bb646a8085cd1f27ada367afd43443919cae933ba21db4d784aee64731bf1599

Analysis

max time kernel
138s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

43e219dde1fb169152bffc8ab4349abf.html
Size

28KB
MD5

43e219dde1fb169152bffc8ab4349abf
SHA1

2507ea9de0fe6cf8698a1f2a7a2646fb134ddcd1
SHA256

bb646a8085cd1f27ada367afd43443919cae933ba21db4d784aee64731bf1599
SHA512

467426bf4be1c55aab0633d76239c1e380f3e0dfe02c2722ec8cf9e6f9753a3e94a390cf29735accbf65052b020df80feb189cf7e2a07696a22ebdff6f5a8ec5
SSDEEP

384:Gfbs6QgPWt0ugNlD57xlVTP+JPVlFSGX48+qccIGj2Dvwk6nr+IoOTrUn:GftQgPWmNlt4JPVlNXxtny/6ni

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410625594"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ba25dfb2e269003ef60503a3d2c07213ad866599625e15477631c1ed2b6d33d6000000000e8000000002000020000000f8911446f0268bdbc5f99cb3b1f6fdfd71ccb1507faaf94393f7315e1efba3ef200000001cee9b3970501cc468b5111924585add74be783d087ed39407b2abfe42610edc400000001810f498d1176fa7e71e24fe97885fc0b8bf47a111079af63536bf9128afacc671e3e79b5a01d192963fd62b38e61c32bc2380d363c01b860efdd6819375f8da	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30969e02e13fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE0D24C1-ABD3-11EE-B5A2-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000036b6e141397bb7121ba96ea8a87a2fae3934f8f1706a7258d98c588262938c43000000000e80000000020000200000007ecdab9278347708a96149d06c49a9c0a8ed9f2fd3e382676dbb0bbcdd52411490000000bff3cd4f155b7c4691e309d0ab9a351288ddcc7f31d852b037d95d56db905ed42ae9189f05d7223551f0477823aa1e6280847cbe84275d2a86b18c9f471dfb185221aa26dc7f9105e6dab67a79f7ad8faa3db88ad44092ff03b7e31070a8ca793c959291536b2d1b374967e60f42ff37206ac98474573bceccfb597da737850bb764586eb4044ab456c3be46882c5ef540000000b61cc85efb5cbdb67792d265815814548333e944967389c032b4f84be5719bdc78c3744752438a24eee5db0b1531db2b01d68b8f6d6e1659cdb2604f9a7ac50f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2716	2324	iexplore.exe	28
PID 2324 wrote to memory of 2716	2324	iexplore.exe	28
PID 2324 wrote to memory of 2716	2324	iexplore.exe	28
PID 2324 wrote to memory of 2716	2324	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43e219dde1fb169152bffc8ab4349abf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0540204f784bbb4dae186d1ca5d761

SHA1
cbf73675a98f50d5393e8d369d61c1a799a4d93a

SHA256
f104272bc905dd0e77eb77bfc24ded12f84098abe408335958911b26d215ab53

SHA512
bfdd04746e8e806264df4c8e100da177f0afd408c91c4c57626e3f9e10aa022f1c8a7d8872dc5a63c970f1d8e2bc0adc57ba0a6f9b31d70e7bbf2652c152d54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1785ed9239cac2871332c2414c16b3ab

SHA1
e362a47de4101c5ed1b6159873dad05c8e0173cf

SHA256
20a45c07136200cf849e40dd56edb6d0cc151d7982eaddd58fafa47ce7f3d708

SHA512
d3cb8a441f44a73f98904a42ea2af8d02f765ca22ce5e9ede81d1df40d5ed804922e85988c8a6e913a3268496c3b62c0a0df5aba21c0cb4ef4b9c11fe405a643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e481a5c79bdc13774fdb03bd7ab5c328

SHA1
0a5b810becb8a9d0b8f33aeeb3e5b7f76f2e98a4

SHA256
405316b2286d58ad0ace8063c5bb093915942ff3ef9093755df969c916182800

SHA512
4c2cb48b97035615598d22f8944208946f1d9ca7fb965a9aefd6648ba548a59175e472b6124d23b9db84718303213e9d2a717a2e981b65fd8a7d09967d278f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0589f4d2cdc3c37b7d0ee04ca38ebce0

SHA1
93a01d2b6563acc53638bbcbd2fe449d52bb019c

SHA256
354d54d5bdd4ea420dc8ac96d29bd21562f83aee4e8d6acfcfcc3d862bfb5815

SHA512
08ae53f139096dc42acca197e3e2584de5194f49149e6fc736af235ddea5407d07279c6949f2f91833d2972b42efa66eecf659aeab3f3071dae7d0ba55a123d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292ce69488daca857a0dc17921147221

SHA1
fd5b92ff1da6863f57ae5286fb8ee8a84eb9b12b

SHA256
5028a4ab2ec02f0e3120f453f29447b00d449746c936039355a8a84dcf8850e2

SHA512
983be5c6171c3cd63f9cc6897114b3adcb729db4055b48471c51200f42524e507646ce6874c64f8d05225499ebc036f078bfb2ce85164f745fc7cd50817981ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4512f520729ee15dcd242a615c008519

SHA1
a41765e1e5fd7300085d15de194fea8bd95ef3ec

SHA256
c0d09b1c12e2b1d67aa88e72614791c4eb23d4405c98dc4cb28ab84ccee03d17

SHA512
0de65579f5088268f1e003593adba8491dd73989e60b6b9661183a7f62dc1b3847c12c816c2c4f555f907fb3ecf24bd1959c3d66b61f3fb42f7144d690a15675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5beaada88ee1da4acc92da4acd9186

SHA1
2b6bbfb8ae7b9456d6ba0b4c6d50267ec075e271

SHA256
8fcf499a4e85909b141b8b4658d26b3625d87486ef27e0f436fcb0f96296be97

SHA512
fa2fb63fa5874a8d4579769c07492203cea4368121d1eee462f50c12bbd4d4b50ed6c816127a26ef158b11d595afcf283da6f06cae78561e15619415dd163f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b72a4dde07a95aca7c0a7d3ff62375

SHA1
17dce5e4547bce6f4f9a3346d465709733ddd989

SHA256
e5fe099ef72f83653ec939e22dd98ca20a26e1cc0cdc7a6df6f67a2d215e357a

SHA512
4c8a8747261734253b0523e0677e3d33c32ea932adb4d211731c2e438f453f68d89fe819f14d043aad3fbc83628ccc120633f3b8ef7dcf30e3e90ce0ef649531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d732299821a2340baa607563c462d5

SHA1
9268070f440911bad5cc5051330ad125d2022b5a

SHA256
051f6a65e75b1320fbb9b768c3fe6df8dcb936ae230af457f5f4136464478a96

SHA512
49d387d5edd66ad7c3c04a3048c530aa35c561f47049d079f2cd9e631ccc07da8587069c2b51259ac78c65ab55c4f374da19be9dd2a4d70bd936fd5c24c4eeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e1c735d82a42dee4f8eaba048725b8

SHA1
361b22708916568d3c29307d4c222566dfb3caf8

SHA256
af1de04065830c5879e2fafd62aae1c0e4454270375f166edb30d3d3e51baeeb

SHA512
22dfa0a6753a76978abeb9ee15b7787338dd520016f4a150fa4dbfea889525b7d35af8f49ae8a82a8494fbb2dfeb6a0bb1b762dfed923067d7b0bb46d60b9d18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35c355ee5b6c06fb59c69ccf495fb9d

SHA1
024bbafecd2ade2a23e3c1ba3ad61046d44e6e48

SHA256
8218890d4db5037b4cf7061a5cff4270672510417dc3c9c3fea084f021c55bfe

SHA512
cc8dfb9290dcc17da9e527d38d619790b224faa980fe392ef93d5295ccf270449ddb270bbf5dc1c8bdd98c2454c9231ff52ed62d15cd64928d97acbf97cd7cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B8D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit