e11f2a19755681733ae92109172a8452f7807789e948c161b00ca4697d78991f

Analysis

max time kernel
135s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

441f8f2136195c8955964ff1d1892911.html
Size

9KB
MD5

441f8f2136195c8955964ff1d1892911
SHA1

6a3995e65cbd08d25ca682ac39242c4206c7bc13
SHA256

e11f2a19755681733ae92109172a8452f7807789e948c161b00ca4697d78991f
SHA512

13031963545bc079a1963bb8a43895a162153db1656e94fa62f3a9f9596dac20169dc8dfb4661869f8259ff77060881cc4179e34aeffaac50965be8330cead26
SSDEEP

192:D9rmu2XAbUKc7FgkuV2T7Zkr1XsLM7ALvp6pzpgOp2SpNxpzp+apTpzpTprpjpjM:AXKc7OkuVizd7gBxxpRhxphxR5xhR5hW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCFA4691-ABF7-11EE-A7EB-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410641002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000700c0ab196dc1f0e71970d9d1e2402c474a81b6887ebd0128b1b6bbe15191a1a000000000e8000000002000020000000f736a1742ef8774fac09641872995dcc2bf755bb40550cdd1367c61782baa08e2000000094a3562900c941815b54a6b1197554a9a0e8f1907da368848b2ec3fe2bc4744d40000000c6825c51151b063c1e815b4a585af5c4763986aac28ef3dc758cdaeff45a8e99bab9af413d07a3e85979641244a6afffa83a2a31f0f832cfbebcc478babba1c7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7006e8a30440da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000fd479a3028511e56c8f9665941c5f1ffe587afaf806a008226fbcba7daf16a73000000000e8000000002000020000000a90711ecf20a78db6348663027b7e8bed868cf5847e06bf9dafbabcca45a4af290000000ce49d6330a8d7f7b88d045736574ffaed959eb5e5bebe9514fab047171ef7b125bdf5d93e5d633f775c986a1d6036b556099f83ca2dc8c3211cd7c859395d72d2aaacf52edf4b10ea33a989c12f6809d3b014e6396a0685c0fd05303aefdb46afedbbcf7146a50ae7295de6ebb551a81e197f9f9d493a16a907a1c6ad9d6e8b65eb006c50128511bf58f89a0aa9b18e6400000002435717b415015577c2ebcc750e3f57d359ec89577408bdd4bdaf453a02a6dc7dc22a6b33fc65c65839e20da4da7c453c3632dca83e91dc9abdccfdb8b17cb8b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1436	iexplore.exe
1436	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2684	1436	iexplore.exe	28
PID 1436 wrote to memory of 2684	1436	iexplore.exe	28
PID 1436 wrote to memory of 2684	1436	iexplore.exe	28
PID 1436 wrote to memory of 2684	1436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\441f8f2136195c8955964ff1d1892911.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aae0956c05a43a7b55be3190c6d72f1

SHA1
071934a01e828430432059bd08f6ede2e116120f

SHA256
3e7b20739953a1d9056b6153bca28a278ac6c8325dc33b55cb84786d114874fd

SHA512
d41544c1e94a629206479fcec89a9a347e04240928092a897adc3180a8253bee023f3a379b7535bfd685088a78c5aabfdb62ddac2fa07d30ab2f20965298b2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf5ec138db087e519735a06e994ff76

SHA1
ab471eb28cc68f5fa52c5d6f15cd4423b9a69b4f

SHA256
24206aec8ced42eb277628c04d875177c8ac6310fcc9f468664e29348bfc3f68

SHA512
da27453ffcc610e22084ef5ab1d66cbc07a8993395f4b4477485152c2f0af663eb09b81718503f90595478d1a1f12a39c485a33266f22ac9a085f31b2ef2fe89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c67cb92e4c860397467ac0a56e1c24c

SHA1
211bb77fb9bf29ba929fd29c1c54e733ddb0ae81

SHA256
b43f85486e0b9bfe265d569ca6b85879ea1147c45b7730ba0605a30406e74139

SHA512
0e8aa13fcc06eb602cf37abb79fdfc584bb13f5ef8c2633c23a7402bc98ba35a8a8d7099fb33adbd689ed49dca26728eae9d1c6ec5a0edfba8314bfe5841fe2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ec99ea13656103c6082b63accbd33b

SHA1
d0558ff6340467e6bb324d410b49dedfe94fd13a

SHA256
0828f2ece394bbe68f203c3e01fef6c2e326be21a58d9cc1560e5d97c8acb62b

SHA512
b899c06392b5b305f9617c1017793ddcebf3882d16f644406e46b37644f3793c413d7672f1a991fb39191f64248ea67e509a0e6ff2e927281229542d84916a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2acf078ac5ebec14fc6d08cda5868e21

SHA1
01ea24031438302feb8376ea55d74bff9e95fcb6

SHA256
3ad87bc64ac3b61a77febb7fe563bb4715963d6f0a786d2534600501ba71493d

SHA512
844b3b1e25d47c6b9b1f889079863b1a0e0673594153263cf5ac2ec9a2604ea0c9b2056f1c7c1c4623a431501b93ea92f422fb9513315a8fce27c52a073641b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c9e6a74c9a5108a0a52c36b68c7bd44

SHA1
4176566feed6796a79b7c6e6041626a400908028

SHA256
146436111d608aa211eb333ae2ff867aa0ee34e6ffc917bed778a90cfc0d2233

SHA512
5f3b7458c4d22a91a4fb86aac8b19e0067e83bca98ae893f9a230f1a09913692d4bb1d4e0d3681af8923c84f48f3bd2aec6ab768bb877f9eacab890f7e2b3ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29cac7498d88f3dda161b79b913ef82d

SHA1
45cc6eaca9b016def8c6ae141a54eeacb0728388

SHA256
4e3d7be8ab4d1bb267387d0cd461cbc34814f48a70fae934ad400e02ff68ba86

SHA512
84ab54dff248e4cbd0f4fb44100c6053bf1f89dd422a2b0b2d0b17199bcc6b4fcd8518c2e1489a27cedbe529aafc057d9b67b69ee44cd64a89b655bcf399c534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af84d30202bb8dedabbd634a66288564

SHA1
64650e6d3cef3b89878c9d5ae2bb276ca54103c4

SHA256
de5a6fc6c4bc4f778ad8b61ea1e6bc2102b9fb634fb55c939e0b5b20ff344d1f

SHA512
15eec0d7eab18712fdc2fd80bdae85a8a45717035f09d4e1666cacb32d4d60d22397080dd52fe9db4eccd6c5577fc50f5fb08d7e60f6203f0a1587f81bf2c5fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af3c6cfd2e0293520f657905fa15a77c

SHA1
0aa7d343f918de3e644f2cf4df4128522194ac3c

SHA256
b23143ca8ef1f95c0a6a379b8696880862a9850e9b7689c777be1fab147f06d0

SHA512
529286e5fc67f01edf07bde0830dc1228a2f7a69178047d31526f219730096e3fc7b4f97db133cae1a75179970345928fac57e51d6e39eada603f36a8dd41cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b88c1d31ea8f326b2b0d1ddfae70d45c

SHA1
4764059693be1b01b595117b8d77ad59851e16bc

SHA256
682cf4625f642ec6a37f563a71245b9e21a21d97e8d382fb3e28fbe2f737c285

SHA512
a704ab86e091d8c09f270bc1b2b498df199016beac5c89dd192f6a6dc5cd18d19afb7c0035dea9412c01a2d76ae3bc8bc8f4682474e1c586ead4b98bbc0f48ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC86.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCA8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit