d262e8a624a3d86a80cde837b06444dc1a47fde59985dd1533fba6ec8eff2eec

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41511e8151a24e115c78341525925563.html
Size

1KB
MD5

41511e8151a24e115c78341525925563
SHA1

020039348dd24cd33e6f331d10ef44cf2358d5d5
SHA256

d262e8a624a3d86a80cde837b06444dc1a47fde59985dd1533fba6ec8eff2eec
SHA512

05ddbf1b564d67f1bb7c67166b09fad8c1b9bfeca5e82dc18e67aad1c1ad375285ab8619ed9b6c18785dce8fa53e7d9e80b2651b245d5c8eb1408c2089cddfa4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410546580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f033d1d5283fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003941df5c9f484d6bcadae991aa6e4c43ca5f0c6d2357520d1d69fd006f406857000000000e800000000200002000000096d16b3da4e86b7d3e577d59b481a1b801bcb7d391c4305d25c865d2845e32b9200000004406dfeff20b8bbf54922ac814da8f6cd660ebb98d4194d17ae70f8aacf469654000000094150415bdd0fb1b4d4579d4dd240ba2269427e9d6fd0e27f96938db098e7b4a2796de87bafdb078957c3c9d7586c781e59af92658570f52bd20994dbed6bb4d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004fe272425c3bfedfd9683f023a0ee33d30c2f266997a24bf238ae1c20555f94c000000000e8000000002000020000000bf89a3d9be8e098b1f7240c5329fff97a9b19f1c00568922375f49564735635a9000000075561e8cb80e2e2d314df4ac98d8f15d21bb53657dfdaf74d3ff16f41fc56cbfb43ce7428c197ee1dc9cd93983d50d37536ca5737b21ec0041df73b67a951ff9c502a23208bb57ded03948805a97a0bc11b560ecc06427ef70699b557ab22386d42eaa14b48b1d338c05bb8c1f268313a1a30cdb6aa62fadb63ef719d1291589abc2b5c6ee59a625720429998650531340000000aef7c966a3233ccd090da1d8ec0fb594a050c3c496b2a80aa5e3f0385b86742e450f21070ef107f728d5bf5d94ff1519eb2d90e4275a1649229f5d21a04d2dc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4F508B1-AB1B-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41511e8151a24e115c78341525925563.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7227c644407b585acaea12ce7cf78a47

SHA1
5b4e42b8823c0293ee02a830527efeb393276f0f

SHA256
39fbc3c66068df3c2abed8de63ff010f75eed70e3b958f3e199dfb82f478fc70

SHA512
8355e629618f20e07b28695de563ab7cc619e423e5ea90528e7e24ab7764e902b01bdbc03c1a01a4cffdcd21fdfcd36910c1143e173d9f2300edd94f69900de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c21ec217fd234246c6eb7e42a58e79e

SHA1
260c37f2a294b76cffae0b0fae0ab9f86c8d9079

SHA256
ec59fec6e4d2b947a02aa1447bbae7d7f96302bff304a72762094ee287278a38

SHA512
acbab0d71c56330bc11e2f7c6220b156c1e8c02c6f07b9d82c76248a812e90f3b4c0b8c297f5c132adca58e37f4206c68c5c38ac108f2a7925418bb05ded4722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b5741c4e2df6c5ba9ddb8c80350daa

SHA1
03a6a95522902b47d04eb521b202a37a8e143cae

SHA256
47de8a706aeaa45a3583616c73b428e40e52236932c582fc7cae12ff64d35970

SHA512
374e0256eef94e0383b3a39c86a5c588e58cbde0b91c923e2191528307914b26b18e9c755f454fe839598d4863eb33e985bee314d729a0c172a5d8b1e16333d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220e28a8afb9372810cd1942aa542ff7

SHA1
99f124f7205ec3fe3115915827b84372042df6b2

SHA256
88f082e416dec31a051e9cad606e3189912694a25243da4de131580ac3612420

SHA512
e35691e7c534016ed2bf950958aff3680d68b350b3a1b80a4aa469c248b959f90b26382ce0a80a8e508b288f1347dbf2c2cb73f1095717566d12cf1ce4dab8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6257dd7d7bf80378056ecfb1e04371d6

SHA1
3cbcf6b97004973832c2ccc895a2ffbdeb8aa278

SHA256
f453e118f6997d2c2519c9de35b440660fd91ea5b11d00549b4912baeffc9cf4

SHA512
714dae339f9d0c12366049aec8d6123191a570b08195b7694ec2a2595ff51f447c63a2569057726946a6ee44b5aef5a935aea3a1f0dd4e646e0f479d5388e3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
918f1176868778c4387a5dec7d6164d3

SHA1
f0590a252f5dfc542979baaa49d114ac5a62aae0

SHA256
33127584c3c856c71d845a2b62b5831af5f0a925375c328a7b3745901af3fc02

SHA512
f62d513206b2b6013be72439ca8e91c0cfa556764abc78eafd807106c7f39e853df990f81f1f80ce27bf88ad0b4911e9393a19ec4944b4100c71eed4722cde8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38181b644c52eb98949079faa65cbcbd

SHA1
225403251ad1033e6d2b5a58ddbc70b23b4f8541

SHA256
9f4637b8b74897f7afad3fed1e0611f31fa4f8d6826066593fbb7649aeb38399

SHA512
e22add8245cd1ad2f53cfef83b6feadc62dcd169da9177308b212206383ea0eb54420c83b06b35c319b067133049b61e928d041de5da2cbc6214ec4a4808bfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adadfbaddc5874f8cbb6a6fddcd23180

SHA1
13a84ce1f8b6e12fbf5aebd080a6368476f02591

SHA256
78f6fde87c367e5eb0ab72ad3e3418a930a0535d727bd7888c32c610e53c3489

SHA512
92e3d0253fc68aa2ed37576c835f34718401b908e617c025692bef7823933b61dd10db363c614c91c981339e75863b9885b21c17a51cbbff4d9fe217ae059512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2694a2fbe6a16dcf98c99ee8b7b8599

SHA1
4017ca44e79d942969078365253b02da19bdefa6

SHA256
76135f9143bee37175255b776f8f97ea0a4c0cc55b32e7e4496675496011bec3

SHA512
ba651c4b76a14f81552da34c92a4cae6002dc479bf8f1a31a5b411347ee15fe1e844d728094ded9f0a7ff69379cec09925a997da32154eca45900014a5994753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e168eff1500eb9d092b8dd08f7416a

SHA1
ae928fe28f4d23de3c8190d7dc1d6799e43fa5c0

SHA256
f8ff94fa2130eda34dba7326c9f8b397a85fb0b285c80bad31dc6c2b201a30cf

SHA512
eb59d4f701c7047e056b06adf645947f19a9eb1d35b0f105b2e8a71473eb8dda704c2ea69854ea58196faf5e229109ea5bb41c846ef4b2036a83f5ae9d1acce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c121abfe056647e54a1456ee80c07f0

SHA1
239936ab484f5b820bed9de557d1f64e2703f108

SHA256
72751fd7de6fffc81e18ef1bf8d340717cc6c0f56e20d8e247ee6777c9a68f16

SHA512
58ee333fe6552e443574995916fa3be579f8e9a3e2cb254fae5810255d4114ed5837aae7155ba233a7fcb71a30055eab85d551b4ec453e31942402486ef65b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC9A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC9CB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit