1cdc9c579c9dbdfcb5d5ee1cebe0f7d751d2f546fcaeaefc1fb78516d3829e7c

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44b606297e1892848137fb3ec7a12c6f.html
Size

2KB
MD5

44b606297e1892848137fb3ec7a12c6f
SHA1

741644423dc0fb9192c8214c87feb4e26c5862bf
SHA256

1cdc9c579c9dbdfcb5d5ee1cebe0f7d751d2f546fcaeaefc1fb78516d3829e7c
SHA512

4b2e1983a2b97bae4e485865a7e43af5760599b94b0dd64bb4b16a2a35d40b91bbe80d0fa998b57517afc26dd9410b678163d31cf289251cb9d9b59533bfd8f9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f5dad404d9e9b71d58b7b82b714df038460ccb7c191562dc51b3cee2ee921dc8000000000e8000000002000020000000a42aa3bfdeb59c26c0d89dc9da229cbc5491cd372e790ccb31e68fc0e09700c890000000db1334570a575779bf3e4a332bb4b0cf805d1b483f326a80d28a5ad347e422fa320d5d82c3164055b88d59a288a12598baa79ea38715c6d029e4bdf1fc6765a1e6dfe1b298ec12b000af998bacfbb3e04d00aac98458083e54f0065699d9410ff593c18562ef59a9679cd130adace139c6238c7251709ad7fa77af56295468fcdd8cbafe7534440c6cbe88b70f7d474c4000000049a62cdb7c3627fc71795e1b476ba20dac89d7451bd7e5c8278d2b8545ed7428f740f9f06c48e6347c8d259e7981e68726135ea2011116eeb465df9eacb3a135	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410659491"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000971b1fee367416b34b47ed23cfe2d17e0a65ecd629789d8c5b1d4b5bb0e803b000000000e8000000002000020000000cc4ad12fe26dfee32d5fe5c14a23732d24989beb0b3004aba3175d906553328720000000d81a0d217d641ce339586937076f729ce290c5cd84a5c4047a7c1ed622a43027400000004842608bb16d5d1422b8ef9845a1e27d86916c3c945edf043412d15e805d5d479ce2f7492ec6d51301adb3aeccff01e2ec55a9fe5fbc38d5c79893607bbfc28e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7A30A21-AC22-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a98aac2f40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2084	2252	iexplore.exe	28
PID 2252 wrote to memory of 2084	2252	iexplore.exe	28
PID 2252 wrote to memory of 2084	2252	iexplore.exe	28
PID 2252 wrote to memory of 2084	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44b606297e1892848137fb3ec7a12c6f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b1448406caf1e588c7650448f7e68fa

SHA1
a86e47b427b5a941890d0bac84b7b3cd5446d705

SHA256
4e9ac712894392831180aae283a0a056000abea23a2682381af32941c5af4966

SHA512
8bf6eafc54ca092d1790bc70023d1512a811a7294ee44e4c28b0635189b1c268c92799ee1f516acaa0a880feba00bee2667313e1074493abdd258941405ae68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac5483e74419cd2605e1a3263fd6d836

SHA1
bca6b34ae61bee1f5b4e0a43c735696c95d35d8e

SHA256
80fb5fe90d83c0b1618b1c33152570b12164005b652803a0430b23152e9b5660

SHA512
0a3f6f8f7265c58cffe9387ebce3bdc6b606270c4bf0e4c3edc891fc62af4048c4f159eb58105fb3f79005fd561b1ad13389c48d23df485ea6dd09fd3b98b2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3192642242aec09033a5d364f5e64a74

SHA1
8627f6048aefd3f0c5837b268cdbec2f0346f29b

SHA256
e1e8b70fc03bd7514fdc6097fb837cfbe0b0514c13b6ce91f51f13a5007e7f96

SHA512
448093d9b2dcb5e999a0edb08eca7f933eb300262e664691cb2b57fd809f57ceb0e5ba26264a2a88648aa19e685e1e46a4c58ade86e4c1a681230eeb1b677974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668da1d99759920e288290494a48a118

SHA1
f2636f7bdf47680c0d500fce539343fd7c385cd2

SHA256
e608e751c6ccd5793f0224e87f494a27735f649fce5d1d3d3338d08db2ee8eeb

SHA512
2fa4abc4ec3777f846bc14110594c6c77bfcaf5f54181e5a38b6d6320cf9d92e84df7333b0321a238361fec3247ffa66611d9a17c9f4a531667ccef19d3c1a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e76fddc77d134e1ec57e4ac4b97911

SHA1
9964640b45298d2371dfd46736dfb5aa959f2f24

SHA256
3c1bc058cf9fe0a18a723bfc660819f68361602980756f444e6ff8a910268867

SHA512
9492e0fcc98fbe1b7846ac710ba790de122bc74363cd5c8dc1d9bcb62b0bff97e5445ff2b61df15a4c4da42930f717acb1140d3558785969c594165daa648d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7986ff31137c0711ae8e991d5e139b6f

SHA1
47748504df389314b29c270d04428938c32cec4b

SHA256
54b1c42e9609e4d54e1118006ea09ca7880b4345ed329d709fa0674408c3c6fc

SHA512
2fd7970a0e72e8f7cf9ee460cb776332878edac59df6f56a1e51f0bd9b979968dea678803123a95c360a0a0eb9b47846d111564e16cd5bf958640496279e1f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB271.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2A3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit