e11a9bff19e9a1ec33f23dbc42fae29abb5601028cbca7100cf49eb97b342319

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4314c12dd2dcdd22a09ab29c5a12f597.html
Size

7KB
MD5

4314c12dd2dcdd22a09ab29c5a12f597
SHA1

4265b05c3b17f66c24b4c59c047870c50695efc5
SHA256

e11a9bff19e9a1ec33f23dbc42fae29abb5601028cbca7100cf49eb97b342319
SHA512

8396eccaeaa115a115e3a644268930e0ca49453bd2a4761526a141ef5b9680a5c0ed13ace1cfdd9368f341519aa561a30e102dcaaa9087040868f3189d4fd947
SSDEEP

96:uzVs+ux768LLY1k9o84d12ef7CSTUxzfiZcEZ7ru7f:csz768AYS/Zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000817d1c99b62ef460152ca118224ee32710f6c0ac3ac58dacd4665af102219ec3000000000e800000000200002000000062c81c59a5ee09b414fe2502ab024dbd099e2b2262329fb8e4330f1deb6ebe14200000008ac1f16ffa5f9504c8118b8b9b3c640f8212388817547212bec65bd11491a34f40000000f3647f2fb7fdca740938f837fb4e203d494a7e1c20d2927981b654cb21e1c82e2fd21f989c686a945d50950a2c7293ac1e87ffa4e2aa4b554b0d187f99da188c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410600769"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f43997d27e29bdef247169bd43dddb611175fd5518920f3ca66f00a7a8e802cf000000000e8000000002000020000000ed6b9746c7286093010c090c11220bed3ac2c35ba12771893a9f81f178c8007a9000000040ec5310e4beb50560972f45d2ef38ec27768d7ee3cdbd97b3c2021b1f23b08d96e0f58dbbafe923209e56fd6781b3c8ac0f2806d7f094683cbc6af890f942b33f57119ae4fa0567ee096cebb90f7b73981db3db92cd12eb7541f7c260592ae427bd182f005678867c07a1ef488ab7710061b169179693924bab07b10a486982a7bea489daf12c4a98a0cbb21adbc69840000000805a63d839a617cd2ab209e64ff927063a005dfafc4b9d87b9bd9f40e7280efbec87cad5459851a27c6e055e76066602bc7cff23fa5b24bcbbaf25eda10f5b81	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{238220E1-AB9A-11EE-9131-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ec15fba63fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2712	1684	iexplore.exe	28
PID 1684 wrote to memory of 2712	1684	iexplore.exe	28
PID 1684 wrote to memory of 2712	1684	iexplore.exe	28
PID 1684 wrote to memory of 2712	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4314c12dd2dcdd22a09ab29c5a12f597.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b78aa5a24c88ed3bb7b226fae3d3171

SHA1
213865805b79aaf5ceef1333a591dfdc9b2fa2b2

SHA256
5b2750cc885be32f931da602ed3c57f5fdeabbe6fe8442d4050b238b93ebcd5d

SHA512
563da7364b78f877788a9c5d18d15ce8c91d173dded3a04f8bc1f347af5b6a4564496faa19db80cebafe609435e5f2cb2f667183e3122e4adfe9b1add061b004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8c25cee67d89b387b1583d3e932e7b

SHA1
6afd4606dc79350d28c9588ab357334440e09b45

SHA256
b55d3b4ee17ffd2ad8a66c2faab634c5b73a7d1f39adbabd412b678193482748

SHA512
b49c7040cd59ce2211350ae7ae3e0f62a42c49b533642bb24f34575ec8a19ef53e2fb92b47ae7e8e3baf5196358e81a8b6f21493d984520de8f26225e96298a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
266175464a147232965f12f8b3f36202

SHA1
3eefb41ebda5e4ab360b6503eebb4b65755de175

SHA256
322a76a0ce26da55c575016b794badf0e1bdc068691cc7708840a7fa3fdcd5b1

SHA512
5a77634c2c938a2d71534a4d5f93001fc208cbbc25171c923b6adf54cc5f25e16a6129958c7f33ca85d28ecb4b7c0ed34c6fd6967074106e187070c94538acd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ec00f5c42fb9a217c8ca77c15aef252

SHA1
f955c63289c1d714fb1b6cf14750bad9ae11f950

SHA256
8c1708db258c5ad46969a4bfd867c2deccede4805d3e125277c2fa5f60ae8ef3

SHA512
d883fcb91f253eb4645c5839d6c61e2c0762d900db91f68599ac91a984a1e48c23076c53a704c561d3a0fcbc1f79add26e8dac12228dd23d98bf653670b62b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13519cb52054f96207ff56cfcf8bf2c3

SHA1
5a7aa651b6940ff4e719f3294cda1fa64ad2450d

SHA256
c233a1a1aa35b3dfd8905023b315bb8434625c6e534900846ac6c9493223df2d

SHA512
28e9ba460eb28d67af8909342e9e62f5238c725cd5e2982d13d7d56633e7daf25cc3c7a92161461c29ef2671811c169508d47a80d82ea2db98a8bf9a6cc1765e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a938af777456277ab56c0f968157732f

SHA1
ed7dd3d165305d4ad2bcf6c6d9b566e2e41768a6

SHA256
5d1df08116eb0d24392ad011f3fc6034ffffa441e4bb70b8c7b269fe79d9b8a4

SHA512
e9493d6a39382ab61589256f727e7d2ec92ee453f0c3e7fdd32728ad3f5c057ff8dd061a27eb3ef72055e8995b5198beee826a511e73bd05a09149716b09c8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c4017094ffa7c41852411182aaa4a6

SHA1
16b0e4977baac1a37d7d9704845c63fff00fe666

SHA256
dd55c1c85536924af78421f7a997e6e480ad7c21bedcda66064ef9814c1f5134

SHA512
09ad12bb03260a22cc6771a61f94833ea52597876e1d75d8e1d497fec5d34b2465c1c115f357a60ca898f028b5f5fcd1d5cbd4e5caca655a849fe4b2fabb511f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c123fdbae232d55d83a69e218f6d38f

SHA1
974a6f7e100116a7cffcc49a261821e0c46a44b9

SHA256
093d723f75db3b3c0f78fd9b957b6738dcc463654d22025e9f570714cc003b60

SHA512
77e38309fa84a8840a0aeda722cc57f2d7db5c86bac265a649fafa62126f6382739ac1685c188da27e339f7a3fdbeaeaca6f315ef6353a5dbd3b803d3644fa34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55414396fcc8dc3146007b5e32d6df02

SHA1
384bde0f161a40adda47bf3a7d6616bc1f665d59

SHA256
a53aeb5a96b3d6610f634db1a901101a1532f3b8634fe69d931c67bf2cb8768f

SHA512
61d1adafa51c79eb49f0e9e673522670370d4785f63c648a3f4ca3250e4826cac8737ffb27b724f7dfb92f9589c53822a0009194c30492122ca29abfcb9280af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1b9492f5a827c7d6a76b4cbb338dd5

SHA1
f33f3fe07b8dbf07f2d88b8434b01828c2034790

SHA256
c3e2ce6a135c1da87dfc966f2e66b6071cb79eeac1364fe640a2b55e20d138e3

SHA512
c3712359732791cb944a7f4107167bbddbc81e8192b76f5ce3029a7bcba985fe4e997e637a4abb17021399e4e2ed044179d508217a04f1ed736ef0cca268eb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3517.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar351A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit