b21b738714cc0ec28876490bd97825e5b0f53bfdb5c917d419ed76b8e0335213

Analysis

max time kernel
143s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443e9526b96928d6019dc9a696fa9515.html
Size

123KB
MD5

443e9526b96928d6019dc9a696fa9515
SHA1

116285b29f4a892b5ac862f3546e8c0be0ddadc2
SHA256

b21b738714cc0ec28876490bd97825e5b0f53bfdb5c917d419ed76b8e0335213
SHA512

ff42be01b66ed7705db7d0b022676f9fb88c86bf1ff54432cb89e36b8b831553f59be33c793c4460e54b769236d7b3e7bdfcd3f610dc78d3aaab1829875b534a
SSDEEP

1536:S+OIeWyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SHEyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000092481084a7e231e09fd0f859dedcb7887aa35cd77d21bc6a88d697fa381fe7b9000000000e800000000200002000000018439b5c8f51192a91cf856f977fe0d9ad9dae9fbe54d478f4f57f962f31d3be2000000057893c1d7e5b330288d1cb2bff0540c637146470f0b84cca5a8e3b7ec3fd25124000000087d2ddff2440f31747582e7df87428833bd3b9d34209c5834e06fbf1404c0278555769ab296c5e504de570a7ae715528d697add2cd4c4eb94c69d935fef161f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a2ca4c484439a06360e2ce8399464b6f1878d2bd72b25b7a17bb50b3697f929a000000000e8000000002000020000000d7affd09e5c79fde966ec0da90d2b249d1ca42be86e1f2012d8ce52d5a2cbf289000000072279e04bab0e56acd4efc5d7f2e4d8195c011b74c2d3dafe063883bcded280e4c6d1b0725da5a0f63a6f3a9a4cae438c816dacc46067f8bf2d24081ac8accd695a9fbaffde541400970a8e450e88ec729cb70c57b7420a1c2d131ac3228a7eb37642b0c3ffb8624cd48e3c6a30a1563b797cd8b637fe8551afead17f3517e4ca2eae5a722124849954cd6f03f13e0b740000000f09e8fafb220ec8a75a68ed1354f88aa94c6e6d2a7fb6ed71df38f3f2fc1754b4d9d487895c57568ca441715c01d76c3d5b76572bdc438af7770d77504728c15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410644531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d73b1b0d40da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{054FA051-AC00-11EE-9C28-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2752	2084	iexplore.exe	28
PID 2084 wrote to memory of 2752	2084	iexplore.exe	28
PID 2084 wrote to memory of 2752	2084	iexplore.exe	28
PID 2084 wrote to memory of 2752	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\443e9526b96928d6019dc9a696fa9515.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbceee2b0122945a190324aeb51002e5

SHA1
1ad577600d0fc0129685623bdf2e43d30c287d30

SHA256
7a209c48cddc236018daa062b90ef9fb72dd3f0947297c6d0ce1244298de840b

SHA512
f3185079169a68a871b313a183370e9d2799418a5e90cd6d04cb319765b2a853b2804d2cfb4b4c66198099e15cc85f0a56e932f0244a7ddc26d06d09dd72c696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76343353b45907115aeb0fd4199a44fc

SHA1
34a74e06e2bd7452f7ddc4e3969150eb353a0603

SHA256
0bed5264e359ee23b2829bf5fe7789034e7efcd2405708dafc72fece3c8f2f22

SHA512
84ab78756c582d088637abaffe8658f4f41faa198999c2c7c6631067cba04779a030ab0d6b17ab74ccc3a1657d57101ac4eef6c215fff94098b526ff835636ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89cf6b9ce3586961acf7b27b90bb5ac

SHA1
d4ba015b48c688d74980e9d03638a30cae00ec89

SHA256
a163725ac724ea0c68891c3c8069e637e6c0d79c48af9871f6cc1833648e7497

SHA512
aec466a293f33a9ef041b278af9caea99b35b8cc6ece57ab530aad719dcfac1d8889fa5ddfdc487bce363f6024f8e64d230be7b8a98f1752cd7949b0e1e72880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a31a5f898f45bd77192ad18867fbadaf

SHA1
5ba965a3e08190c37241846fb2a5ef1753e6eba5

SHA256
6c49b37fe56b89b171948163fc0b9641f7de2992d36b5b1a0e1220de39246110

SHA512
e5869fa983ba04fa0c9d8b8271ebf0b91d7ed71cf226e1c3a63df65ef642440a590233b734cfb4532ab669918d314b7ecc0061e506b99a67a55d604cd3245682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3674004a016e56b93eb845b28ac1ba0b

SHA1
81fb38c119664ccf6f31fccbc520d7c694e3b446

SHA256
77d89523ff8858a0fffeaada61048c9bdccd94287f583b8bdf077fdffa06beca

SHA512
2a0ff57117f448cbb165b781c692a13fe90f75fd0e47f552ab2f4f1f5becf5c40c6e81e45e13314fc81a156a559e92c7b310637259c4932a257a6d7e529dbc54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f62ea849906f4195c0e73fac7a2ef6a7

SHA1
c9fbf2e5212838bee5b93b8eacc41515cfe942c0

SHA256
2bb68f3a4c14beb563bd1cf2b236fe765105d264e098facab6dc0541fb87ea04

SHA512
0d0a6076c5b0e833d878feffbaeeaae573742ac973129aa91467e0bfa0b7922e22b0d59592de048df912abfd2f0c9d59122e4ee0e717690368c541b0ae223f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb0ead91e53a7f3e3d2db582a0cce99

SHA1
81bb51a23bb472650867582a11b90f76fbdb9074

SHA256
b369a72db546594730498bf70a96c854af3ebfce46c37cc524e4f3fe5eb72894

SHA512
8d7dab7ceb8df607a5765e3eadbdb0dad9334262b9d081db397dcd966f1949b53370bd8c9ebb58485296e562b8ddf937f969f38f0fe572a40180d8bc58907763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e615dfec7f7ae1c2b506c90e33d0714d

SHA1
da67a06fe65afd4dccb5bcf73a024ea9e2936784

SHA256
7105fc49418918417827ef611b4f6e8589726bcf59cb54a2eac98a7c5c8f20fd

SHA512
8343a2e5c8d74dfc899587ecabea41575d8fb9f88b5b6a23257857ab802b247ef88f32eeab56fa37524737822fde5c13e4b18bad252ccfd98f2861387dae5ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efacad26af6b4c8b6059fbda17fd14ca

SHA1
d9f80e50282992a0317a509fd326175a8fa7fd7a

SHA256
66dc3987159b11b06dee39f28371c01a010a79bb52227b22ac9cb02fa46f160e

SHA512
aef6a5c0f82cbdf4eebc27a6779b844106fec17aa1ad59649f92495da1be608095fce550df2c3f09cfa2e68424f4d9be2ffb56ff8004192f83abad53b67a52b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c71168dadb5ab955007bf9b6363d0fc

SHA1
d3f0c5fb9c7ce292bcfef0ccc590e34692fac1cd

SHA256
c2fc5c933900f88c6bbebabc5789bbf51b7a8e6f7879b01d615d2118548db392

SHA512
0de5050d4ec9c0259b31f766e02a7c7de45c784ddd83a30762e3845276c11ffc93e0a5753d5ae6360a85ba51001e6cc57e5d5f0fe99ff5984bb2d2e410eb80af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67c71939222bb684e2c963766c18c095

SHA1
80981cb48c72bc4fd0030a5c77b9de843303b912

SHA256
48a873efa3d76480b71dff42a117f14ec8c8a63b73d1fd6ef10ef0041d68496a

SHA512
d8bb7e6b05f59757fc7f1de3b8b63946b6b0a53a37cb5fa21b4be315a06af0e072500b80e491097501ce80483ba5c61de7808384c3f0f96c7216eaf79553cfd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc5f6d7b90ee5c37be220905186949aa

SHA1
f1e827ffa3f9d555030bc72b24b0c5bac59d4d74

SHA256
921bd5347ab71567282dfb267581d0695990e09f75c65fd5b78045447ccdaeb1

SHA512
de2a4eb1a0439e524b85ae08ffa37cd6c0a29d6f21449773e45c0dceee9580b455ae6b7c6bc93f6408d387fcf3082513ef5801dbc446207986eeb46381e57425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc10313aff39df29c358a07edbb99d3

SHA1
a72af6b97328275633911e6963604b590bb2823c

SHA256
b6773195944f9d8f81dd051d90fc473b236fb2be15b8e4cf4a298320c4f39b9b

SHA512
e2cc2c6309d8f54126f0cd85639f2d3fa5ff7e8005461ffda62b3a7821adf72e15d1dbc7862d24b80c0cedfebb836ed571f802def343652ea353cc6c72e98399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9788b0cf7a61e5b966f64bd7f67eacd

SHA1
fbb547f507df2dfc5c662cca25882af1da357996

SHA256
7f4966f271f61787c0c0fb20c526bc901d02b494f53f4cf8cd8f5ca923c24528

SHA512
7c87b5bedacdda8dfbf1966fc0d9621b30ba979ef8b38b82b96163f9114ecb569e8b5b98b304ed57b7ee007308c552ba393437ee73519dc32d815ff2dadb6a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4366.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4379.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit