352d529fb16a8b1c6e7fa3b1eb50508b001641291739d202c14193368445f3e0

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

418fcb06f278f98ea20b4aeb6314e9ae.html
Size

1KB
MD5

418fcb06f278f98ea20b4aeb6314e9ae
SHA1

0c9dc44c9d1c978f499594620b6fb51c2c319a40
SHA256

352d529fb16a8b1c6e7fa3b1eb50508b001641291739d202c14193368445f3e0
SHA512

0589e5a24541a4de955360d95872917d846ae013d916648d8d3c827297a6a584e8f3f78f17350ce0326d134f30e49af34110b9415a4e52a81a9c0859868d08a7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{453AFAE1-AB2C-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410553588"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000346c5d46ebbf30c3447eec7025ca5d112121a91870998386211632cc1c372059000000000e8000000002000020000000e1d84b50712afb629efe19442206d40cfd50b000b7758989dfbbcfaf6bbc733520000000f36dde284d1a6fbc72bb10705e014a808e26d9300cafd3ee179257a9b2fa4395400000000d20f831dcd27629ed872d07179d33bb0c6637a5da8c583587eadcaceb4ca99d2ad432eb0ce29612ea231e342898706676f24bee812d5a5fd8a2a4602374223a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0402d1a393fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000008f7dda463b7dd954494305aed24f4268e04c02cb39251fb0f5736552aee98fd000000000e80000000020000200000001e8d05b8b1470d20b17f20d95104afa551028c55f0152695ca698d055ad8d1479000000019bd1b37270b8c25d77cba2ba5e3d8a5eee7a07570ebb1467600c20a4ab5493111e6e39fcf39f8bd9416d480e26ed117b1e850109ed9a358add2c1bac0564f3fffb04068697762cc6c0fdb48f5d3a010712df7656f9b7b5b47b0c9997fff97007e8fab991abd7646f0e5a0f9e5c6e115b48b568d5961fd1ee85812f7e05a260714a97a634aaf4dbff7c49e8ec3a0b6c940000000a0e77aa8e5d55f772a76ea2411452422d94cb4278370b2e1b4f4b03d422cf41c7755a663e3093f44f8839649d0361dd68ee71801f07b598215b545125a217eef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\418fcb06f278f98ea20b4aeb6314e9ae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a744a587fdb8f7a86781a669affbb50c

SHA1
14a4b76279dc320d729fa5c06a6bd65116029da6

SHA256
ca37ed327396053624921578d5013866d28384225df514b8e711aee2de7b0c6b

SHA512
fe93e9caaa7b60ce6327b109b7b793207fe3af7c4420df2607dd38359788fa0aeabfc0142db27c485f54255b9a39946fac0f2b083afce4e4a7a121675b7fa6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37fe637a359ccf6c2e55541307f87100

SHA1
37745d2cbc54d8585f716490041b5bcba19e581c

SHA256
4330382d9fa708df2ed36893ea25cc4e6fed066afe135343b3a88d991fb464fa

SHA512
d353690769beb97a6cf837c51ede107ff139d9d013ab1e9c33d22ca896560dda974d6aed43016053e83f0ddaf7cf4d1cc580906de00a66fdb3d924c5b0664eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3542e72a147a6a77e227c45877ffa45f

SHA1
686e397a3e0ba9918c48885eaa52b82a15bfd95b

SHA256
22708c6b7311ac3247938f00ee482de00db22be4d11f80cb8f3e0b4cfccb3a08

SHA512
0dea61a941f42d6aeec0ab9ce58a9d2c5d3b8857d3ccf3dbb28b71803aec1de08b974d4c3d5a4e3d8f1c60b73aa4873ede5096cc2873d89c43bb048dbff25e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307b8106e2e07a4d61933a9d6d55588f

SHA1
f88ad766ab0f8169480f636e45a3bef8322afca9

SHA256
da197e1f2cc47ce42618e39eae647c1b9c63ebe6a427fc2f2212f5ed4bb9bc59

SHA512
031c6b10435d4ed8f283c2f747b058c99951ebffb29fb5c808b1979d22cf87ffaaebfae7878eae36910b96e2153211391922a36c136967aa23725288e5b14977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f639d66d49461e992eee80f8cd69b85c

SHA1
58daab1a2edde2779e5df9449d468f973d0809cf

SHA256
9723cf0f4037e9d1a46f239cec4d8a331e58772b5a9b58e893cafc9e13559262

SHA512
2e50094aad6c2daa53d1436fce95b9f6221fcbc7974da8aa6ad2017c74972cab7fb76d18b6e1afd71c4a139d5aaecdd48a04c87bf6a7a626109c053d620f06bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e62f507b4fd450980eab946fe186153f

SHA1
5fdb1359ef1a938c1b2027823bcc2e6b063456d3

SHA256
d62c6103f0d5085173fe3759fc9881f9400ad279e1978d3e39f4266ba3fed817

SHA512
f55e30d33696d6aae5b0ad2581f9f08aaf5c51e0454121f0d32cedf811b9a2c34b5e54f134df39666818587dff1e6c1e872a2c96a7cbec04c295745dc16804d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865e0d4ae51c1dbd14c4dbf8912974a8

SHA1
10f22b1f33f010104a1f1edca5b450e79805386b

SHA256
1f8beb8b2dc1ef5c18190afb5d398203f4fc5d24f8f7631e72748e483e8a1292

SHA512
7cc4605bd56de1c14e3621db9c84dbcb35a55f1ad41e2c1834d543a3b2f2e4b908839ffd1bcc17986a539eb4004ac444670d0de49dc2a89dfbb50e139471748a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e14d732c5c1a358f5d9012d66372c5d

SHA1
14a36c5703bd5e358b634c126c0374faf65760fa

SHA256
708be936bd6b5c8731fd06f476b83414f55e332ed66ec43a4f951a14cdb11a53

SHA512
2574afa1756b1bfab9663d5629aa381eb2619219dc99297969ad6f88e63f7246858439947682af4a95243e964b59c3c75ac919bf92caa2c668af818058e2d643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b41d11abecb391b61de4c8430566f1

SHA1
91f7265bb45275b91ee678df3c219816cb25ae12

SHA256
9f9d700fab916eff337dbca406b31d800353fbda33d05f0ea1f8daf7b934bc7b

SHA512
ea5bd3ed7c77ad64d30ff5df0cdcdc6ca86c15716a8631484b0d1660eb8638efc3ee84303f789450b887208c90358bc0e4bbee2df3ac900c5fbe827536a2b895

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA517.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA682.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit