9b398dfc1691934f77c14690a2359ccd51f1769f141339f182cf08ee1679f5c1

Analysis

max time kernel
78s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4268d4663c7a17ff2016ab0240cc7019.html
Size

47KB
MD5

4268d4663c7a17ff2016ab0240cc7019
SHA1

01b4279ad9daa5425cd2ac9b1aeeb4bf5ec3c0d5
SHA256

9b398dfc1691934f77c14690a2359ccd51f1769f141339f182cf08ee1679f5c1
SHA512

04a29534dfa2492675d42fc75a42b90714219540bc645113c209638641e3cfc0e6122b8e597d51e5bf8c45d8e0b4c93caaa439f47c838b025ee0f1a3ebaeca95
SSDEEP

384:cxhh8od1j8xWsdZDSWuXbC458w6l3nBpAEwAvPae1HsUKY:cxhh8of8xTKsXBpAs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80081b0c763fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33BAD4B1-AB69-11EE-B07A-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000826edd077b92aff2fbfd5490f32d14bc17af1abeef0196eb2b4a0f55bec2b398000000000e800000000200002000000077565798acc09c4e202874cd1addb1fcb710c33138a7a9ac89463995a417be67900000004999d78019ea8aab806aeebe5045f73ea3cd0e2c4f61324ceeb3bc23522e562f8defc498acb3e6dbd5d7501ca7341135dd6e8186d2ab2c939fc5ada77aac300487c5a7149d4b54e23889a12f8bb0bb8c694f0a5a2312ac92789dd9ea6c677538ace27012811dd9596bee1706d21ba1be50737007e105e052df1a680d1546e713518e853da02d7c70c306a4f34e1cbaa74000000030c4173db3c2546b9200d225e89335fd6082a02c8175171350dd8b4ade5d21eec5164f9e01c92b9c4af81f421ac6b4f03c5b633616f47864b2099e6ff1b5879c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c93dfe2718244cc7d745612cd311a14c5d325318f047814ec041edee47aec64e000000000e8000000002000020000000e5d1c6883031fc7f27c9bb39d4fd6979d54cd5522715556e6269562356356e2c2000000074882725f8ea814dd8a6aff700c92c9a2f5f3373bc55e852bfac19552fcd611a40000000b950d851a716729096fee1c67f9210c6ecf4f00ada96cf0e58bab186b4f00506cdaa7196e471ced60a6e66327f85f1a244ab151344e12828be05f42e82f60374	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3044	1936	iexplore.exe	14
PID 1936 wrote to memory of 3044	1936	iexplore.exe	14
PID 1936 wrote to memory of 3044	1936	iexplore.exe	14
PID 1936 wrote to memory of 3044	1936	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4268d4663c7a17ff2016ab0240cc7019.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c09393bfb728ab9b45c94e24c404ac

SHA1
3c4f29637c0faf1b3e5335955773d7334080e436

SHA256
ed6c07d141e59706ee0e87224bcdfa1158dbf999708c95aa113e1de504631945

SHA512
5d13477843e626faa0b668ee74af11d9624a0faac592560b94d34248f966d9fea5a4b4bd25d17d17411c40254f254dffcc0eb490b2a2298bb232ce8d258cd8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1716b91524e4090e24a83af4f9b0abb1

SHA1
e62a08cd5f08705c5b612e45aa90c0e0fdae75dd

SHA256
abd60583eb187e17a44399461f3a49b21d00e5c2599804313749004f4e394611

SHA512
6f8d55bab8ae6ad75c47fd860f927a54a66341a0df4f8a19cd35b57704eabd882112e899d239ae2c5998b49e4db1ffdd47de6f3f5e1747a35c09d78caaf02371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d10beb2dc508f1c85d21a7bb85c748bb

SHA1
df61fe75ab4e68e0d75d2f15b88cc96c19ecc6cc

SHA256
5668fc863315e5131d5e8fa00a42e228c0b44c26b05e3e7258026d1ce84da497

SHA512
5fbffb237445258640071d0895af1876bb34f4e2bbb3dda8dc3e3cf75b79814d741bedb36918686f2dffd58bb134d6459de7af6e44c15e50bec06c57f23ba654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
864c7ad588dc5e80b05bf0ff0a10788a

SHA1
2f706874786a863ed0df872a37a2a7a82413403b

SHA256
f92bd13bd57b26a7f184febd22957ceabef6bac5eed96b83f1d835bc37da3efb

SHA512
6d0a20ee40614d1248c148f1d6e56a2ea4e98f22efc0009b0325482befa9f30c31cd485ad187e7aa5424f597dd8ffa5d8531fca38a9d7b429ad88211a839401d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61064c2d735a61e973abfef007c2b15c

SHA1
b24bdbc438eac61c6c5cc8b9121a4d5392cd705a

SHA256
6f1c569f5c70c39b70807cc53c550b0fda3eeb917625fe224f308fdfbd2c2871

SHA512
c2a71a904eec58fa6ccabb59d97eede548dd04bb4db14792b94c7080ad621d222c97d7c44bb636b45a00c5735b0bde1f50fa7fa3790e4d2e07f289922d50b5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e04ef28991abd2022ecc3c53b2f056d

SHA1
ab3203dbe6a52d695ca1b05a52ba802e3ae4660a

SHA256
d1ccd5d4a70a9e386e009039ef5849fd040d8ed92ecdd763e3c903fa2819b1fc

SHA512
2c8bc71c96f84dcc9dff5c7d433639850fa665cde17965fc2eece211abf47fbf581a582fff2fdb21293b01eca65565e5709a78b49e16a039d6b678e04bbabbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b294c05cc6a22c782fd3864f8c908b6c

SHA1
616440bceb4bc85a845d643b04be1717f90a78f3

SHA256
760983639a9067e81ce9ec5e92cbae021e67fa6dc34a33a6b0d36299caa88924

SHA512
9785f839cfc23aae0264b3e7abdc4ddcfe7abd69792f4df7a6cf19442a8b6c9fe84d08e9459aa92db63a6f425bff36f22af9c4e9f5bba2acc1cea5fffe732a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
434ba591b88fa9af130947bb0f2825f1

SHA1
269206105fdc43db26b1be74a59bf29d9151eb8a

SHA256
18663d1ed3b0c647865301cee770221314484ad3eb78c48435539c1484632d1b

SHA512
df4662a078cfe847741feb50d1f2772fa1472cd2472c4aff3b88c9595d63156f4d21470ae4542b6c6776c9fe2e8d8ed51611ee2a0496ed9a0589a21b3520f789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c27cd93485b43f97565bc3f32466a86

SHA1
53627f618760d2105a829d9d406205429486a063

SHA256
b2e6a4d584770c9489b9103a83d753de6c4404cf5315be96ff377d3fef2536ce

SHA512
14b05216a5b0ca17d7c0e42582d049a72b732967ad5ef815a8fdf17bfe8d57fdfd4474260218a6b9c8de1d40ead96275b661c7c95fdb1edd76fc3a5f96a95af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2d3e3643ae44f2fa9c7e35ca6dcf7df

SHA1
3bab47a09020a50d88eb24d9d614b70545513cb4

SHA256
83350b03184ea8444cca7256a29da448012c1a63185c7bc3f7caca018fba9980

SHA512
1ba189f6fdba690a6b49aad4e586e2e4c60579b6f7f92a70578e109840acb1df93fa4a93351954c8b6a02c2fce385f5596828f2bff523586ec60c0a7e9a1ee3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327daa81f97c746aa5e16576cf4d24ef

SHA1
0319ef0a384acebdf8a3d58754e109d80a45aa99

SHA256
ac32005c6bb2698fe1cca7b2a2ec9c1ccc4d3880c57205b4967d21844c40cebd

SHA512
c14c980a4ae4717e5608954dd6e4d7c626237ff0c009ec72960cabfd8e0028e59e98cbececa191a67ba014f289d2067ba43991eedb0ddcb4040cca89b2c96c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b3029b14860868ad6d64573a52fdffe

SHA1
84a6b1eb9f644a61de48f1859932ab8482baac6c

SHA256
ba83fddc8ea61545c4b2cab723d398374d69a97ad652ce21cca5adf787c0e000

SHA512
b055016a527c53c5e89226493fc7a97bec1b72ffd5411bfe3c1d7fb8c632b9f4f25c75aa5d3245a53aa9b8bde09b5c988a9587971d1f4ab97a7c237831858f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06e0fa1dfcf1f5e5a8feacd29843b86

SHA1
e0c959b3724f6e42a9de401f1b7e24ba82ae5f38

SHA256
9a0df5b58bf111f40eb6b73259cd3c430f6f4426dcdaa8a6b06de8934150cd64

SHA512
7b9821b3a8a2dbfd35c8cbe4f610c95a7e202bd98bc16bbd139c59fe3883658d3e38f98fb0434c5f51219a47c5cf92a25e0949fd6c82fe5ad345443891fb055f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B1A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit