9f3b61f856595be9d45afbe12ba07cd7f78022c243ea1cb58726bb7431ecf937

Analysis

max time kernel
240s
max time network
293s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

459329afbdbdc0173f1300fd1357cbbf.html
Size

2KB
MD5

459329afbdbdc0173f1300fd1357cbbf
SHA1

d31fcecc0ea1cc9448457860afddb761e5cc1fb3
SHA256

9f3b61f856595be9d45afbe12ba07cd7f78022c243ea1cb58726bb7431ecf937
SHA512

c1e01e02d0850062d359244cc9aa414a73333021a52156836d4797ee99c15f2fe9f85c78f15c47f8cb1e55a9edc15d43814e148da02a5d853fcfcb85c20e3d10

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410686298"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FBFB6B0-AC61-11EE-B160-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000a0622e419241a290f2957a2748ede509d1467da27125c45d7a1b0e28be51df6f000000000e80000000020000200000008ac16458e3659e84f59faf40f3b829f880a226b77a2d2ffa637ceda5e2212e6690000000ef8bb82ec39aaf99121f28be12e3dfa2a35385f0b16b0286a9cd2f215cf17821d6048591bea19e891a109fde008e2b17850f7c8de1e59ba128ab0264ca447cf4b7e50aa3b0f48c28fba57dc5424cd1a46c0a83072bd298a0e85bddd140077be2ba47fe9e8f0ca4189c471dacc8ef0abf41c26e1b2552b532ef102e51607f11e28c9ee4c177d8e96fffe79d69e5809de0400000004f9d0ed4b5edd8126e5ca2e07ba6ceb281103635cfc28f164e734db67f192e41f770d2cc788cb35dd32cbb31709adb66e45b2e7a63c8ebac08f6204cc4a342a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000734bf9873c7b07bc98ea813044b96d6143e6dd13407490400eddce21622d2320000000000e8000000002000020000000005bc0d12347dd9cb7caf31890b53dfa420a9c8a63c947925f0df6a43f61533a20000000c28191b78cfe184b260a1a21323c1302ca626c4b72684f0c8c79ae5f87fc0d9d40000000160e6ed217697064c0c996fccdaa84cd752df36fd47df8789e029a0c40803e4e709a4fce4ffe2739bad6ae73fc4e46062cd6d6779d8b30939393693dc8e4f8d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0089fe1a6e40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
1592	IEXPLORE.EXE
1592	IEXPLORE.EXE
1592	IEXPLORE.EXE
1592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1592	2860	iexplore.exe	28
PID 2860 wrote to memory of 1592	2860	iexplore.exe	28
PID 2860 wrote to memory of 1592	2860	iexplore.exe	28
PID 2860 wrote to memory of 1592	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\459329afbdbdc0173f1300fd1357cbbf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563ef1bc8b1504b7284be6ee73100bbd

SHA1
b27374d4a1dbf414a15ded7658c4630d9bcd9bdf

SHA256
52a02e79aaaa4244db99c5466f75377bdcc0ca7b423e28f163383a37587e7a64

SHA512
36e0c0abc302996d286fd33ae27e004b7a3e4c18f57cfdaadfe9df3f58c1956879622056e11da443253f973acb6dc0398d5a86e05471ffa43e9951c001299ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0667621c458a289809b9737754fc75

SHA1
049098d00ce439e3b7a3854b36d3ff14d90c9efe

SHA256
f8dc2df6ce2e5bef82c9851b3388bb19ecc907b29fb85b7e47ba5f5650fcd084

SHA512
540c3975cdc2528a7c70037b39b05ea91d38aa06be07e1d4a4c8a26f0caaad181c1f1f567b8bfae685940aee3661ab606850ab022bd4c23d180f98386286ddaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de8328dd509d88a19199298efc359a13

SHA1
46b29e241a95f6ae0aaab17ae1c3d3129bf4421b

SHA256
551ac460857e04ade2357252f47f3cee960b4723a86e9c17ae40f960a727b2a2

SHA512
7cae85ffccc3ac9f9bbbcbbd2b1bd169b90ce0d7af3ebd895004fdab0e575d32a48fbabad6944726527468920b11976c2e96a3ea07dcbcb2231cd6598b050951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1810d720e76a69bd5c08c815d3fc9d7c

SHA1
1c9e245d70083f32b621504150e319803d469076

SHA256
5cb8a4598583724129ba8b00f6dafbd98068e0ce3ce5870fa859679af8cf5774

SHA512
835c8269b2770e997e97a50c76c8d217fe15a7c6620be58ae1e629dca09ee4adcfb771bb451455dd3172f4d4475ebf79af6a22ae88ee3740f9c09bac444d27d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef0317284c7d818455069117e9f32de1

SHA1
4f327379cbf7ca0ea16f8c00758cfafcd00047ed

SHA256
63c7ed109997da81f8e5579d6574d664c6c5c8dadfce74d6b6dd3489faf2032b

SHA512
6cce8a0536fd52a8b49585ef384f4a8925634ff8b06c4758123cabe2673e2c03b3210e05d63bdabb77e11cba1ce9a0b74e530048774af4e5a06d7c4a1804c81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ab41e019985088409bedcf935288c6

SHA1
2c7b82803119f13f2cfd00970091adbd4bed30bd

SHA256
88e543a07c9cb80c7ec5da125e6fe16bf03b3244612abf15198cf24e47564031

SHA512
1bf3718d2e2508da48f8412da5e9eb6027ee1a361fdae3b5dff47116c8fbdfa55989c1c38e66f03f1f4fc359aa60cb5001457e6e8095d24f9d6280bb8d3e696f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e3dd908dc5fd1d0a6c494eba7d238a

SHA1
b869d51c811f714c43ed909d3564bd98266bbfbf

SHA256
8a2d95d7175e6927312cd9e94b456f40ed7a17f1206b1ce9f591eadd972761ab

SHA512
de8154c2d00898b6a97c7601bcf4b42d4b17d81cc6e206c8c05c814c59f70cf8837efc34ec2f9f61be83ecfd5ce9b961b0dc5f8bc5174c030074e7618537fe1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20cb8bfeb2a261275d037e198dfe2d67

SHA1
71c8bc79f4207e919e2a8b4d9973d0f9877c4364

SHA256
de68a48f240be552f1eecc7475bb5a4ef80f9e1d9c84e50869a911262c4950a3

SHA512
b20260808c2935906c3e2b0f339059e7a498795bc2d33266810e9752c3a2bcbb0ba4d1d385623b81836d2e37cc3606c8db977bc28bc8f35d12c56cff60a2af7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50eaeb670f90e33c83f2b34922a12613

SHA1
083c7179e1a4746a60ec37f8a07fcadad6a3ab62

SHA256
17d8db4857e335773f5b0a5d92b72d97202c34a4d5a8a644e00faf2fa00d0168

SHA512
63615558dc6593a8d609e9f1b7107e1b5c1f5fab42166863531cac31e6e0ec7c51b3f45e777474cecef965f7c6ac5995a5e2bbaf93c7dbed0c6a874bfdab9fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c64d96d006b9a85941e47525d1dae93

SHA1
1ca43f9e405abf05b06741ffd82a90ff1c1c5792

SHA256
8da9693067882ab8cd6d77795ddfcb82c46e065399bf35a27af62a6651777561

SHA512
218dc6cab7de2d1fd7ffb7954500831ec84733aa728a2a3632271caf8abdd93f628a348814592e168252713a6e60f12b4b63f6ecab1a182db014a88aecc5099d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6dae8b838952cfddf9fff0d308c1ba5

SHA1
c14a8aec92df6617391d60d126fdb4f74038da97

SHA256
ea5e9c74e4da906fbaa95bf93f752bc008df86e4e3c3e8f74db92de80c9498b2

SHA512
d93550a46e0eaa4a9069a495bffebb651afea0c700918ad5e326c37dac5bfe631430692ad4e3ed4bc520698e58f779479e1c8018c0855dfd1008f68410c9a693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af3f730df7886d0b5d1229e70212977

SHA1
c4cda9ff8550448d11b428317327bbe212d9d276

SHA256
e3235d1efa7e0dcc84a180cb21afd1e9e9cc630bd9d6246b3e1752ee75a22608

SHA512
0c64a5bb6f83439822686c42667021aef6cad55da9f2e47ada5d9548ffca9ef7e9020246bc0cc64c92854c3577ae853419bc28d1ededdb3d5a0d321243c86d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b3138de2e74ab8cbb69910125fcf37f

SHA1
b9aef4105e3f144b73f2d538292d31ee44db75d3

SHA256
434f371500a47b563a3092e23c0bff884f27f677bc32655fd7a0ea9f216d85b6

SHA512
4814cd0987f5bf2759c9ce3ba4ec8c45db986ffd732815ac722d264ec1ecb96b98d904fbe8c78a3bdad5f8ae24ee20ea84d658aab3449c27537f760f79ec1196

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE64.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25CF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit