e7d3bace5acb3025f07822f9ffbd287392fafded953a7c008eb2ba7ca159495d

Analysis

max time kernel
240s
max time network
266s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

424596520dbc8e515fde9132a0e9a3fe.html
Size

10KB
MD5

424596520dbc8e515fde9132a0e9a3fe
SHA1

7345f906ac0553f48d980d03e740563d0075566d
SHA256

e7d3bace5acb3025f07822f9ffbd287392fafded953a7c008eb2ba7ca159495d
SHA512

4c9f309382ec70008d0876f405f6a52c78ba6758105583940af6ead700a5be1dbcd70642e5a8a5afe99bbf438d195ba4d649a4cfd5457c2e704192ec8c202f13
SSDEEP

96:uzVs+ux76QLLY1k9o84d12ef7CSTU5GT/kpWps3HKaU87Xh2p/UGUZO7Xh2227lg:csz76QAYS/8aoCsZzPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5484ACC1-AB5F-11EE-A018-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000004b906757e40a5fc69a376c5b518020fa3d7ccba1b1e87276fedd9939b9468105000000000e8000000002000020000000bc30ee238160df112ead5627e69202f4570956775ca3def762a6cedb0afc7e8c20000000b24851c38c82f8ad511eab6e96247bec1b8a83ecbd0cbdc221f73d702b57182a400000005e0c14fbc421b0f935a6a3c1573c1e85676923e6d816647311f5d1f2d8ea642783bb1ff603ff8f0eafaef29bb3f18fe17026d8567873b9dda45da7781ad46753	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410575544"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000bc54f85d52889eaf58f02e1ed9dfb12d8012bd3412e7d0de2fabc655c9210cef000000000e8000000002000020000000b4a9890ac2a1066a61f02f7e0f3eb55aba0575827687850d412892a36bff118990000000699866a41871ae072bb271af5a7e1cebc34a17a89b8cb621c063efc85962638e87bb4f95ea9195fafe5f75de224638568d440eb7d89b01ec82f64991e5b90c44353cf48c5958874e187df6dc5f0a9e673e092f9ddfb25865c4297565fcf2b075b9c3d3b3c5192032ae928488c052864c155f5e93467aa6cef8172225d27a247c3de8e583d6cb42b1850828525c7605da400000003555619db2a5f7a79f6c9f73f71ac54fae380eb1f6b040c9a30560ac1c7ecb999b317c36ca806c83ed1641501dab4ba31f6cca697810358e18eaed6ccc7c1dc7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e96a3f6c3fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1048	3028	iexplore.exe	29
PID 3028 wrote to memory of 1048	3028	iexplore.exe	29
PID 3028 wrote to memory of 1048	3028	iexplore.exe	29
PID 3028 wrote to memory of 1048	3028	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\424596520dbc8e515fde9132a0e9a3fe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a3438bac07768c628be614529cda09

SHA1
12cc0c7fad9f2ea4c62ef610c51125cecccab229

SHA256
e6d1e1bb28bae9ede82a28fc15f5337f9b23ccbc023486743976396d74540817

SHA512
618b979e801a308b4e3a484f4cf840f464c0bc5693e0c269cd45b99c34960483164e8e0f399af741b14e95993fdd1e72010f0e92dc5bb4e5038898e9398e8802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f8642df0bc892e30970d30d76e7432c

SHA1
3dae3b4577aba4a34e71c2f50f1a6fabe7c5203a

SHA256
e782f34b4d99b50eaab0b09832bf8370074429e3e4bd0d2e10c4f6eb33fdd2e3

SHA512
7a7f68c5bb5cd71af7fa3b9d8374352709dd682d0bfac251a6442b2b869dcaa43dc9ee475e90151d22d2c1798146577c2af8dca69abf6eaf88cafcc054f8e5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e501c797dcd031c2d4862f88aaba4a07

SHA1
4086044985870860e2fd849a10180944cb9e2e3b

SHA256
b8457995c0383fc2272f1cf584cc8c5996a917ec126995a922e705ab9d3a5150

SHA512
99ce43cabfed891061b9f307d42e4104ee6c86baef379bbcc544cdccdcf0ef94ac7cec51aa2cb804efb2b7f5856c750db8600e2361fab1674248d37f9ed34645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c7bda0863d625dc39ccd4ccbc48d960

SHA1
5b032f2d93eb334d7d3e43c37119047322652eb2

SHA256
6b2e286037a52a0bc72e7a94078887d72822e8f5f19f59b3e8f7b3d81adf269f

SHA512
922433e215fc1d0443f15d09e15167d7b33fe4a6016a88216da60c5ba99e3524057671ca8bc7d0ee595c91ced5a8d75817d7a40c122cfe5deaecf78b2eeccd3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22144e002bd79d6111b6829ff8954ddd

SHA1
d02ae9de902a0a186162efee54452c84389c26ad

SHA256
b31e03461f692ecd87de5f64d6f358931f821520e026acdd0c34bf40644e013d

SHA512
a865ed351e6b3bd8abfdc51523bdcc5942bfc9b8c013c3d032f4464ce1ce2cab3435636c9961e9924a9e461774edad8fbbfe43acc08ab503b0cb437918b20112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4687da7d26575dd27933bf382fd26a8

SHA1
3ec5f3ef69835d9f0935c2b5b1d82a3dee7ba0aa

SHA256
93ba23986113a638b84b9c2645108693512f4bf891e3b27b09fdff3fada81fa0

SHA512
78b956d6daa30dd5a8fdb162123dff330b9b5835fd4d5d0e630aca4f4392bf52960143cb5cfa124c8a1a326d7f900d3e0da701cb27f3d57bd2e5bedf666152e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30da71a4668d14b9b6d520ab01ee05b

SHA1
68a0727ea061f831db92e731c47b59ddd23adcc8

SHA256
0cfec9745b01a6594b69327c44dea183aba372bcd9fff61b094a55a1c0a03898

SHA512
57961dceeeaf50bf00fb3d9de9726cba32a3d8a6b7cf5b3adb1f4edf1097cc20ae11d2397e1ac6aea5881ef6076198721dd47b7c0ea008b5f4c1169af5fbe472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe707730b126428013b8776e1cb6d224

SHA1
c3c85575b5d169d20291e3e01f83ba832cfc8abc

SHA256
6fcbfa1ff58306e732dcb52daea253446733654aa6240431bbb49fa8f8afc724

SHA512
2aa29beaf5b99b0340a702aa1c6cba3d83c1e863c2515f9ea05721d9488d835666e38ac012f364891a6536ac9081f15446e50c33632ab114a4c6a17739b4de00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82f3704cf61e52a3474b0aa3e83ce5b9

SHA1
dd14cecc6110da9a4e6d6a5a03a64d0c98a5a12b

SHA256
57038fe3bc81158dfc66bcfc205fa8569a9977e5dc0926323330b4d336f4f808

SHA512
7d6e57a4893964cb3557066d1900d1e82b4b408a9670f5d6d6beca7f1f89f85f6954e2ee0d8f421fbae2f9bf334e1aa2caec28e4e651f98f32eed82987d4dc52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06a9e4edbb057e01be36d7fa7f4304fa

SHA1
2e4eead4376f334f11e772468c9217ac4c7c57c6

SHA256
4a600ca56b48cf36abaf573a9552aa33a460b5c3068abe82baf4f179a688e746

SHA512
f117fa4709dc920334146daa273c270acb2230c938792801d90541e6a80154b56f6d870ce00434905f17d6fc6bafe05374a3c78806d8eb2e3c70eaeb4a50dd22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341233b1b6f24532d3a882220b9bb1fe

SHA1
2df88870fb30a19c16d0b7f883d0488ae560fbad

SHA256
77b6a596cf3aa488f8cff6486e5e31767b4f9b8a6498a967b06cb73884af8a04

SHA512
8a6866c10419b89e697c2fee029712bed2e98a38b0944035abb30d8a5a292906515510811ab81e7c8d7bc07ac6c0917f794dd30e360f77be9591e68fefe7ce53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05f93548a602c828468c4cc9c0283cf

SHA1
4c9720812b720e974c3f9c8595034edfc13c6ceb

SHA256
e439e07cd9d732600dc1d05a0c7a4ecfd6f5a9d7e5c1fb4d37ddfbccaf4ab349

SHA512
f36a98f0b24b8cc47108fa690c3be33e49307d62adec120f7ed9cd105cb2c2d488767b7873c86536aa0517d06ac87f1dbc8362c64351d59dcf71fa4703e4f5e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b943a74c0be07cff983fa95569d0fb

SHA1
4c0b78b9927f1f8f11cf439738afe02705777376

SHA256
43f24d85d58cc4979153373e5cd6d3a8772b931cb3eda92c64a27116af71dfd5

SHA512
fa4c760218eec97fe58b32d9011620853ef95629dafed47fc19d849e7bf0bd1403b67e5d09ea2a87801fd6c6c3dd588afcf888e24a70fe9f8bc9a1d76636b152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fedd6c710611bc3898b51a1743e85c31

SHA1
9ac325d46c32277d0f7b3e7e11732c429317053f

SHA256
8eb1a6185f04a61fb0b741330f00aa0e2321f3e9222092117670a0e139d65f6e

SHA512
f87f8872664da314fbf440cdf7bdebfa71e59ece2b0defdb371a43bc520d6d13093381d99b4e44432ccf9020f715f373921953775e1aab5748cce605d46b311c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA27A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2AB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit