f3603d926f1ce7da0ea867c1687051ca9d751be33ed7f104200af33d90b16354

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4572df49bb28e0b25f4b853a0e3698e5.html
Size

28KB
MD5

4572df49bb28e0b25f4b853a0e3698e5
SHA1

1900a6f324c7a6cc8103625c7d254b716e58490f
SHA256

f3603d926f1ce7da0ea867c1687051ca9d751be33ed7f104200af33d90b16354
SHA512

84924aa5e4e23b008a08f6ba4410565cf3eed5803895fa8e44b5ff1103f40cf92cf95f4f8584be08ab3cfec76e6e35d64ca7d65ec7fc2c95d7409462aed714d2
SSDEEP

768:S2mzcqJ/6+NlAwINBhrwI5ckbIPbIGXcaPB4r:S2mzcqJ/6+NlAwINLwI5ckbIPbIGXcaG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{910266D1-AC57-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410682132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1736	2644	iexplore.exe	28
PID 2644 wrote to memory of 1736	2644	iexplore.exe	28
PID 2644 wrote to memory of 1736	2644	iexplore.exe	28
PID 2644 wrote to memory of 1736	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4572df49bb28e0b25f4b853a0e3698e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8152638c8bcb25c18f3d2c6daaea2246

SHA1
934fca7e714de72310f3b1a3c3e74588ded72497

SHA256
f2bb83fd5e9e0499490b9617067b85f6dac779ab286327490e5989972c63a727

SHA512
a25f2a4a472d25f6dc241b8721f89bbd5faf9c59710b707fb1dff664a34aeeda6c14da1ebfb3e165d497f49d5813b63d49a9746411c72203dc8de9c215f34822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee99b8679f072ca30087d00cb3c91eac

SHA1
d792d43f17b028ce3669a0b78cd27f499ee42921

SHA256
668e4d59ae59b7a9103f736059548b7d65813efdbb41effbe572c2a44ba15ce6

SHA512
c8d792998708fe770e60f74c0b4b1f01f7ce345e4b6426e2db6b914c77d0630b62be2a294fac4f9f843c5f91859ab22f85ea8c214af9a599c3662444c16221ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d578fb359251f69d63bd45c373be7bc5

SHA1
53e284297e62bdee0cb5ff1f6c3e0a02758982ae

SHA256
dcb974497bce6709df62504ccccecf89cf8821619b3159b4380d3fe44de1247a

SHA512
c72c2290dff2be8994ea054230ffe525e305a879aad4cda820070909671a66aa7cdd012185720399f26b4ea02215afbdc1a60e72f79754b4d61c0102cc62638d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ddc705a9dfcf8c85a8c1cfde0b0f870

SHA1
cae5c4860e2e9f986a608e58de01c18e70299159

SHA256
7896c1e81ce3e1218d71f4737922a157166a476aa0eff2c317e8875cedd4d0cf

SHA512
3bbba9c4290d024840401540d490547c66364d5bf9dd85b6fd767a5d2116a875d3b86cc191818ddb808fb9f37c3a677bcf81736b850d78f728a78eb3a3cf33b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c6d5c9753f88bc234d7b7f70a59ccf

SHA1
641301c0db8ce84b175bbf015650a84345f8f11a

SHA256
fbe6c18294b7bd6b9b7ea869efba15c4b692ff868f0837248b756a7b72420351

SHA512
266c5128757003cec684b714ec70ed36a03f713e32991cee2e029db8edb56d553dd463a035eaca58e5279790b1b92a02a1f89d420400b05ec3da2ecf3d808272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faac13db5487d36d0a58c604d61fbcfe

SHA1
11da09fb4a0ba01bf9cb3a2c15b6642dd6640277

SHA256
0f0617b1df3d7b6c815a0ad8606c5c74bbc7e64aa0d862fc26d9007de9a09cdb

SHA512
8ad99fb43d2ad973c7053446f77dfcb1fa868ef0aba029f92820335cc00ac9d2e6303d46a08be8fb66a1491ea27ca89ee417f74fa867c403ee64d6e927fb7696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e41842a4c5b9d9c59e5466a0e501ddb4

SHA1
58d2c4002d05f7f15fd983cc8eafe2e265dfb3c2

SHA256
92eb117e6c53dd88e7db41633935dc038b91ac1506c172f75886e02f06363130

SHA512
6c690e4dc9e3d1b1692f397bb932a66532e49db8db10368e8b41e7c500dbb19dfa7997cfa592439e36634c224892b372424d74c55203d0afe38567da92bac4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8049.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8126.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit