4970d89827107fa93723a0e00f7539bfac4e82267f09ea48aa68301ecd0ba74e

Analysis

max time kernel
143s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

445252c9274c8926c816971bdd8f7650.html
Size

83KB
MD5

445252c9274c8926c816971bdd8f7650
SHA1

3af69378305a2d8f7fbfd0c9be405e5be7f5bb42
SHA256

4970d89827107fa93723a0e00f7539bfac4e82267f09ea48aa68301ecd0ba74e
SHA512

f61d5be4d54e90d531940c916e545b1929504749c32652db58b833b45a3ec106a11c319dca94ba6dab281ae31ac944d8acb4effddb5eecefed11f7e1ce75ac10
SSDEEP

1536:4vGn9XS8YQV0NcNtxNSNeNBNYNoNJNbNsgxQ:4vK9XS8v0NcNtxNSNeNBNYNoNJNbNs7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000088ed4fccc05697c768ec4701dc72cd0cabbfb8d074f64fa11bee84af6254145000000000e80000000020000200000009081c840d920e94df9d8782a7b6ff9c5bf0afc20965641737702fa280fa6602b20000000392e4a4aa6c99efcf0620a74b5b7f94438d44c099b5ec0f34297195358ef8c984000000008a4d37bd132dcc33c06fad86acbd7be4c13cbd2cf505bde0a0c89fea07ef6d6c2438eff2c44a51897df3dca55ba966c8bb2699e2127a7c6c3b49f91ced30e6a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402971ab1240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009603ed1f9ce0dd4f6fd388dfc7b0247a61f3ea2e0043e40e89ce096b9ea46c2c000000000e8000000002000020000000ea38d91109add09b5c5d54aa1f6b992e0e5d0ff185bfa9ab6acabaf555a899d19000000059a2053e17e21440782090310a20ce57e9e04f90ce7219a2b901859c93a176a0b82f7f14e5a0594a6d4153ecc01adff0b554bf07ce6a43df3cddd8f67687b1416eec6aea2829882531fb63d54551316102572b305e9a4c256cb07074b06d9ccd97ff75bb7d378a04f5d738e852dbe13203a2adc25825df9cd6da1a65d778a355c83f8eb7cea0fa866eafe1f0beec6d7e4000000097701e5d2db187db01125520150a0f3c258814d155b967c8de5eb429aeccd85e07ef0f7cfbdca33c7e14b01a64dd523eb2734eb3c9f0e8b4d9a04b22c380f63e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410647020"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE9F9191-AC05-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2716	2856	iexplore.exe	28
PID 2856 wrote to memory of 2716	2856	iexplore.exe	28
PID 2856 wrote to memory of 2716	2856	iexplore.exe	28
PID 2856 wrote to memory of 2716	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\445252c9274c8926c816971bdd8f7650.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
c54a6778254d6c7ec7f193e13e47584f

SHA1
d7b32bb249f909dd84deedf26eb09ee5d1c11e4e

SHA256
2a5bda95d4a8f97ce0643c2ffeb2bde39436c69d981adeb9295993b5b00370a6

SHA512
b1e040b397e0e17514e0e2fbf1ed4a4b2cc644f5cb613dd976558b9f31734bfae8aecb35fefa2819bc65cd13b46b4809143793bd90c42bf4df9242c62abf6eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0e6185d2420359413e330e324b6e17a2

SHA1
32e7d7ca1fdc3d43f282a0dbadb9ef19fcf555e2

SHA256
55b73111d72b0e799ebd6b39b9decffc72d5347a3c0f5dd3c751731604c1918b

SHA512
6e790ee64f145eca6bc25323b3e7ceb433262d0d861589313b55e1c086ea599500ca9f12eea169cd1cdaa89a9631cf457ba747d499f86eed08279e45d6cd06f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa2f31b177ab49f23744db40bc0fd28

SHA1
5212ef6db000117e3e1640a36e49c263da9ece3b

SHA256
1a406398da9801f1643d724e1c2bbb06d87ebd3655a418d1a34ebde9302f216f

SHA512
8ee1b95adec0e8ff95cc264b0c724247ac9ef624d7bbd1b95b76befdef04071bcea072355a06b39fc3f59474e4143c12a611756d7156a5c36370b240dd619883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f02275159124d9d165df9046f306254

SHA1
587b162fa7e5753189ee8abefdc32ab4b3437b58

SHA256
62e14f0f4ea7642b73755458be63b0441029a492f975e1967d3f5aae9064f1c3

SHA512
0bc97906776046ec2a21e1a8c34ecc10e3a654ed0b07dd842662c5cf0a57085e62404c9559724c5cb3766a32b8934662fb6b2640c2092c58857767c9deb80ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15bda7fa8ad91d6ca7a098fe53e4b710

SHA1
91eae502989f58c697c23fc2e54201507c5ec4c9

SHA256
e78da7c98217e5859b12087dc53726905adf9be93d14ab9fb892da5de01e400e

SHA512
44739fe234db012062c7c308a8592760f85fc4bea5512995f71f9a8ca4782607a378aae9ad9fe600e7635866a917d00301591a19a01c8f3c3b0a1db96efe6d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e905b744fb9ef560bb73d44a7a8704

SHA1
ef61193b0327d9719e0a12d5ea45adff59d88219

SHA256
d9fc446ffc011e5e031167777b66dfd8f832fad42234596cad81b3a2b0114af8

SHA512
dde4bd9f476a4be43400ac34633e33ee53bd745117738e98d5dcdeef8e2a881ebf733693f64d2fe39d0599d67767c75c5f677f0509ef3e81346d2cb551373a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0c9a843ccf620ab2a4ddb38a70dae41

SHA1
590a3a5a80ffbee3aeb44342a0537631168aa7e7

SHA256
bec84d8a72019d9c7bc77e315f901e015427c87db196edc3a3fe02cea3bfbebb

SHA512
145889e9e25014552fa8b17b9771d703b761ce569682d66056e76333443292505fa98bfeb725ca977e5063c3062e8676447b87f577199cc1eeaec23eba67bfb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
168db37ad9d58a1c2b7bf66b477600b6

SHA1
f226dc47b545eed5451dd9b9c43ce3d0e1b66df4

SHA256
f20f96af468099eec112f29b5ae6b6ee5dc58e1ab2f8a7d36adbbd4d3baa41eb

SHA512
a3089136a23074cac221d6ddd8243bb03d960044da2b1c71a0ae23e908c0cc4ef2ff91711fe998c97ea976f50976bea019d4dc1f360240fa7dfd2a9c3718d2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f9ec7f13ea042496ded3c009e26caa

SHA1
0f138c2f90c1772f051f8e7ca871b6a13ba1146d

SHA256
5f3812750ba2e0684b4015c331ef3b3dba1fbf0b37be9258b58e3e062cd299be

SHA512
dae1c80295561dd299543edf3221e5fb2528c8edaad22b0605ad6f669966f9ec848e2f14e344a69db053d1ae64e3d6f69120f8fc1575450f2beacd4203f5b344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b578ea642cdd98b964a6d85cdf463ab0

SHA1
cb80e880e8b8aea4134498dd2c186d592cb445cc

SHA256
232f9b9d365663e04fa482cfaa53e51e7c517eff1c06d49617b1e331c8d91612

SHA512
810b6f1f5174bd70d2d17f794548551de004ccad250a55d260194ac733d60db80fcf560cc94eb1cd0e8077e80520b0a8714d228a2bce3e8b456b8a9642cd8a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f5ee6a2cfdd93d78fe6f13e5cde0d9

SHA1
61659362239b9401f1a06859f59af47d31e15ebd

SHA256
f54ab6a454d129195c191155748c65a137660cbdfa24ae33e86942e2b64454aa

SHA512
66e7ccfe107fc7b76d7c685ef3d80285bd549d1f39f7e7acfbb89f53886d9a6fcb3c77e4ebfcc851565a25f781956ef0143b91816ce2db1f0f7237c796dbbe45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
accad389c9ced4fd5c538a2a16403533

SHA1
3fafb158dceaf260df9e56ef18c1bc7fce77c18d

SHA256
510a7f030dd8a6e66e67a07f95d2624c462a41ab381d66b4dff9d6b8aff98af7

SHA512
263b619f0c20dabd6a946cf06cd9d6e3f5851609c7a23170561a308ad737b5ccc69a679cd3bc4d43c2c33a52caabfbb73c4245938bdd144626e202ab25fa5f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21dd71384c39ffa4b99ad34fcd10f23

SHA1
ada9b5bb5b67fa7187869b9dd4bc6f2688f0e655

SHA256
14b0509502a077704aadbd4442d342a39a613e30ca39c43a81db9f9201423563

SHA512
3644b926d3e7381adc4e10b6c35dc04555cb64f33113d251ebb158240a21ecebe6b0a1cb6c1cd8de8f934dad2a181a40d561d63dc8948353a89ca088e91ec088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b334c2e183533d94cfa7011ea82785c8

SHA1
47018ee18612250da65692d91d25eb7937d9788d

SHA256
d8a63d7e41a265426303b450c4220bf4d415b467c28a2ea66f4dc09a6a3c470d

SHA512
05788a6ecd988843f8daf390932d039e58e1dccf9fe5720e1ddd48e6a171fc6240c68da8838a8c75176266a7afb05b9a8d330c218545f4fdb728669ba8cd4ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEC8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAECA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit