a2f79f2b124613f07243d3898dbc33c4f4802729167cc268a957bdcf869d4c3c

Analysis

max time kernel
119s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4316141b10535398244bdb69df7c8065.html
Size

104KB
MD5

4316141b10535398244bdb69df7c8065
SHA1

6e99702f2cf7592a04a57a14480baadb76252404
SHA256

a2f79f2b124613f07243d3898dbc33c4f4802729167cc268a957bdcf869d4c3c
SHA512

2c5d6f637b6ec26b957f63f4ad3381c9b04354e30952e4c197d78a6f27f6ba88dcf85af87783fafdcae535bcb3fc1056d139c74e80366b55f8d9bea397c162d7
SSDEEP

3072:SOxIi38IP9kSsgo/ZvxYrtPTKCNtHyUtCuM6D:SOx93jVkS8/5xyP2UtHyUtCuX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410601812"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b570223ed09f05d3a4da7e9870e8ef9063ccc8123820eb18442123aa5a2940b1000000000e8000000002000020000000c9023396436d1a6885438dd08e98112c1edf955ab205d8eb5a3de95d833194d790000000ea1940813ba89be4417938b71424937a373c51df0cd9a8ae044893980f3a90c9562fc5ff580e4f9c475949d3cf1aa69d95fdd6d658338fd53bafc7a8c27a86724a6dee0ef350f73b7f7a66fb16a0274924a0d51a4defe00c923b3ccacba47670f9fcffacfe5f513525ded215c94a2566cdd30b4879a13d604839f852b9593935d51f8cdcf0a1e122b9b4ce2689e057c040000000c77be8dcae8bddc70a0158fa2ee133b401c6ed27aa2c557a2aab64c219de2e1ec2c984af70253d82ccfa0418424085fa13e7005f457e8427f3a3fe856f374a5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000073ac7be756a83ba98b23882dc8dcc23a479b669fcbd9e0925f3d3691240b584000000000e8000000002000020000000dc44d34abd33ae7d1ef74bf05eb2a18504313c8a8f38e0718cc69864607f0f2f20000000b7e7b9f3681ab662dbc82b4a903574e8ea02130cbce38c72cbca243b3970ad6340000000344068384798062da2a761f4a482f4d0703dd76876150b9ce4040402a7dad43a3b1fa6a080830ebba341cf7e352cdc498b28f3693274056d1da6a8dc8a24ae58	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b54263a93fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{864308A1-AB9C-11EE-96B2-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2732	1244	iexplore.exe	28
PID 1244 wrote to memory of 2732	1244	iexplore.exe	28
PID 1244 wrote to memory of 2732	1244	iexplore.exe	28
PID 1244 wrote to memory of 2732	1244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4316141b10535398244bdb69df7c8065.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ce93c593cc95dc60f24eba41ff7902b

SHA1
23da540c41e045af9f984876523bae0098dbab21

SHA256
09bafc52f74140690c57042583f4baefe4032872a4b82d6458f1d85104660c53

SHA512
2a4dfc5e4a585ed0def010fd8aaf4e171b763b6a1ae3458651c003a5995759eaa7e77a9f33289f1873eb7c7643778deeaf4e40370bc04c029d6ba17dbb118b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0cae2c4a4f578abd5229a41aa51fdd

SHA1
bbbfc35b051d14388246a34e77d3c0160894f9e8

SHA256
e7c4cee4fbf52150bf4eb83a10d23d9d33cd24c60873ecc8a6d80200fd5011e9

SHA512
2267167756f85fc108956b1fd61c5d4415bafc65b3f1e3064032d012a1fa24afb6cc071c1beb52052eaf265699b1581559d4cffd091795c3c39936eca3d3c1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d2282979de97ed85307256b8aa457a

SHA1
794d1381060fa12bf0f9e117d6a72acbb37989a8

SHA256
ca4e85a43867fbb87f3802d5c2416f689e555cd09c992989163ba0dbaff3b5af

SHA512
274e391fed5fc9736f8effb4463f69a5d094f7d7b2fd6ea7e7d14fa0a04710b86163ce73263be6aa50dc2a55037221165f748e6ce5434fd3f81a29dda6eee4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f08bc7fbf25891de9d0631c18200e99

SHA1
4970a4ad13bc63f99fb89b8765a272bd4dcbb46c

SHA256
2d14f2336df0eebeb3a423680faa9ab40810d8641603e360c4ac2382dd26dbf7

SHA512
b554b095a117d3db5e53505140ced38b0f61ac3df4e4cd67d413edac16398aaeec16bb715cc41d4d9613bc7e6122e25e8d25083cfd481584725f8006ce43b464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c2e6da7bdf73907c269aa62e3edb44b

SHA1
d9698e1eed244b647b49bff2a865f11e95b5fa9d

SHA256
5ce2696396680f6c7d07cfa6f1609621ebafe79667c60ee61dc331fae2254815

SHA512
324c4650f99e95da68b9a349e718c71b210dd546be14e58a51da4f8c795cfa5fd71133e5758abe8f93a1b71f938f524d2aebdd57c66c346798fd977c914deca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbfe4b447ed2a40d16931bfd490b58af

SHA1
6cb4c19e10c92818b01784d648a5b450228030a9

SHA256
54336bfc4622a66dfc0f5813880f3060bf203c5da23b9ef5cfdaa6d542d7da22

SHA512
849d73ce04837cfc68bbb0e587eb9165d7ef8d5e320e9e05fa8e975dcf29e6f001ce699636ef2305c2984f995a0d89811686e7c7099772247569a3f3a5a113b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f13ede0a493a85095f9adb8c31df8a62

SHA1
8c40f0b95018a6b105eb9458976dc605f9c306e3

SHA256
2c6417fc67935d9e45ae4343fa70f2ae765567378ce545ffdda41722e5dc4668

SHA512
232d028bbe0e412f060201ffe2827309a746efe70cbb7c85b73cae97e8a3c262f4554f40a95f3179d34a106cf5e1ab671501e6f6027c5531c47a02bf0a3b18ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7839afaafa62c77dafdf0bde77872c28

SHA1
5f94feffd825d3aee2da9e76a889b4a3fd506c19

SHA256
ac22d266af04c33452442b1749037424b724511c2cff9bf24972fed138d912cd

SHA512
226d29afdd419ffe1c6f6056ba8ab45709d171ed3eef0dbde3fa9d65b2f6b60e1e887a774bbc5d842b24d876181c4f7da7d1fada06b4f0ccbbdf11515aacc266

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC85F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4E0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit