7b85992c5916924c11dbb09cf33072ef7d9ecd4eaee247ffa7a4ea3b6a9e083a

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4101fa055b21969a52d413dbad705dbb.html
Size

16KB
MD5

4101fa055b21969a52d413dbad705dbb
SHA1

b7e173ccbc14efa8b0abafb30119aa5920136d5a
SHA256

7b85992c5916924c11dbb09cf33072ef7d9ecd4eaee247ffa7a4ea3b6a9e083a
SHA512

930a9d72e2e26e3d1994ef853c2d895f63f0ca7c28a307bcebebf6d6587978250289ddbfe75a2774c2b1fe56df3502750d0f2b0acdc709d5a1a9a50af6ccf5e5
SSDEEP

384:bAdRnNRAoouYexw5j94ScV4V6FyZ/XAPI3G5kYTvwWQhIXAPvCn6PjCn6FyCt6WC:bADNRAoouYEwjG5kYTBr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e43f76d666e3db7a75fe290fae98b59cea3bcab2a14f68534d75951c537531dd000000000e8000000002000020000000ff2141d5fb7ab21f53ac50465a200b1c618283a463ffe4e4e7eda32bc872606b200000009fb9163dced126e55e610c6043e40f19a159cf189d80a05b98f2a92173cff5e740000000898839b0a361e14c911294b3baac577a05c35959d94ce4ab442a954dd13c61b38d27bc67637c948691bf6cb8a76b54b4a00eae07f55a165a22687318a402daca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410537438"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8010787d133fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6525881-AB06-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001ab53ad0acd1c3253224881f67c27ae2677c3cfbb4e9ef3464adb778115226c9000000000e8000000002000020000000f151fd204c370a92509a20a0386a1579a725b18b9809d95f6a8c3ee07c02852b90000000f06c230d789c5e4c3dbf6833d7a53f5c82a491bb2591cf1b7bec76ced3be5cab8dae4bc1c510a3219dece93495e7ede9a40ffe1e5562e7bbdab499850725b645ef401e4f93cc1b30c4dd55cc6d19dcc16b1bd26a7d1cc67e1abe765eb15da685573ccb35278f8c833c920a5c9021c8583c91bb190dd6225a0615791011cd1b1bb856c283744ada60c69ff906aa8c564a400000007044c85dad0d23ad71d8cc24b6f53b76421935281cc542c735db00a4074501809b0a951d4097be5f8b29f53476d79961e5896680e4d0ec575c4e834e221665e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2796	3012	iexplore.exe	28
PID 3012 wrote to memory of 2796	3012	iexplore.exe	28
PID 3012 wrote to memory of 2796	3012	iexplore.exe	28
PID 3012 wrote to memory of 2796	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4101fa055b21969a52d413dbad705dbb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a67d419cd37acecc061dae1dc974253

SHA1
4fa841c08df286def305ee663c49c08145f05afc

SHA256
202b0ebbcddc94152bf971acd286d8d6961f4f2375fa23265e28812adfc1f6f9

SHA512
69dddc86d587e995625cfec6fe3fa019869df1e6035255d55b7a312480e7e2ad0be2d52406f002d4cbeecb9807e67b6c777f5f0c97bc2e006223b7169304aab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef39151d4c253b7129ae5922ff7cdc4a

SHA1
ea4c4fbdc82202bea03903ba695271380e913756

SHA256
f76ea57aa1a402a54e77a184e299ce0d03be3d2d7d2ababa7c524a5739593523

SHA512
e5badf8e677a93ad195b38531a59928a35cc814b83c71f3b45a76fbcd02aefeb3c013293940f09d4a0c4f6d7885b2fb6b8872fea2104e28e5c5fe8c1aa662d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556994d294915f3791ad32c1f99a77aa

SHA1
0f469901c570c4ad7085a7bde493e6b90e487b31

SHA256
ccb30e9f4175ac4a1b77df76a4242142c6d04bbbc09cfaf0c6b6650209540949

SHA512
6606cbaed2c4773457eaeacbab43a084314435ed9b01a3a716ad0318477bd1248842ce21a9e95c5a3d7f1111c4faf8599d1fd6dafd4ba70a30f51bf161c3e0d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd1ce13f78f484c4de1ae3d5c726523

SHA1
080005442320fb05abebe64395edbf996f533036

SHA256
9fc9542e8269c958c09c02e5c690b4681df6a1d371c4938bdd237c902bf85df8

SHA512
1a0fbedac82d775b9b64a1ddd84057a51b755aa5916a0aa730208e36c26dff4a06a7b356fbcb0ac8593f024f9a161f4e8a3674a1520407d39d5b095aa3d56878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029a8c2e51a598562a6b3794457095f2

SHA1
1d4cc668362417829dec69899922b6da0852cf1b

SHA256
c81a3656c82b0267dde03336a59d2680d81e6cda5f5fc74cd8948c3d2a210216

SHA512
95c0cddcb07a4f7c9eb98dce30025f41ba8e96d29ee3ddc22bcc67f8bbd4db268574c829c1dc7d419f0261035ccc45db647a3cb4f31916309cb03ebc27743ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bedf012b0f6235068ca98c157305751

SHA1
8c5e2af37d4eccac5a364d2daa4eba65e1fd917b

SHA256
c870498738ee4f312b0b9e1c3bfc3bae3a8b40a521be3004e3b0e480d532a9dd

SHA512
55224723ee224e28fbe84dc7fabb7ba98dcc3c8cdc2cb81826a15e05520c12f3ddde219afc547db25e1207aa88f5b68676f3ec9cca09ef6ff72379cdbbcd455c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea908bd7ae10d4467ece9f5ec743a78

SHA1
c656536157a743ab91d741f2c156cc24eadbd72f

SHA256
bce0476718d2c64ea1a7a89093a9b41610f29f7d80fbe720cb0a095ac791c943

SHA512
d835f899c42208d7fd6261b7be510418d2766c18f52bab0560fd65e5bc7c563ff23aa7f07b1f05be0469857e16533eb2d85ecf35db7e48ee3475022081cc4c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5945b109bce72f8da635a5b677c683

SHA1
b2cfa9c2b199c9e0e794a22858d5c48943560f07

SHA256
304dae7f6641c8b2882ca837a447413a403f0bdbe973bbbff0885bab86e841e0

SHA512
145e4075389c1b4311b0fdd5ed2c6b5854ec00758ec974f4134e29708dfab1a67cd4fc1c9f321715b73bdf82d08ae0324b285675c10bcb45c39a9a4b62773759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffa1ac923734b586021d42d024418f39

SHA1
a03e90c53be66b8106840fbbee3799ae83aa3d48

SHA256
3e42370eca439824f3e9a635ecc1604e71670a4dcee6726a513e4f6a93c3da25

SHA512
d65fe0084ee8d9505a99ba6eb0ed3fe4c4811aef975afcdbed8731f53682c7d6c65e886228a46d14473cd0f292e53803036d38760448dee184d0fb9b93320a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db63c03de91cde7ca0f05a7d6b60c45

SHA1
8a11a0e14c70d98f957ac0e87644720af84e0f5d

SHA256
004b4ab9af62a52e3c10918b97ea847274d8c8e5e7233215df042b33b16648f1

SHA512
bb1650ba4a5091b1edbc1a908a8c8537668aeadff9fd7c0e585dd06b593ec73a6ed0c800b664fb71f687c0846ea483773d44215240d5a4632da216559034a379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf650b6202dea09ae186377b5eccc1ae

SHA1
b38e570e8d28031d95f48018bff7551b9b4b100f

SHA256
d1a3c38b1a56dff2ba4396130917f9258c12ca97ed9e1e785bcd495a547f8689

SHA512
0aa5465cdf3ae5e17b4cb32d4f09e1c35bcf8540a93ebf37509e02e1f5e0d0a32ccae15196aae952752d9edd82ec03c61bf8a5278fbb2295174d19777b428446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd88075750bd29b1d7b75806db43b76d

SHA1
609c923347ed7e6881ce5fa924199f0244cbf058

SHA256
aaa62d7ef21f52a0b0aef50b7208033cdf82c7b9e27ffc56f1e77869b656ab38

SHA512
2037e7265094860d715b4c0d5c0926b3a57a095d30fdca2596452689a16a6e88f44fdad3a5d550a693da48d32317d0dd7e3fe50a9eeb453d315c651d65c5a11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29926ec0297cafb1063391e9581e4da8

SHA1
6543801f78eefd62331eed2aae31103f3cab3d01

SHA256
38b7a4ba851435f58b90b3d9b7c86058ed164cc978e09441dbd44a3d471e68fb

SHA512
25f7dce4f12c4ef5cc7e58a62112ad45e54250912443e62d7ce6a45021e27c359502b8fb2ce0b348eb20c70f36f6fe7fa0e4a821871d7694871772697fc4ec1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e365a57cadf5ea2091b4636c3a0ba2df

SHA1
c0a9a353af0cb4972c366b2c8d397927334e4480

SHA256
0f3a471ae8adf8ab02aed08e826af2a52e30e89894dcb8dcae5036f33e2bafae

SHA512
f2c17a16214ddfcd1d9dd26f0836a8d6526499f97624d0409a8f29ec7ec32d7ccd6a1706442534090fefb03346cb9a6a7bfd9f2c3df509f028acc56687d82783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56ff728900f6e5c219e87e37d6ae5932

SHA1
4e2a37d9898642464610fa77ca2c701fb68cb64b

SHA256
cd7b96f8ea9a514a46a8eb9813db9bc1888751d93e0a1cadd71095867a533b63

SHA512
6b68b7eefa8b755fbf0bf57d3b1283a5429955590049c9fd835264f76fdffb9247c8fef8bfffeb181ee0425cd939c1f917a2f9771d85f84934bff5cda21db0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F72.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit