57fbddccd1c10f71560f913aa8cc2474c36baef5f9d7f1f077916d7ffeea9a61

Analysis

max time kernel
127s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

442ce2c64f01deb6c491e661c1b40105.html
Size

4KB
MD5

442ce2c64f01deb6c491e661c1b40105
SHA1

06d3f7ba7c7a985aa8bf77d8053a94b44212a46c
SHA256

57fbddccd1c10f71560f913aa8cc2474c36baef5f9d7f1f077916d7ffeea9a61
SHA512

582b064b5a363d347cab135bed22f53081277b2bd6c9b63eb8d4647600d01c7c870b897eb8010cb3364ec155efb2933b9b821e297a61dab0755bfd2d92d7940c
SSDEEP

96:QmdGgFGYjx91ZYxn0tfoTHXfFOvO+HxH07ZWeevbLYvyfHKfC:QmdkYwTPX+RAbuEgqa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e2271d0840da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000000b01f19863142cbf0f9b944cbb88d24691f5ff7426c04256a606419ea161fc6000000000e8000000002000020000000298fc5a2da503d5eedd7f54f318189ed5ab74f43d82b97ebc6febcdacd64d0d120000000064ff9cba0fcf4ba25aa2a70af07d4653b60dec9149efa16b0de647acc30b19340000000fb5e64d97f98572d25e5cd22957e1a6fe289a65d7a93abcbfc0b6c3f3ca569e42922abf38b6a82c0d55a18fd4ab5c81e804d23067a51f23b1acdd678f92c2b30	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b3f88377487d76e99cf450376b48552dec73ba33f7fe0dc76e7d92cd1294f349000000000e80000000020000200000003bfb1d164a41653f02fe5d87f3ce11922e091385e013d16c85d91acde3b382149000000099ceaefa8610fc434994748e925f59524afd2665e3320e0b829e574b1b75c91f4fb8cf463094c006a22ca31200eb737c3982ab4f07dc0351e3c3bd4d4b8a21a620d11fa8ebb65b63312360de33cb5fff38902125f8ee76ad1988be3163701bb9a982b73440ad32d7ab314bd30d5cd02ebc4947d5b1c6ca5a9d12af0bc807c3b6da1ca1d1bf776045ba181e12dd8b687940000000485d5698f322f25ec6de1e4f0e333d829f0274c07b60503e71b43cd47bce8f93e197d993ce98057156682037f15104420e9e6e0b29adf462c0af71a2ae4e7927	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F24ADD1-ABFB-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410642508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2312	2024	iexplore.exe	28
PID 2024 wrote to memory of 2312	2024	iexplore.exe	28
PID 2024 wrote to memory of 2312	2024	iexplore.exe	28
PID 2024 wrote to memory of 2312	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\442ce2c64f01deb6c491e661c1b40105.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f5519777ec70918b5b21acfcc7f757

SHA1
a6b18cead7a4f168cc94a9942b74e5a1c0eb6200

SHA256
5438a497eee1f065f8df087c08d15880e15eeb132bfefed33d1b439b5d5af1f3

SHA512
097740f7b8be3afe81e0ae84644ce683329c483fdfbf74534804dc0b9717778ee1042767877bd7a9407a9340f1349aa7cd8c0c557dee5427af67692cbe60a421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc163f7f15611fe5bc5022e8ac1b103

SHA1
b6ec5f2500cc5275dcca723ace5588b53cdcd525

SHA256
16a57027b5578793a9d096fe7412a080d59b3eb2a2ab93039e3a484f6b7938ed

SHA512
62b04574fbd0cfd3f143243afa423f9483cdce7094695280a1813cbfdc629beafcc94d33150efb101c58280f00a636840db724b6d2d65c268fffb311d2705192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6011c13a68be9be3981c8bda5587f973

SHA1
66c15933f634013409a635874c366cb857ddacfb

SHA256
451441ef4c42718079238e677767dceceda007316e28acfaa2ec4ee4f6ee6cc7

SHA512
1c7be8161b5d91d709c645f4d76da291f5c2a83a0ced8a8709eb96b8085a794abb13d33cdc5ec4c260b5c8e196bb58aef94931878d36f975dd51a76541860bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dddf496a8a30848d86f2277476a6542a

SHA1
cf6e40f0114804cdc92317829b1e034fccffe981

SHA256
4f29200475847ad2d1ae388e48e50289d9d49e72f60e33ef197c06660a63a370

SHA512
2773e64d3565472366c67b81786620e00292756abf27db379f39ed93cdbe1d11b7e160ef115ecbc04f88a857c3419da690814300690b7c01c23411c8fff719bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153520540db1a099adb525cd02ea207c

SHA1
4ee7e5056c47149e12e11a770983af576bf0ee42

SHA256
119550c798a316c227c92055c16d49334a18af5a2e32cc5e538334e7a880ddca

SHA512
fa75c52132031c04c0ecb44296ef6f8ffbced34f597e3b0b28463c0513a621e9800efe7c4027ee990ff78ff4afcee47b341a21b846d5f5cb3a3a1481b2033e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d48f26119db704f6eff17a0408fcfc5

SHA1
7993af6329b6214aae7e6a5c0bfbc5088ac3e8af

SHA256
2916fea7f7bb13740eb2be7b9e4c25d823c44e3b5a61de0db3218ff2be9160f1

SHA512
856fbe8c8e3b0121780ffa0b876ada8990cdc1868d5e66d695b388cdfa8122a51d990a89510689c88ca9080f06065d7c42b0f147131e85c56587b97ba4da76e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03537bc012e9548353a081ec936cef04

SHA1
54b9bc5ed2af546610af49d1f9a50ed427c39fac

SHA256
5c1096be6716d737126da8877d8cc92c2a18600be34fa6890d4d38898a010600

SHA512
61ef88becdc2e3cdfcc3eab24d33e25086bb7d01aae5dcd281cef5fd92f9014a88ab02cf34c4709cf89eb7d23a65efc061bedc0b2de10182e69178697c5ab72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2290.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2330.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit