6e19e291b358a0c0c250488d39ffc5e3a0c71c3dd862a609fbbe47614cdb66d3

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43a51b623e2530d9934e8541f094b19d.html
Size

2KB
MD5

43a51b623e2530d9934e8541f094b19d
SHA1

92c1185d1b643644975c0aeb037527f08f141e60
SHA256

6e19e291b358a0c0c250488d39ffc5e3a0c71c3dd862a609fbbe47614cdb66d3
SHA512

4bdb2121c8a1543ec5307d31607baf728f21e9adc760731b80a1e89f5d66849aabf4065b7231bf6f245a27b5544733247a775133f5977ef786f841e29ea93f6f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000dc93eb7c97bd6e0a47407e241256165775ea80fe76a4812001b779a0f1bc3b8d000000000e80000000020000200000001503421b3882cc8b12c0f35df5d2638cf5050c3a9a9982a529b4eeec854a64d7200000009acc788de6cec5347486b6f377269296acc1f16da8c98e7ab7b6b7b11fb7b01b400000004e2de5e80a6025ba00d4ee398dd4edd0087c3ebccba3001a3c185feec2c92fcdb7a523d4102817a7b053f3895a6b565382f7eda07e4cdc3d9437d86268321cf2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410618215"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000060a7987bfbe1dd472d3b170217fd67477e6acec2871da0da73e23f98d3f05a00000000000e8000000002000020000000159cd813c9c8874adab5f5caff5492bc9eb287a61a2b464266b89bb6d6467ce190000000df62e3ce0b81fb30827bda08d5e30e98e7be94e45f9ac4b2a42ff135647540a0dabb7ff8e989da29eb4f5a9de6296a298835b638c588e4889ab0bfb16da6f8544088a8482b4728e0a426d6cfbf9bddf33a937e95b0c49eb27a3224c3a5db6f28927f32b343dbb0ee929bb42716a92097085f0e52dc066c921ef86bfaf3902f1db4f2ef06fac195806eee057c3c26fd5540000000c4663e86e7a400e7e226cb495766743a7290dec9f56471e99c6e072b1e168bd4a02cf310d1afb0d0556ede40db21d74523d3b694f78317b4c36eb1e02b6362f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1704E81-ABC2-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30473b99cf3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2700	1044	iexplore.exe	18
PID 1044 wrote to memory of 2700	1044	iexplore.exe	18
PID 1044 wrote to memory of 2700	1044	iexplore.exe	18
PID 1044 wrote to memory of 2700	1044	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43a51b623e2530d9934e8541f094b19d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55afe922334f86242f0c6b2c0e35eb2a

SHA1
85b8d27407f0e313370323c39056ee314253c524

SHA256
528c79c061557bf906affc1684ccabf375a5761b7c46268ee545db756712ddbf

SHA512
e8d50691a25130c42c4ec84b76a6a3af34cfb9d8bb86459fcb3e5b17806580cf4b62c48f04ed12f7de3e69c282096421cfda6a0fad62132e5f7ba79a81ca7855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a488fdc1fc226bde97337a5f7bd11019

SHA1
a012f9bc24c458f965065b8f1883d206afb5bc53

SHA256
c7147591ebb61a41851e5d8451a967afee195d9fbc29f7721fa1a64c9f85575a

SHA512
4a4c82cc404d7b7696757d0ebb0ff08edf63d931bdb28f4dc8c41c1ed8f7db173685ad6a5f56253f089384499b898777742c67bf8fd13fe2fc23dfc38146ef2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
377e9fd52a4ccaa00ec79280e24ebf65

SHA1
19fd658e957b97120366e5c57382ec4c067b9906

SHA256
f9220ee54685e38649c62e5963557058c153adc4a39337f37856562d7a70f894

SHA512
d944f89b1690be440cccf3f423018b74694bc9fb8c5b4d6a2bd4f75ddfd4db081e21439273684f2c8b5d38d296fc97012c1b1afc454881c4b023dd116e6e7098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd0d770222e16ca9a5dbde9f00906f59

SHA1
7293e440cf1cf98633e2c954aad73420b57bfcd0

SHA256
46942f891d3f997035019af159e774b07658dd51dfb14e13d7f8f0c7d32d22a8

SHA512
f0a2807a715545741c0d3fad579c3e64ed2b9d98608092e59c3972a7921f59b6d358c658f657049b48fa48e5d467e3cc26d5efe6ddc4b821ec7053f175fe3fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
985881aa1f39ce0fc847f9b1187b8055

SHA1
e062c2e2687c4091848a3cfba60fbffc9fd4b8a0

SHA256
c6c85f77be68dc275d7f9e43d03410e71ef00e9bff1ca1a331d1a2ae78abacce

SHA512
c1ea9eeff67ef14e39b4e4e4d2e21f0bc98772572ae118570f8fc84922ab83a089c24370275710adb51002dd75af5e277c1611309fd1a7e392be0e1e3b88cdac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
750657eece98cbddb8e3ef4bd1bb813f

SHA1
59a8eda518513c19fcd27179ea8b27624c67e921

SHA256
36c4b8027ece0fe50204ffde2de2556a36573a7f20bf295c84fad0c2f7d5c6d1

SHA512
83b578f68077a7f8ed76cfad009cbc76bdcef295b4db7fec99297a8824c3458d389711cc42454d56d93280fcff6d65e2d518d1b7d566ebe2b78eea089379f2ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf800ebdda3752441888b3572c38d3b

SHA1
bbd4c7cfafe4c15fd44513c9a10597a8c168b4c3

SHA256
e3f1b02b01b93886fff2f6fffa2eef3033dd3f19c8c135178f4fc1d18e8aba86

SHA512
1cf21be845e42fd4949e7110d26878e9278dcf64a34fca36c66c5581d7e8502e5fa2b225f8ba37ed342a13ec754c8a72b7d98bf9149d893c4522cd029be81794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bdc661d1a1887abf4e2b015204ef7f3

SHA1
f7bcc1c83f379c6a8f67d43f9d86bfd80f4feeb7

SHA256
9fcbb93581a2a08a02bfbd097fa2a9d6ddf230c8a1e18c45430d7fb0043f93d4

SHA512
5a57b5f53c5f01508bf3170a9c6b42bb8b7df30efb431f64855e68f42e6b302b6483ef3fa35b80c899ef72cc4e98fced2272147e41a7e1cec929bb2a5cd00205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7c194c3a0afa6ccd865c20286c7f08e

SHA1
6d3f8cd3038a79858973ca569ddf1615dfa60423

SHA256
dab9e2e722ea08b8ea36acc3bb186e50e5a0aaecc4beec87e2b04432f7581a94

SHA512
5aa8cd9ff16a91466eb639b8ada510f58390952df7e563d6a9c57580412ede7b7d0ca70d253fd56d5512144df2b92d3f4c51d24f847e542f9e395d7d1b0b7cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cef05495939446d1f531e51721269a5

SHA1
e9e7110f299f8bf052177448cbaa9f4e214d4a0e

SHA256
57e83be22aab9244f7684149bfa68658e836654a827b214cc4d61006692dd010

SHA512
21fef23b66259191dff6bc80d0bacfde2649d421f1616d78c1ca6214c7fadb9b6f47186cb6868bc0ea5fa1501847ed343abcd8a149aaacb2e4a462048069a6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66fe6c3c0da19bab1ebd3e56fc072cb4

SHA1
d6efdf484ff29fec97d321f166b45b56cdf3ddc0

SHA256
b6f94d6d8e548930b1c52034b24a556549298dfe5c48c84631dd107171000735

SHA512
380e1405022662453e174642b51daecd4e563d392e66b6b3bd05cf26d99fe21fb400f4372fc4aea7db0e62d83f463dcd6a01686254c968fa531cfba8dd13b4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c9af81eae176f49d2f6dc3855d3e7e

SHA1
c92a2aae3d6e4f73e0d2c9116dfcf1347c6a174e

SHA256
50efa1ce4648038019535be6dbf436c00e4c4f737ecd8b85d4bd6a5d555af725

SHA512
77a91b98be235040b44f4169f69b548889f51dda64deab46373e88f2ee658d7b4b60a8629dc534476e71789a0c4479c673cc40ba0a7db5992c59b5aa849434eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a56734ccbde6a9bd25f52f71fc7960d

SHA1
6dba30cd21508713b7ccd64643da773f65bd303d

SHA256
ec7738bfd21b3ede1a71788a3b1d098d502fd23b1d9efb49de8b327413ab13fe

SHA512
98b8d0213a604ef8f35dbdb2dec78f2e97d41be047c87029594299e1018da6223c8b459ecf3185d14145929fd3e85b795823491d10619bfb241d02cf1e000cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b7c8fa0ffae987e8f2e1833d6403557

SHA1
69f071795b03c8beb31fd8d77541f43b86bb5db5

SHA256
7036878cae4c65679cad9f33bf251ff9bb52f88b6f04a103637d6962070c36d3

SHA512
308ccce8b531bd4b79f5917c077723f29fc99120413ff0da75327889a8bb2eb3c4ac76ef960365203a4d05ff0abc406a4415fd04934169ed4ec6a42fd95cf889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5831147280debe95438302ae285b05c7

SHA1
4b6139b803fbe41fdb8aa56cce844096aed41236

SHA256
590742b79d69afdf876bd0d025e8c48da9f6871f96900fd50d1e9a033cb21456

SHA512
89bbe3b24ff7c5c8c75762aa6bb773d0f0ec2a8306649e42786045fd26d0ed67d67adf8aba797a66ba79080718ea8b9637a7adc71ae892b0066385481d0ccf2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4FA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit