6f846d61fc77902964b4c5e5fa181ecea3ca56ff3558cd80e687a37b432ee4fc

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45ab2ffc459186e5be094aa35c360785.html
Size

2KB
MD5

45ab2ffc459186e5be094aa35c360785
SHA1

01137adfbb762de2b96deeb2e1c35e9d43c2ed8a
SHA256

6f846d61fc77902964b4c5e5fa181ecea3ca56ff3558cd80e687a37b432ee4fc
SHA512

76c4d1de9bd6667f9612ea110f6df3b9e15670edb0907bf1f2a196a9f2123c0b80b2199df072682522b0feb490f9dc837dcccb2efc7ecd4cacb7f685476e7833

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30900c527440da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f6ac959a15faee3ead90626cd28d8a94ba7712e01d22837c15dcbe4e0e73eaf7000000000e800000000200002000000015b582e2e1e4ed8268d163eec641368d499e7059b89ebdad727196ae2cd2921420000000361785f877e541a0cb090bed2552cc047e6d249cafe8d3001c1d355ebf8e154140000000472ea3ed2f914c6361d6db8a43dc9488264b08d2dbfe76184f241e69fec34a3ee3c66a717eda7f6a2566b956d12dfa373a04cd14cdf0fffa1730d57ba29b72ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CE269B1-AC67-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000979b4dc39990eae0bc71a2850843450dd1f8dc4c8171a32926f29312c93140f8000000000e80000000020000200000006ba88e5a632589de73875c249cd43a2093b265486c709e6788ddbe90fba411e2900000001ade57e50b0b59d15ed07a1a0b9ee4554640d2d04bf97f609ba75818f0bf14deaf2c4e3da0b84c3f83deea5798c74e9e9da11a49af391842af2b2766b87c496c7308ad71e05fded133fff8dee096a51591cef554e86557298a07bdd1c8ff119f9361d9b45f7c903351c21d007e722d981308d94d9edaa1bebd3db9303ef87b4fc926373346c7714b2a47e3444d5d5f7a40000000cc79b9e374bfee3d880cb0a83611745a330e280c78e438069ce17af06aead636ab00926dcdf3a1c6d58477d1b2983678e0da40029ea24f572be2d52453509f62	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410689000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45ab2ffc459186e5be094aa35c360785.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e9e76933491be603401e504af670b9

SHA1
9416cc2404146155eedc7c6a1e2e291809bd392a

SHA256
4c4486bfffd4c54d517608d3e343d30d93045576f38083141098190363706c26

SHA512
1351139fe52ef7773a60e540926cdfefa4d16693250dc9b594ada8c0024b4d94997554ff1b156553ed9b2b60fc4f670f6a798a1c43382c8d01d63146fed37b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4610cb30761100fc2e90c0e52ac71d63

SHA1
97768850ba09eefb42dd02c48b96b12216dbfeaf

SHA256
099bd2d3611bc8de6f424b65652d4a8dfc57d649220f1892f38337e227e8d614

SHA512
0325f412b2e10628758db633634168fdbc1d40eb692fc821c3b8ba8d9725903f3628c9ac924f51f8ea5005ecbe7a76fdba0f5a4a5294af03ba3a913ad005fe64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9a42d607277eb520d83202bc87ba477

SHA1
d809bd29e3c7c863970c1a60f3bb759bb12e8f85

SHA256
9052822fd8ea90b5e0f2132700ca1a687df22b4cb29e887a65924e0fbbc75380

SHA512
e9fda29a61671da08634f4f3c65f2c0bd4b0b1c5ecdf5e2566ef0919057e0d655626d9e1f792a63bccde219330276bcb4c28c7040c064b8bcfbb22b1086fb8f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791e13497aed9d7dffbbdfd0d04a8f58

SHA1
d365aea7113932ced3330afca132296066c00371

SHA256
121bbc596d9550353b6680269703743ac7411bb9abb77ef178c0dd037ebd5f2a

SHA512
844de124c4880e9fb7a1fbd86872cea8a31f933f95b2e7910380eb0bcf604e32415ab60794dc8b558aced02fec05d87735d95243e0da1ad11cd037828b4fd935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ab2fec289e697ca3e3691e6a6f12ea

SHA1
b851ac26b10e9829637af1757bbae23cdaa8ad0c

SHA256
f32a44106c07de6d8db0dc6391376653bcfe80f9da65dcd83373b82f3819c41f

SHA512
a9769a5dbf9f3bdb3ec9656035433e625d32d9d0dc451ef938ba39742c2e927285f39a75d51bbdaafe27321caa52d7371dc0e2f5005afb788331464d562afda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d776ee07fd0f6b1e2653688cea84d958

SHA1
dbe923a2ef7558dd4740cd95236f160b6a83037c

SHA256
f35dd2379c826b64139080fb3a68476280ecf616573c1c9c5b45bd783d6c4c21

SHA512
4fdc70884365c87128b7d7f979712f46fb2082c5f2998e2b5a374909cf3b9bce04c42cb0ff915c41d050213865f8ff0795223e412fe1d3fb4046c6f8a304d3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca5f635eed6bc227df2cd1f8c82f8d3

SHA1
7fff07f1648ca6e186f9ea93c9c170c284cd54e5

SHA256
c8984867fd00e73e85020f8f254efffeacf687638e6d6b9b144cd7c0f7ca8d61

SHA512
8fc213b619a2a069e849f3274e1cdbfda96ccccc25e89df3f7786b020d00ed95559b4880ce8ac1486267beae0347e8710320b120d39f08ca27b1ac05e9c5db3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c42c1ba3a8352bc56b9c8ab8df1bcc

SHA1
32afea1c674a0e09ed312660cfc3acdb249930bd

SHA256
17d506644486e095eaf76ffb659e1532c8db70781b089176db4493831a85924c

SHA512
2f354224df8c81d7b8ca1545beb834d1db27d7bd8975f0bf184d0f29154270f6596a4593ebb5e7c25f4b04bdfe131032cc8e6295754dd5e4addc0d2c5e92986b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43630bcc313d6037b6825cad72d6a87

SHA1
2bf190552959fd37bf6afa1d5dd1603ae491fe65

SHA256
ef5447039e36c1cd1a03ee3542453946df8316cba6e2a69dce96d636d019a107

SHA512
904092f3da411e9ec0f544462d20e1291a2814af730b254840a65ead28e506d21cad9d2302fe02eb86dc3e92256e66ee46252fcc6257f8d4d63eb4c9bc71935e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03dc33d0571e6d185dba76cbb6afaab6

SHA1
acf739a2dab5d706b40952fc095d2b6b64bf0e46

SHA256
0cbf5f16cb962af78137d296524754491eec0802a1d95909ba4fe3a07787aaed

SHA512
5bc9b5d669482ed040e1bbebb69bf48f6974e9926dbc09b09024716498b4e8ae2317eb8cf7be58bfa1b02da3f36f5524908e7b6d69794597e39b26b5f101af86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42af3af03ae86c95260c5ec7a0686663

SHA1
8a665b803828d89291fb7081365530fed7c8b33c

SHA256
aa140877577af0d5722a74436d28e04312692deb5a9fc5634d328fefd91dd841

SHA512
a18790bc4ab5c83ab6401061d7e75bd7b0b2c56535d6af537bf2204751ad5c79ae67e46d8ae9aa59a4bffa54cb0dde5f3b7562d047fecb640d121778d2e1f76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c63a11dcd54c44e04c014980c38dbf

SHA1
6621842c212f953d18aa66f114507ceba859e3ef

SHA256
604e9b7094281a5e62321b13026bc29b0d03a327bae441db4df224017ddb2fed

SHA512
c77b825944bf52c4bab729baac16b742f49adb7c6dc5aeee617dbda087df4776f2b8838a933dd8289365637a9009bc940aca684b66d9527e8a287436fc6ff505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BC9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit