e7e57da4df90f6df3d0934d16f17499fa42895a91d76803f5cea4c5b9176b69d

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4189c74c4669fccf398d3a246eb78538.html
Size

17KB
MD5

4189c74c4669fccf398d3a246eb78538
SHA1

84a29100be5dfa576db12886b93ecf255db989c4
SHA256

e7e57da4df90f6df3d0934d16f17499fa42895a91d76803f5cea4c5b9176b69d
SHA512

8f98bbe82274dd6dbbe05976c3c183653e9f0f6f01326dc146df5e62ed510dfc47a63f58676d8716982695ec6d85e2aee8faf271f7f0ea5b392eb56227c729a2
SSDEEP

384:Sjx8Ff/TqfgTQc51qLzLFf+W2QtQmIMffCHhw4gF+HHRFO/wxB46F4t45P8OAT:Sef/TmgTQ1tQmILiwAT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005f76802efb39f5d778a1edfde6035f9d29d33463204c5408fe0f9b83d97362a3000000000e800000000200002000000003348807f4fed71cc79c87a5fe203dd08fe6a2c44f4a0b2c69f5955027e3dc51200000004adab3b9087fbe32e401a877475db0894525167899220d75e8e9ae345f9e5a0b4000000043cc6047dd32989007f9498308d9721c429ac0fad32f32495105c24cea099710c25f68b59cd20f4c418f50b2d408f9defbd9a1288af6a23cd014ccbc115dab38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f36d517baaaf31e01e06f309a029545a062e2e7d57afca3cf13bcccd703397ef000000000e80000000020000200000001321d3294b637eb61d2eb96f621edb0402a8da44bf22622039dbd31aee486fb090000000c65f0952dfed7a65283f27b38a7c7dc9d4bf2e2590ed2103c50de417ce2194705e7a7bc7088c543af6946ea4bca6a46f7132e0324f83b075211933962e8b947f2d46abecf678fff84e5e4cc5f1a77cf2fdf5039ad247a76b21b5c48996e41ad8ede61e8f3a8bf42877156f4d5ef16ede4c2f3c191d198bae1e095e350095a527e66ca795ea3b34de5a2ab00c3fd2c103400000006458170ef878dabf4c173a26ad88a33b3e5e592ea1b67cbefc5bb98fcc042870df301822573ea111765703b80f18a473a15a903564d1eceedc8e991049f22c41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410552945"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705fffa1373fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C906CBD1-AB2A-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2080	2092	iexplore.exe	28
PID 2092 wrote to memory of 2080	2092	iexplore.exe	28
PID 2092 wrote to memory of 2080	2092	iexplore.exe	28
PID 2092 wrote to memory of 2080	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4189c74c4669fccf398d3a246eb78538.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d629b653e53548c0f8ea10230f21995

SHA1
a7086c32998d9f49820ca26c14b3aba26acc37d7

SHA256
780d5ed657529e564952eb08f1ca303e64e517ef0c70d0f3916bd4957b47f220

SHA512
dfa68d7119d0ac21c1f81150adf73a9b6c86ce9351e29490cece8c2fb4801764df04fde6009059c734bda2f67db41876633887409e3814e8698dc3e34169d27e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
178f341dfd346bb07979d73427f233fe

SHA1
d840b673421ed07f5ab43920d81af4bb25578342

SHA256
8c857d360cf95a8908cbfab5e6a5a5ad6ddc18a639da5a4cd3c1938527516bd2

SHA512
4868dd62ded1199628e23654591e824ee109f819c25658b6a15d31f1b8ef5ed1af9289c91ddeb0d697a1fd8601b5efbe92a852f403f394aca0ed15814b363748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e30ebe70223d1dd2e657efa6662df6f

SHA1
64f276e2189b1565fe4e5ce6b3918dc46d012ff8

SHA256
a339c8e245efcb741487ab8a954dc6ab460fc9c99de065350ae64c952c819d56

SHA512
0711b0c9bbcbac28698d4efcbdd2ee89d559c5b57606deb1f406999daaba5080d93ca3be4d45913b459445922a12ab4f69396e9ee3ee0d7da210fb528aee4054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7013edd9ff2fea01b516757f57546262

SHA1
d20edc1c50a2c26a6312dfef95b3da4453f517bf

SHA256
4c33d05581c4911e1ad83710fea5a376dad4e85d1b7c8003480a5d70a69f5d60

SHA512
2d55ee4a291b23005584f53104ac05964a40a2e035f445eaccdd733cc7417212b50cfc444ae71901a32aa419c56d7dfaf5ec0d77c8830f4a97a1ac121880aa36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a3422d999269b959c184007d0f1d8d

SHA1
750ca6cb19764c722d0b8a907f87093552809ba8

SHA256
aa6da06f459198cc8451df49117246a4b944218181a8f7e2926fef343b573087

SHA512
9b3e808e677e5e58de16ec543f8b457faba43ff4a699460f5f889add056ee1ec7306d7b048cb9e131c323964296821af46e9661d974b8fcb7236e4ffd3f0f718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b09ca10dd0f4b99b3625942be8444222

SHA1
e9ec8242a19f928115da6f169d1bff051e5f688f

SHA256
00716d982d003acbef90470020eb6db428e31c942378b3abea133c005206b952

SHA512
38bf9c15d087c1b84fd03c8ded325555569bbaf90a88390583446bf05a8ea246a82261988279b97eadd073b39d1c8d604f8f4b1d5bc2c0e44d4ae70c519670af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed8ce7416cc4047e0961cbd9c194901d

SHA1
e39dfccdb686dfe0d202bf2b667d32c6e862a954

SHA256
fafd763e2ede45a8c1b82d38ebee6d1c342f4b9a6f23de248d9d55d1e17d5f82

SHA512
dd132372d6e6db2e71f70c70ee423334884494a6467ea8aa49ceb74362a2c59151ceecf083a113be9ea71668ccf0af9a7a75269c78191508382bc483fecbcd37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87988101e7ddee615f8f157452e9eb0f

SHA1
b4b1c01602e78aeeec050f88a9d718952dd31c3d

SHA256
ac214e3ebd57aa17e99c5ff1a3e64f8005ddb9578afbd2f861a436133bf10545

SHA512
9e705cded7cffbb33da37c1b6716c723979807d10364dc4f02febe2acc49b2873b0693a6d54dd109f847b8504344f87a1400acc30ba0a269db9b4628cfc57f91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81afb920a79f5bed6b0026202baf6ea

SHA1
5f6e39f65531d1de3434be988c60f5192fab796a

SHA256
01cc9f0c56ecae3a526fddf3c5e8e73de5c085bdd28c249a5da12a84a6416d37

SHA512
e725c43d5cc9d6e04b64a330b6484619216966e6d9a793bfe26e26b905670a90c8ea4f1c49c6d53bb529a16babc8a87ba9ea9629643f4e621ad7c1a035af2cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ec30617632aa5b0b3487967b870873

SHA1
468a3e83d2ea59fc7d0b03eb8ba7ed5f18859e41

SHA256
a3e3aaa18bc0708e1042558b1b4ee37b7b9b78b16287e495b4024af793a713fe

SHA512
57fff60de097a174118916e46bcd7454dea2ff90b95519cb4b8ae0b443759bb072e008941876f67a6b51a45e1fd241c96c7e3c976756c49da6ef6782248ad0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8c86cba8cae4e39d37a178b8717f538

SHA1
23acf4d9f6f8a604b5576045fa0c6d71c31e61ac

SHA256
60eb56d0e806899131af43f758925a6e6252d2be15c0589e9b88988dae19fd7f

SHA512
8b5a06997e8994f31b3823fc5460bc7a80bfd1567238514817673431d77fcdbd9fa13c2794cfd534b83dc2c5696a63eab2a5792b535a7966d44b17db233b98d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f010cea43da391e2f935eca2a9757c

SHA1
0e48a4b83923c5bdeb01d54c1fab65e68aa1b308

SHA256
7176e91cac1c6915e12d25068ab0cf3ab1a990441955ef4d4d2f00a2a8d75121

SHA512
b0b62aabac0e26feb640a6c47bab34dd010d7220fbdc054c7caa04eb5d60555d90e9cdbf1f886807c36d404f93de1c0347d54295f8df78e08a06d60a35a7a7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
128314223b87256130baacc9526136cb

SHA1
ce0100567b0414c2690519bcacff713f3a75efd0

SHA256
218b37b1e0191eddcc093b0ff761b40d634c143e2d13b3a5d491b51c3190df97

SHA512
abad5415d78fe896127b15d18ef48bb25d87b385df2127964c0c6de668e5838d8e3fdf50485989a3aa09df7319eb5d1a33bcd6f742e1859d2b00860c445f1ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a9bf2097cd9da266cbb6952e2a2f942

SHA1
2c306507462e6358ef3ab9977157e079579e3ddd

SHA256
c6fbed454b9d09fa7a60cdced21d48438eda8a8215b9fe5f366567f04f8a9f00

SHA512
d5bb3c146cba608c618ff9d094ede1d7f672ecde86b23ebb9b4b4a4f013ecb1169994961244164fcc2c733ab2c1939e7db1ee28bece0fe3bb5cd41917ce2f6a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cf6aa91201c979ec4df06463ad4283

SHA1
45568179c33b37a74e98785b0a0c6d114db5f137

SHA256
45bb58dc072aa1be18caa2f3f520ed9d59e0bf7b18ad2a0194aa5ba6cd98a85b

SHA512
35d875d29d38bf4cebc1f77361fee3c5129ac32bf3f8429d2028564b131048ab003c9d2b8f0bd1a1d6f511f472a13372e62f8fba11f18fbc0f885b1f2c68ac50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d08755726581be9ccb2d91108c7efb21

SHA1
32b9a4e54c0ca01e0b3b7ffb8af2e04d8e01b069

SHA256
6073cbb5638a9d97c7170f70438e048fc175f3496655b85e46a4ce9d8bfc199f

SHA512
263907c653a51931db98c9e355af8a48ddb67a0cad92ae30338b63847e9da2a4d894d5d6f43063cb188ecaba8f539ab509a9c4eea894d23876936162c6e55a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64bcdc82d95285d1d94ec874815a47bc

SHA1
cd0488f62f3c23d80e5f1917c6170e085526e76b

SHA256
d066a0915dbe2bb73fd3f33ecd69d3bf30ce4ed84691b1b702900e6715338fe4

SHA512
e8877c14af06ee2cfc7a091cf15d034f9e2378999cd7c8c486e53c5caf83b74ac1bccb3227e811e242327b56d4cc7a8b9340bee80f2fc779344e33dfb4a49f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB424.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB63B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit