74dff3a8bf70169264aa90baa7dc79f24ced45078679018e1967c170e05d151e

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

418984842ea7f8e7d38c65078d68a9ce.html
Size

39KB
MD5

418984842ea7f8e7d38c65078d68a9ce
SHA1

628e09b4646dc18be1acc97a34bdd860df6393c7
SHA256

74dff3a8bf70169264aa90baa7dc79f24ced45078679018e1967c170e05d151e
SHA512

db33bba0cd3d24f6129f43351b569125cf738aab8d5fd9d020cd3872e3a5cd7011d0e4ca39fed891fbb9dd7df57b410b7eec4832e39ac2fdb8547b74b710a8d9
SSDEEP

768:Ig3eyHHvPWdFNdXdYT5TUJ10MOv2oP1YIfXbmw1/2SgH:Ig3LHH2dFUS/0MOuoP1YIzmw1c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a247de9bf93cd0ee9a243e75a8f6d80281a58a2579dfa38bb187e21c5ae4f56a000000000e8000000002000020000000cd9e987710142b8f759cb52ea5be91de4ec936871bc28a6ecd59a20d24076d7720000000c433cdab5dc6ade3f1b27b506d9f18576dc6f291d16d35f9b31e1c0274ee192040000000e00cce5107adab71924229248cdaf06a6feb818ed0a945461c4f9846c25dd8a23b79c41a353cdf0fd5c478cac6d1d57235e5f160d5c7da74d01e9a012c0ab438	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B98C5D01-AB2A-11EE-88BA-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000717c3956054f4763a0e3e543ce1d4d1f0e71c0b16bcb3ac61f3080240cecc2c8000000000e800000000200002000000082b6d85e674005a48ff6f9a64676b90877737c43b27dd914c9329864eec4a214900000003fc8c975b8cb98d8e46b2ab8df3488986514d409f06c1792301bb9683e7398c7c7d238b608b809cf2b30ec6fcd29f9f40d1f741364afa61940995e035d82ec53fac64906cbbf06eb6bf7902f0ee61bdf06570659d5131981fefadbc4c19e8dd8e952122c81d96f3e2333e0743d8c92207b11d2edeb3711899b10156b447b236ace8b3d976128755777e9daeaa3c1273e40000000ac48c478149132d8d3fc0428c71ff06ec7a7c3fbafcc1abaea69154e5ece661076dcc25224377625714659fa3d6700e535b0254806eea360e795732a96dccb15	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410552928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a65198373fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1552	iexplore.exe
1552	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2472	1552	iexplore.exe	28
PID 1552 wrote to memory of 2472	1552	iexplore.exe	28
PID 1552 wrote to memory of 2472	1552	iexplore.exe	28
PID 1552 wrote to memory of 2472	1552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\418984842ea7f8e7d38c65078d68a9ce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0285deaeb27b63bf699882aec22325

SHA1
2b8f020db12f2b16ca117e9b4a8b03e31b6c29de

SHA256
6ae46059f938abbd4723d7448afae3feff1e45907513d4abdfa3f5924ec3c9b6

SHA512
55e9ef8628c2683074e9e63575dfd1b373e8ef77f9f8f6a07ff4013514e21010acbabe074b7d7a5cbbfa9324927decdc1f00212abbf4061af4ed475c137e499e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c2ff99a2e96f2764345b1b08a83c55

SHA1
f88c9b4ceb0c0d2c88277ad3d904f714787f3d92

SHA256
54bf4115b90691879566c7e13c98575f070a3b4091c90fae6310f9d814902969

SHA512
60519eb36cd15e454bb7f9567e8fa5a82ace426b30b98079c89c784489ecea54bfe008f08107bc7cfabb39f8e71095759e8f81909eff722383f720cd31aea924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d1c9f3613f227fdc93f75072403784

SHA1
fb5ed6ae1878bbf055bf16e3b552bb45ccc2e91c

SHA256
fa63cd37dd26e2d4300e00540f68ba12d38b4daabcfe5093b50b26f1a8e28da2

SHA512
6c6fb063e5f785c2784cbde0cf125954ff57d62ed2d6751035713d696468a3211298d1eb464bfa9aab8d588e8895b1dc893d8344055c4eb55157ed62b8bc5404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9bec61674c975adc0a567e3a6fa78c3

SHA1
c18578c3b8aed8f3ac6d8d376bf6dcc494b57fdc

SHA256
0369f1f3b1659bc4e4835518ae9b7ff5f3fca262eda52371c72e5b280981b3ef

SHA512
a3279002591cfd9fdc440b0abfbf0bab06d33dc416bddbaf2ebd23b13e3195136ac998633465608ad67f7dd4ebc9c77a4ef84d16df32326a2c6f30cba1300078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c90cfcf1f23a6e281b9acb471af802c1

SHA1
c1c178f1533de94ef03723201ed2c9c30babd987

SHA256
ec03dd945e04f3b088a20b1ff8076450306b1459a18baa2fa3773a1bf831bdb2

SHA512
b79d810ead9b01ae0bbfd0deb70020c4ac915b949f103bc2a6239edffdc827f4a852a5e5945c9e8cf192f759302ebe33c85fc38f50f65165a655c3dba32870e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df4be1b6d6fb08111f98dd62d5323c1c

SHA1
c1442cacb57cf9a3498d6d56e47b4c83118f7480

SHA256
ddcbadb2b0a6bfdc6d8b66be8547c5231114a5d5be8148d201742bab19aa7940

SHA512
cfac5e016f9a48ee8d1d845bab23b78eefa9a3d7e6f8c8ef620f1e90c40acf28e8223f019cfecf75a3902782440307c6b334c09ef89b569562747b3673713e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aecca119e41b4b0dfcb21bb967f548a8

SHA1
449c3968b53d691f6b9016df63dc4a862b3e0af8

SHA256
c74f93280ab73bfaf20003db74560eca62cef7da523fa2071d7450c21df314ce

SHA512
ecf747a926fbf9a6eff12dfa4ba0ccf8afc7938c32c231b097c9ef695353b52428680604c91b3c521da48bf41651bee1a9ee6edd67d26ee1815e97c26d832081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a984bd541ae6a606df703e884a994a74

SHA1
b5ded70114381ce602358cd4a72626a9eb4cad12

SHA256
7d2477cf425c1876344346aefe1cc3defeedaebf2af6b4a7c0df9429e79fcf26

SHA512
fb07600067918d93520070b7fe1962213fc6c7f731daf4d97afc29a9a7a9ba6030472cbbc71f4c0d9b5098a6e3e128b9124b085179719a1ead76d6b17dc7c595

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA769.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit