e62b5601a91946233962a57b043a600aa716d32a5130c448a2cb4d969b384a59

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44cc01ff4b8f2441283b043fea225450.html
Size

56KB
MD5

44cc01ff4b8f2441283b043fea225450
SHA1

eb30b432cf188bc583331fc3d54828170475ab9a
SHA256

e62b5601a91946233962a57b043a600aa716d32a5130c448a2cb4d969b384a59
SHA512

de54576a16871276db64cd0d626f236ccbde7ea36c9fd59b9806f912d536d0fa5f05938af413555b2a1f5ab49fca6f681334ab67e17606ce57ba8c8b5a131e44
SSDEEP

1536:gQZBCCOdH0IxCUhaCcyXQ4MogbXr4j2QK8BBgG3Vm257b3WMnywPOXxOo/OrEipE:gk290IxUCcyXQ4MogbXr4j2QKqBgG3VQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE5C60F1-AC28-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004af201814f53a698593a581cf497e153b2ff960aa83d1a5300c40583fb6fc1aa000000000e8000000002000020000000675b50955ddd4b0d440dc5167a415992d56b71f428504b67dd19cc8287ba11229000000085baac82d911ca6e986747a9afc140b137d56202305ca24203dcd21f649f7cb9abb16b5d622c2e2663ab95f96bf6111a80294f18e2a0db67399c41718b75f730e28ed73cd5200377f46ec9a0241e709ca8298a80989fc694355ab1e86ddae6310469dcae7f343f5eebd5eaaafeb1af2bb2e74856d6edfad276c9fc7ff15f390a275fe849991fa5aed8c0c7853da2947b4000000052bf0819899e041b0063453c9bf9213fe857336c2e0112af3f460438268fc18167699d0ba97bb9395727ab6ed5abd9c5bf6d36400dd74ea8c29d9820bc9eddde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504e2bbc3540da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410662074"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a4ddf4a9040e378da3a6ce7a81c10ae799caea892a23eb35b3b14efec7d8f6d1000000000e8000000002000020000000f40f32328d6076d14cc60c49c258c69ea41091e6263c86385ab1a447d8e4960420000000ca90dbe0c5524d1f8503c1993626c2fbe0d2615c7fff4a8bc2976ae2e591c12940000000a3c98251cd641db1ea239b18e43789eb2853af024261875118eb1b34d31e7a6dc859e651a78a68a1ce958cf7e6ad339e60f7b7ee0dfe6c02757055b869afba95	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2364	2208	iexplore.exe	28
PID 2208 wrote to memory of 2364	2208	iexplore.exe	28
PID 2208 wrote to memory of 2364	2208	iexplore.exe	28
PID 2208 wrote to memory of 2364	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44cc01ff4b8f2441283b043fea225450.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecbd2bea8329a8b6e1d207cc0109edf8

SHA1
ac8138f481673ff58b75ec8acc117e0aaa594f19

SHA256
104bfa3bd0b8cc49931886cb8da8a02ab6d233c40c93147a6e9ec6bd4691e374

SHA512
095267dda8f938fea4df87c45e1d05cf24b0b95e2ddc7c9eaf493e17d85235e1dc5ea3c577ec3a768034d2481520c259cb49aa13d1acb146d9ab005695c9db51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32825b53e2d18b056d8d8602cd012b76

SHA1
4417c8d40b52f7ecae489ca05e49c45848fa97d8

SHA256
5d43860cecd710a6ac02f15e56ac7c34e2f7cded1b34f8906acee667543c52af

SHA512
3ae936f2263ffe7636e0ffbc611eeb0c31f7abc12900696ed5788f2f348d31a452ff056ef88563d446d08b4510fb0a06f4a64eef87d24de09117ddb0b704465b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
967bba53a1872c337f068586512cbae1

SHA1
8e6ef4ae0dda3ffe0c47236326c62f352659529a

SHA256
46132db83ca34287bdc136c2ad68167ef4ed84c8d8243f70390150d80f02acf8

SHA512
4f81acde9177f001f71586e83374c5e746488990af423f5992e510ebd95237134705f4e0b16679b6306900c3112ee29eccaab707f9415205958bca284da8d187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16dc96d83a9a12f51710543ed93b4aa4

SHA1
eefe364204a54105c450add22e4ecf6b507496ea

SHA256
89838c13052d19017b5b9d4aa458954f9e4fb0f27fbe473df5ef36a31f7ec5ff

SHA512
d4b9c1d31870e65d5cd101b1d971cdb156c2bd7ae9d4256ed27dd37629d4682d0bf32b13001532ca122dfd5a30e22201c876fe3b6f6da58cc01a45cb786c0784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0a10db47630d0cb7a7e064247f98aa4

SHA1
8c135c86ae2c9aa22487169d4f8c4cafda934dd1

SHA256
40d988768d165f4cebbb9b0fba099d84bed5e2d3599156135a76b2afb87710b2

SHA512
46d897a93aa2428aec11928f0ae22eb719f2a8b96d08dd724135125ab8532e4d44ae272b275d576b47f116db691d1c3cb269d760be3ddf976d137cda133bee66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4325d6727be058d1e3ab377d2c44775a

SHA1
07cd68ca26260b19ff8c400b084fc10b862e9ad5

SHA256
7dbc8e3089d9362f9ea1847288bd22c9339535dffb26267ed3ac5f524b510b2a

SHA512
3b98e1a7de5a3b9b172d86283076af236c234bd0132e568ea4d56269a348a4a1d76f9c5fb07daa1d6cc5843a44ba30ff0ae149ceeb9c841639eef045f947ee37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b677d6e9b28f1388c3354cf8429e3f3d

SHA1
3eb0983b6e37160174f7afe1a24fbb71c257939a

SHA256
7414e79bb924ca9060aba3e0890e58e5dad673c4f4e193bd9331991663051336

SHA512
f1a80b50ebbfe1c259cc0e91f3a850e2a1977592d1d299a3de3757f9f4709e102002d0c654272433b4593d0acf60dec657a64ef9a6a93938ac5e423d4a112842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be9e73fc3403dccaefe1ff8cce79639

SHA1
ca2a46b49fb983392c668c5b23d249c3ef484354

SHA256
7faaa68ff417e3040a844cdd20462a6d06183ace84f5a7dff11508c3e0034a0e

SHA512
90c73d1ee3d5f26616eeec539f1f625259dcac129d30bf50babeaa76d475faf7bb96fa44ee44fdc9ed02c15b40d63b97058b1bc5325ea3d9a8a707f82ace4189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0159898bfffadad202be4eca2e98e4e

SHA1
ecc085e665356e57565f4b8f389541bc8271309f

SHA256
301c55970340608ded04c87a311bfc242ce963923391dcbba12ecb4d61fa2539

SHA512
f95e9986750994508d31270372ea078e21908fa471abdd0c7aa02134db84950cf956c50eb2b902108fa2cabd741123a9623f8a92d098181a86a037b7b628a43d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88659cec6470acb4bda48d803c804add

SHA1
e2b07f95d804b68d7c5863ce001547086913af55

SHA256
2a1f6e4931e7b680dc65031f05fe3b2921a490459279200e05c90cbe7766acfd

SHA512
c3c37f26df958146ee905ab5275eea17bfc95f839ab1bf2f7a85771ff0a8d7d5b2cf5386bccea78ddea05d735a3aa955de58559204b72c983e0876cc2e3222ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc034acb7ca1bb401cba91d14b61201c

SHA1
c6c914946f753417112030423f0e41f9e39fc4c2

SHA256
7a3ce6f9b1358d92ba19ad903ff3f5db0c079ed6e90f13abaa4627b794a80e7c

SHA512
19bae242c8306f2d77bac42ec80cb7a0c02ed940990260551901485ee821498871aefedafcf378bba4610308df12abf6ee524e64bcac6873062d945c9640f73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab738D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73FD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit