8ede87c709fae5a26c3

SHA512
57a5ff3187aa890e9c7f1e59bc112f92f7b5435b8c1476a479848543b7084ca19f40834edff8157f3fcf623dade96b21e3496fd57a3300cf8513e171cc4ba98b

Download Submit