8ff8a1b25c6bbf85613c81e87bcd95ebe6274aa8c5347447f54117dd80120070

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41b20a9d36474e1f1c13b79cfc8ae9ca.html
Size

1KB
MD5

41b20a9d36474e1f1c13b79cfc8ae9ca
SHA1

22a112f92944d909bee6fc8dd4e4689a9d543755
SHA256

8ff8a1b25c6bbf85613c81e87bcd95ebe6274aa8c5347447f54117dd80120070
SHA512

ddfac6e4abd53e515579338a76006e7c690b443d7712015cdeb21ff96cb258cf27652beda4aebac8fa254026b30913dfbbae920195949e31a378b30407f4436e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E526BE51-AB35-11EE-A8F8-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000079fc2c13da986ce002a8c1487d4b3dbcf4e45418bf11cbeb1a8bf9f311447651000000000e800000000200002000000083bf93374a9fa6a258400402baedbb13bc7c60d4c7d9e0be823cc8a799e436382000000089e587ba0e868ae388a9fa958dbe2a4a44c15ab0c231b44bb54d0b25026a00234000000025a8b5601871318385b43430f09407721213ce36769ecc7c842a1df40eac7b3c9c696e45e88c525a541c806652ebdef679e0e285d573f8a53cca0df1db40915d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000028a9f33fac3c43829a2502e8436e4647795ace3fc506cb432e7fef705b83b4b7000000000e800000000200002000000030ea79aaa016b92e775f1ea4789f013c2faf07ff6b3b6a9e04e540e763cb1eb590000000894606819beaa49e06b1d08dbfe67d8221ba8cac5d39be1ff7f060a7af5ff5706a90e377b7aa847033b03c9296317a3dbe1320c0ff313fc95d90195571c533055a799c89856716967680f6714ff63685eb339e7832b7036980b87ac609484bbdc1b3e38ff5e2d4cca9b29b679c592eaf4ddc738231d60cf7501212d98af8ebb5b17b817201e00936c5525a43b3ec99bb400000002a454c0e642259086c252a94ad803e789ad739691d46cfe20f716f492684b1785a3c76077e1a8a84d87a287346f9088ed05396b09db404cc79a1df0c003a2a32	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410557726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801ff7ba423fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1932	1988	iexplore.exe	28
PID 1988 wrote to memory of 1932	1988	iexplore.exe	28
PID 1988 wrote to memory of 1932	1988	iexplore.exe	28
PID 1988 wrote to memory of 1932	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41b20a9d36474e1f1c13b79cfc8ae9ca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eeb595551ccb71b6f8deb32f69622a6

SHA1
4fdfcf8d7c20556c4acad1e0d635ce5c69bfde9b

SHA256
2a9c96e4ad9296c03489bf7346360f3d0112914c2383d9a853f44cecf7b40998

SHA512
9fceca58452079872d4e74ba0dc7bb1f140c810e8b28de2a65a72a4bd8f2f27e4eb9edba9c3e5447b7090cb23a3f109b4d8b28035fe4cfd2fc855a7334973255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2efbe6fed07e238c37e02d6fb1006537

SHA1
c6cd7279325b723f8105d10fabbbcfebe08e4756

SHA256
8e3583c8cce691f8e758675d404c7e6d838746e110e971b766341dacf1f37dd9

SHA512
cc4554701079a70d05e42798cbb03bed25ebbb87e8299087aeee5f1b0141da334c38a9f483136d846c0899d812b001bcf9265b8979095db18a7b77914c1c02a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
938dda198ab3f784dc29e804d7bd54c0

SHA1
313ce7680d743043adc5f4c0b84607e32556e207

SHA256
52ea354d2731e679ef31d7ab357f01f05c581d3f784ae07bd3f1b16bcc5e379c

SHA512
fb0cb083d713f89c1f88ef03b6d97e96cfecfef7f07529f8134189ef47cd6efe7e2fe08199ea62f0d5ff909dc7751a5c8e5f56ec706d23f16aac6c3463415d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd792160eb7c4986399415d0ee202b5

SHA1
91d18bd4110ef791f1df8b207d19d5c0f1d70702

SHA256
4f244c7b53d84381dd2bde4d2b6247e64c2ff96d6ee2b15fc4f429f046c8420d

SHA512
79c7b920bdb1237107592c767cf394c62b39a9368ac6d7cebe7bac9aa7a40a8b978cba226644f2a4d2333c117749224d64033292d218c520430b63c1ffff56eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9975decfd844fd33e583284538fdc1b

SHA1
bf6a23c8c676aa92a84041df1d4205cf4a2433c9

SHA256
d65ab700dbd247bdfe51533c817307784c49905ecc11f4e2ca7d48988ee1f4ab

SHA512
a2e8b14acef34e818e5c0977838c19ef4b023efa83465e9dd4fb33ebdfbb0ce410ad8feab0a572208dd8bb73ad617f324ee2507cdf8b376d30442752bb8bd186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f5cbfe9b7c91e0da9b01078e698d40a

SHA1
6bf47d4b42e26e65b6e270811ccc5dbe23962b8e

SHA256
ae3477efb71c8d79dedb53336fc6b562002dc45fb47da06137bc585fabc8ccc8

SHA512
57305c3da72799d2b9d5e91c9f11edd226cb16cacf97214dcb4d2df485e15170c47d9114811cf55a7c1af5788378d3b81e4847093caf0c5d2229ded846b1f23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9208abd68498aa41867851d1682ae467

SHA1
465b552e9910579666a6b6c2a877fecdcc583128

SHA256
9e43aef9bfbee3cec057aca329466f53a159580ea5a2733b18e60bb9dc4f4ead

SHA512
b603170ed392021d9b4c938c77b3cc22762199f65b9bd7b874578613e596d68d470aba3027a5f89edfb9e5597c888a367ec68de7c6398729ee20996eaa4da6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b0bdf91a5d087906668bbb67cdca0c

SHA1
1c298a435237a3bfd69b3fec9e71cc8fb7b420e2

SHA256
acce94e69cd751c59ae33991e11b15464cbe1a60cabe5396861e87b88bba1803

SHA512
276a0b51cc5b201f655e5773f234ccbfb4126bc78a0cc3fe965f94cbcfa02cda4a42f34e05b07acdd90f5fbefa49263bfa6ff212ebd02a0de9d0eb15c4787b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab123429133e721cf6e6893be96f672b

SHA1
43b9179d624c613d45f2ca31591697f9ca818ffd

SHA256
8410a8e5a86053f820ec0742edd3c7a148cfaa6ff57d9486cf4e9617fece8f5d

SHA512
ea4fa6d564d0a0aca80fc9480ed6fabfa827c2dfa07246a0b9d4a3da23bec0cecd145afa1ea401ce9f18c198cf3c99a5f5da6d8a6c6f6bf1e3891c9be9e42595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7908724bc4059358a5407d1b563568

SHA1
36464b000cc40c5a1db71fda6efb55f6c50e4573

SHA256
932d7498f197c22310856196405b6eb92fa266a875a969faef65b9bf9e81fe69

SHA512
145e0aa104f4ef668ac87c2568ce45fb8edbc1e43cb5d7f1dafc945722755743b9f429186ccfcdd527cf7970caac7c1cb1e0d2b19cd37e3d8fb96b537d4c9c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045eae0d2afdf359a7f75c748c6be48c

SHA1
5660ba4f8f927d7b8478ba0f52c97cd95e7cf08c

SHA256
cf5656dd9400c208a6215444b40c929808847a6b10eef109223862b5b8701d17

SHA512
7b120ab2588e1e71e721828e616915375c6102fcde70e062fbf845b8fa1aab10eb859b36b2e727d2a809e691237ce56a2d22cb4ea67f6271acc0586b5ac57d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C02.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit