5b1294e3b44e9b93c93ace5e7f90d52d8aec4a4ab50693c8850296ad85277960

Analysis

max time kernel
121s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42ae9bbd4c3256ef5946590e468ad362.html
Size

6KB
MD5

42ae9bbd4c3256ef5946590e468ad362
SHA1

0df7678933770e9d46d598aa7ad1486ecd46e19b
SHA256

5b1294e3b44e9b93c93ace5e7f90d52d8aec4a4ab50693c8850296ad85277960
SHA512

5fec5f0b07625da1dd4a7d77ee34e5ce96be8af9851597c7ef479164463b5c53841bdf50261d79e326311c679c653852ebb49843d6e4b19b32aaaca74433b5fc
SSDEEP

192:Zy/O8yw4RlDEvHLgszgAhvQydXDChxiqEuf:8/O8yXRiLgszgAhvQ9iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04293d78a3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001cc57233f322e5b90e148f38f7830ce24eb6a0ae9acad6c20eea36b343876222000000000e8000000002000020000000590c651c8764aea82bcdfbcf630e9180a766bb5e6edf872eee8c9d46b182362e2000000026158f070706e418a37d7407119567fc8e09e648e3d403b2b10c35a97df9cf6640000000fa823f482e647c6386e868cd17245383fdc2546c78635ca37b6bde7561abbb8025c659014873c53896783e6653b1547f2421ee937ae4b41de8898c43c2ac4a12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE0EAB61-AB7D-11EE-B331-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009652c51cb7d1cbd02c0d5c7887c7246a4031cb53dbe4f6a85f4edbaa27159141000000000e8000000002000020000000c4418fa524846741ed95fc9df45a815c864699282097bf7e5dc685dba6cb2fbe90000000fe46c4594bac1e593a83ebc0d59f77cb24a18af4f7415ecffdd08670c81cdd2f4fc68b370c17a930ce32e2a5c042b26222a6a71c523a9b5b049a3398e9aae3205a2212eb2a255f5ab9122b93d764e0ee1d5b90f5d3058afc9205176b72959c939faf87b14f80191619e88327e1769747d3f877191a363cee9c1259e62318c3f0ad468b232c723cf8381f374220fd5abd400000001ad9dd07efd35bc0b5c9433c9e020b2c96bcab2b05563db901a163566ba13dbf059e9810d5276ccf56450869a1b5ea8f7f07753479255c613cc4cdfe651c807a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410588688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2964	2124	iexplore.exe	20
PID 2124 wrote to memory of 2964	2124	iexplore.exe	20
PID 2124 wrote to memory of 2964	2124	iexplore.exe	20
PID 2124 wrote to memory of 2964	2124	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42ae9bbd4c3256ef5946590e468ad362.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73251cbfa46f18d75aeca00af04cc14c

SHA1
ef4ccf239e52e8fe5b4fc8a6c86f71d8826224c4

SHA256
83d0619f5cca25eee19b33cee51613755fff966b8a176fc4d432f43f49914158

SHA512
eb454df32ba46aa7614a81de930e8b8d9a45059262c52c8745fc7ce06e70f60406e80afa7144b70eb79cdee6282de4ddf571973f9d8d0b65638f195f7d86eecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90403d5e13906cdf930ce1914a324033

SHA1
5c56d16543cd4e2ff96f24d41584a336c659600f

SHA256
38dc9f16195d49b980717684d2188b42cd8727a18e3a93ce86e38f52100fbabb

SHA512
6ef6c72a527a80698266ead9e99921967e2e1fc28a02d04ee4b8ea06683088da17b485aa845d85a8fa716a88d6d95386d6b36449bffb8efe34a1f249c42cad73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a3ff0532a0e9284827bb8993522466

SHA1
353512c36b96a6cb9ea90dc742595462182858fe

SHA256
9d6c9210d95ecbe9b9c3acc60066b74731f8f04810487d1c3d44a73162358fba

SHA512
480a0b631aac80cd3f23493c6695707881ab97756c1bfaee50876cefa7ab702163aa1ebe4edc688659b4f151cf3f376ba4f38742cd7fecf3728dd93dee1f0bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4e8fc95ae19848d4f1b5fff09349aa6

SHA1
78cdb5b5f532a607dae1e56767e6b90d5bc602d4

SHA256
523a1fc4045c0d76b13a6a82c92cfb1bd5387010b6ffa6e1465eae43aad84166

SHA512
b7fadc73b2c74818585f8f425505f0e2f5fb8e5f40dc4e865f187decb78cd4f5a2887174acde3d5c3c202dfd9bcca358d349ecd7da32a2880f091b8991338a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d83de8971c630b16aa86aad42ab8cf

SHA1
7bf6153b06c5909a7c43cc5cae50781a5ed16d7e

SHA256
5bc741b07f77d2e4b119807a589bdd2bc2cd5fb5fca574e3b5eb36cd37b8ba65

SHA512
556aadb2980658353516ec373c08c256f24be69c2fb6cbf89b9e6bd7ee9c35950c73e861ab78fdd578d5929fdc8c41580ab69ff3ee20c936ce020e1926810a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8d1ef118e5195de79ef36d0712588f8

SHA1
5eb71ccd02a9fe30a9800857d30a326cf8da3d4c

SHA256
5c3881eed2d4f3676c5695a4f3248543baf70eb4cf2d5eceaa664f0c4d994f4d

SHA512
488d26d699543651eb197eef374d579b68ad7abd7d48e28255830096dca15a7147a250c7288b3a67da299b98a30e37b1418875ab209245d2febdc68f13276405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45ac8293b5232a9b0d4d252767c7f62

SHA1
f07286eba7d986630f1951d2c3c8376d36e0120a

SHA256
55137f71d737d8348422398f546fbaf69dab52e4ba2f7762d21c4bc446b7d379

SHA512
5d3b2d387e08cf6e2aa1079166377a93c293d929ab0158c6ba84f5b974072e1ab9bb8d85aab862350a200407dcdbdf6e32c969478773f621270869c33d92bae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e134fa7d092def7a3bcddb5acac48990

SHA1
1563e99d6880d535e7c74a779f25738dc1650f6c

SHA256
587b7bc90b680cf20b2bb52489bfcac650a2fec174cb4d376142b33f9caca01e

SHA512
2b9f8ed0f9f916bd28803755e0b79575118b34d4de02388bbd8261d44dfaba5db8f0355b771f11ca362cc84170af939d8fe8d886ee7d48a4a62b04c067b37853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79e8b9bc5d35405a74caf9901a66fd71

SHA1
202b48e7fd1a974308837222cdeb144004562f57

SHA256
f7f897b050198a8718d26a9f053c1658030927303f14d3f04b500a8f4798e4be

SHA512
3326d30c70ecf205dac20c8fec5cd5c7f425d5bdd52f74f5f7fba7a15c753ada92bc6a8e9b9be5eda6a43967d0b2fffe1150e0fb068002106a23d5baece49303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb611c6a7a0173f82d0af72d5d47ade3

SHA1
a482b7ad96ab70ee7a2f2ce9fa2ce6104531a386

SHA256
2fb83683220d9ce25dd09932a740880e40c4f0bb0a9269a5fc07909b8752a97c

SHA512
6c299e5fd8fee4fcae725db6e8717faa31f8df17577b03f61da89e18644caef29cc1559525cf173c5c56540849332f608c8764b427ae84cf48d68f61b5c2a338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a957c965e44809b68f320496a3db9a8c

SHA1
7d35c18381304cc1b7989b0fe6c2bceba38c816c

SHA256
d08e7dee9bae862eeef4f3e324e49d1de65ab8f60fd41a2e163ad2f72f4d3aca

SHA512
fdd6763b2d33c7966abaa88ccd92ca87dd6cad4c9809355a4c243e2610ab180af6c0253a323322f7fff2eb72abb58024a193c8b30f47ebc5d36fb33d2327453c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7a205979855cd502c4cc76ccb6c4c6

SHA1
08265b7a7333252c11c30d49ce9da2e276a549cd

SHA256
3e59c0e5475e06a6e31b1f707f253757b1c00102d3854c9b24edfd731bf1229e

SHA512
74a33c20ded88baf57337a489a90c12b0855e040333ca7c4af5c727a2fcc0d0ff12c28cfe97e8be5f2717331cdf97c0ec6a1f7b35396c3888cac471353e063c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f8120b1f45903cbc160023a94ce6bb

SHA1
841267b447fa9eea52ba833b17617268b32f1bd1

SHA256
b5da6902286f09ce9a92560769a2443c2efe8a7abf438146d8d5f91709f89a52

SHA512
eb7119f0b94f544342d0cd4e27d3e7cd6cd503f2d6d239b341bf62e55af725172058018550138ca97d7871b8e6e66056c3821a8a461526a23fd44a9b6f712892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0129f2f3d96ba22193618c9644f21990

SHA1
c71a5130367119a1e2da2483b0a7218a30ecdf69

SHA256
0d8f3e7d65cc04a05fa4331573040d37eb6f1a4f17cfe4e9dc2098918c294173

SHA512
b5f3bfad873ab4204b3eccdc8c8da964ba2bc7b5dff9b7b21143f2e77db4ce186668b207c119f38c219f7efd3a2f171f236639df6c68c79b176c5b342656587f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD135.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD5AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit