e46c16ee540f40292244b6bba294523727ba13bef26591b0d939d91712b79e28

Analysis

max time kernel
0s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443d87d7951211ee559efc9e69c68d51.html
Size

10KB
MD5

443d87d7951211ee559efc9e69c68d51
SHA1

d1ee94fa799edc65d62d6dc24fd8f9656786af79
SHA256

e46c16ee540f40292244b6bba294523727ba13bef26591b0d939d91712b79e28
SHA512

a19f426d183444ea86cbdaeabd5e0e502848e8ed0f04cc70ed6758858622ab420f63ce9794c3eb1356d9e260db2392121eb83f9ddaf026e3ca881841f39aa20b
SSDEEP

96:uzVs+ux77/LLY1k9o84d12ef7CSTUbGT/kP+pSps31DvMdlwe60UYRDvMdldlVHS:csz77/AYS/C8SgaNUYRravPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA5517E1-ABFF-11EE-8A73-D2C28B9FE739} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2436	2848	iexplore.exe	20
PID 2848 wrote to memory of 2436	2848	iexplore.exe	20
PID 2848 wrote to memory of 2436	2848	iexplore.exe	20
PID 2848 wrote to memory of 2436	2848	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\443d87d7951211ee559efc9e69c68d51.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ab014991d4e44534c086f25e592c4d90

SHA1
29dca4eaa26d72473f4edcffa5900f9bc15bff04

SHA256
8341fcf254c1f5fc22c2167b994412a1a9ef260472ef6e92d175e0fca6a26b4e

SHA512
24b1925a07d122f83a7e787a599cfae39fc7f59634797eddf7dec2986668f012c0ba4d572a5a6527a0d8990c8fda2b2f46ae10793a901677f74ece080535beac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8940a4eb5ec85da75c55e65599e0cea9

SHA1
58add6b18d1b30e79c07867db56b8c6abae89460

SHA256
a38ad4b28946545c82c5d9b1f77d800b6fb0ba2c3136ea3aeee9be51c00c8725

SHA512
929998f364d0e77e34f00deb920575984a5940d98c3618addd350379f4dd5790bafc17e4d36111cadcb54c960d59bef604979df96fe46ccad412ddc72225c009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a57b1ccb7fca54a7337ae3b2ddd13d

SHA1
227ec475b89e4715f207ada1dc92510b96e0dc9f

SHA256
3c62e68732bbaaac1899df6fd7a59dd7961266b875ab2751becdd47727015e83

SHA512
2d466c7115707bca39d441b15e42e8ea885fb5b89085752041379c40009f70bf33086675d4a0d326911e03c2e1303fe30ac86b5ce27fc7a04c58d69c8ee64cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
389310d153077693f6c5b30bd0eb1e7a

SHA1
5fe05bd1bef51fb33a72ff1a9e3f15dc5a24656c

SHA256
5877e93f042359e3f8938351c2531f7bd84a20db2e9411dab598d884fc585660

SHA512
6ae59eb25930090c6650a830b4feace47ac3b93a957bd4ac3545bc7637445c44661e83acda9644cf904f47e1ddffa65d331c35b8656cbfb8cd211210efb4585c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a07a468fa57dc75203a8226a9a8077fd

SHA1
bbc1d0b5ada64f13d98d18966a64ff1aa1fa3758

SHA256
254ca85ae7b254f8f922d35e7ae3be20a8e96cb4fc79fde3cb03e906f73ed720

SHA512
172f20f32ce0528b5fc917c2952e71dec4bddc2c858592d82d3dff0b825e40094d71f08ce2a3d7208e50663d8e328dd6f974df3e1e925632d18ff73d5879cc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57f2e7224d214faa26b2d947eb497ca7

SHA1
26e419d6916e75bad4c8d5740260bb4a40d7aa9b

SHA256
bd8f7aee309cff30275abd0a341b416f11ab082c11028a6d62c23bd106951554

SHA512
61db5aa2731ff3b5d2dc6f6b8ab148d2fdfaa6dc7fd027bef8e2c46bd570bd0761d5d23f8caf16c964cf8a821de9f3284b64367d218c1366784cf35787e801b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1688da7d446964659b6f5ca716dddbd5

SHA1
ccea870c5571a8b51238ff434c0c50b3e9007ca6

SHA256
2209de6fea3ba213b558058d5b1aeb79773c4e902ad4925598db038cfafdcf2f

SHA512
4260d0f7f8a422095bb47cd25d4afe750d20fced82eb55ea2510575260b38e72bc8b9aedd7d4fa2565ecc64aa0ee152a5142ab0c073290e5cccabed6f43fabfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ab33c4f214b3839673a405f15fc9b26

SHA1
1e00b608c9f63ba751b021ab23960eddc2d8d698

SHA256
4f1ee0a0bb675145c0ad375425cb054d2fe50b9cc10f2050a23ac17c6218337a

SHA512
44d1745d92c98bd4f90203f0ad0734c882ae03ada377ba0739883b99ed4c55308647e5197097fb1ff293f62036a623849f2f458281fcb49706e3773fe9d1fe18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f50aa44060fce887cd1b9d40e4e149c6

SHA1
61b1ab24ac8efa7344f14a5960f8539caff552d5

SHA256
fc327edf0bdf5a7321ca86f319f6eefdab304e0bf2e1a18bbe10630af5e2a574

SHA512
480ee9d107ccded6bad5e8d94d90cd7b4be191e500e0e11166cb33fa2262acd2a53499d645d7c8d3e41500f4ad33a7e2673f59a6e2c86fd8dd9dbf4224d82d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39151d344a66d1578d53c227654cc4b

SHA1
e61235a96ccc3e1bc8c7aeead6f02c627afaa812

SHA256
f1418440b5dbe2725dc25aa1ac618572d51fd3e4aeca49e6d63004cdc73c5a0a

SHA512
675ffaf142f24f0b8f39d8870258df0ef29f6355239014e1487a90513b970ee2b404e1c2c854c6d5394d11e53383b296fab40f772ee3b10984c701a0b2e06493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
42945246c93d8f8c41ef3cd3976e7522

SHA1
8bf86b3aeba02184bacd601799fff340916c88a3

SHA256
2355858e676856056435971506a4e147a8ec6072f2bd47e0e93aa11fc85ff8d1

SHA512
7abe36d6d01088b99a4659248ca047803ac59722172a33edf85f52a327459a0c115dff4d7bc0d48e04fd97936876d2c6041e439e29950053ce9716bdb489f91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3894.tmp

Filesize
77KB

MD5
3ac0110bb9e761af6ef8c014f2aebcc7

SHA1
79f7c89d81b17109d12b6fd02bfea53c06976bd5

SHA256
ed28bb14915b4dcd8d8bc1e7772328eede392b29b8d097eb4ca6a7b1409cd286

SHA512
7692d38fb2af09c4a894401202d2f43242aaac6821449d29499c99468fbd49dc87cf3b0a82b63822e64332716833fa22802d89eda017a5cd3cd5790c97c60393

Download Submit