46e4b1a64fffe1957af562ebd771564852b9303824d5c6e03497b63b78991270

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45b048064d645d6b57a00d180d04f1f0.html
Size

52KB
MD5

45b048064d645d6b57a00d180d04f1f0
SHA1

af37996e3c0b8beace1f7c15d25e2b6c85cd143f
SHA256

46e4b1a64fffe1957af562ebd771564852b9303824d5c6e03497b63b78991270
SHA512

f0342dfec97214b74ab8800c3b86bba614da06007d386ab62417291a1f7e51d66eb00c12d10d54c98da798dd58d6cb77b232d955b9d4d2c4268e30cb06ab3b6e
SSDEEP

1536:n5ReJMCVeFh1EnRDhxHZecWAlWal1mj0qp9AyAuBq:nAMCV+Qqp9AyAuBq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCD1DD11-AC68-11EE-A83A-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000cee7ae2b23dc79643581dfeea588671425f630197d3e45c3976db433f320cb87000000000e8000000002000020000000d53547579e7aac4e4358af8d55a5dfa3a77b6db5df3ad8ed67235b59efffdae8900000001d9eb6fbc6ee5652e906ddefdb0e983e8ee01653ed2b1c13b2d0222813ff6e4d3c81e1368f14d51e7651c9167fb27c37c7dfcd106771ed2ec79f0d109e63c5592d019efc8b2e060752ad8e29839b1461aced037b4a10856bdd00b8b687a1ab361e307b1fd27da516f8c4c85ce1a9392ceca1a763c4b6bf7aeab81c809bce2c9f4abc09ab619bf17f7fef915a7f45389f4000000070afcdccad987ac9397db2b31c722f77eee62fb0b38464a97f3917ca640df3a31c1c982063cb7acd09b3b26d05ffe7d83c80258fb7d8e3d765eeae2a788586b8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d6654a5c126326820e88b96877da593962702406c4619efdb400e12068cfcd75000000000e8000000002000020000000bf1119b362925e4be44421d71a182f2756955580f95cad91718dd458e4a46871200000006314d0072c905b14750aea797158bb9a888727eba17726c68c541d47759902894000000019b919300a59e57655d97a9e1754983fa4b66a96e6d2d57c7154fe6c6eae1306b33a329325eb3f3019a2df0bbda3c479ce68e704dc04a188f6bdc67cdf02f94d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410689536"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09955a67540da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	iexplore.exe
1200	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2624	1200	iexplore.exe	16
PID 1200 wrote to memory of 2624	1200	iexplore.exe	16
PID 1200 wrote to memory of 2624	1200	iexplore.exe	16
PID 1200 wrote to memory of 2624	1200	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45b048064d645d6b57a00d180d04f1f0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df824e5a05933d286fc399cdca6686b

SHA1
b6e4956248f7f86434b4d8700fb73aceb3c5a51d

SHA256
9f9b9a135f2a7ad309eb2e2ae2e49b1cbb5ad6af941eaf65de6d9a52f1d36a56

SHA512
7ef40def97ba42cfdbad0931cfcc30ba7f2536792ab6d84eb264dca41b33e061044199a0f2b81bb6a6f2e48e32cb484bcb4be8d2abc62d2c38aa0c89819adf78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3929cbdaf2b55ce004869c5dd9253df4

SHA1
8dc2423176e26521c34c6dd3435f26449066be29

SHA256
3b10fb273813f3082206bb77da4e8531868528077f822d20a8f79bc41ac23ed4

SHA512
9c4313606bca4b41b45d5016fc91c5f794e5134884b7a1f38269dca3fb2d74cad1c467dc063e3a7d137103ccf6257cbc6e542958b49e46e7808763facbbfda29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a372c6c82cca234f38745b7330de9b

SHA1
70d88044a483a3cd7d4e61c709b20dcafa83e0db

SHA256
bc6e4c74c2018015aeb80d43d9250c8716f185e8bbf0c320338d1d9b2f41e5c9

SHA512
f4d25ac9b2100272d011b9368254f6d7368f8adda413455dd3d93518362f5d7dfb65e17ef152c8a1c913970430e8b366b188f75dbc91714a2155e7612d4882a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ec76cfb8e279e3d918f0deb862e8f7

SHA1
f9a1c745f0590303b7521b98e8a5dfec62571ac1

SHA256
5f470972a0c2168caaab48429255aa7e477ee9215e6e2514ea0a25907b9cb85a

SHA512
39b40cf46bae7b9d3749e25fad61301b446f5340ce2b3bbe414746795b815cbc97d20f957c978df29e05291c05b2064b6df0947d10e28022fd29afb07f5ed746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e47bebb9e5fc1b0767ad087c62c427f

SHA1
36adb9e47e3b585bdda11bd7dbe0829fd9b1e484

SHA256
a39fe84793f94e5b5977a3888d12c4b6b81d435d616f94d3ee3cf4e4e1afae8a

SHA512
9d0fdb1163d12163fe94500eb7d5247271104aca30e6f18638e473e48842530b52818984913d1a3e42ddbd171bb6ddaaa80c9a725aa55a8f444eee5ddf1461c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b1c2b6cd04cb2ace46acb4099036638

SHA1
973c1a39cd21b9ac78830218788aff8bf8d3309c

SHA256
58433515486888f6508bbb3204f313dfc2a0c72406e3c0f97b40d266575217b4

SHA512
004802ff497aadfc9f81b9e67bb917b7dd41b15d3a7af59c9125d5a2a5ed16470c7851401c2ec38bcd5e1a871e99223cd7386bd74b97ba3007ae64093d3a2865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb818fe2e8f985a514b22218d7a2c472

SHA1
22de60e381316869ee8e74c09ea2bed5b68547a0

SHA256
c6d202f8e0affd179bb59d6526c950ffab514771cfe0c3ad958496d930993fdb

SHA512
d720981adb174db821a8b2e056b86ecbe778c41a816ce79731963252bf815061743ec59b7a789e0d1dd61b50a4fcdf96c19250b92e40d5bee506558062a11bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db24e191025c9f93816fa981b92fd065

SHA1
c1fa3e2b76e2813ada35ecfe238b525b73234161

SHA256
7cac23b2b511be6a1747ab577bdb4601d3b6e3928a50b1e3c9b3a88ab42deae5

SHA512
0f58ec8681dd3fb8779855eccb5879596740099f65318ea57de31d01e7d14e9509b25b2e6fba62255da9aa5f77fedfd1d017106a1c6b4f45321c9006c21ae715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0193dff2be222e59a81f2c511782a7a7

SHA1
3599299cfaf05240aea1950675d08cf3d7270323

SHA256
e965c4a22a54ac6073acee62d7f1442d98eacc8141f8189a1adb7ca9993b164f

SHA512
9e4995df6c29c308d7244be2bafb197e3737764c6a49acdbcbac7ab249337e89f86d568292eaec057d56a24f45fefdc83c78a44909f5cee0327f0881e9629231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d45fb472b29ee9ea23c9765d804c3294

SHA1
b2c2f7bb5bf4544f82e0509559d84997c44aa9de

SHA256
678ba995834da81d5878a5ab2c6493fb2dab5b758df1de8eb9dc6443b9d99c9e

SHA512
39a086ed8215860883886fb875dd668d41dddd7e433b9df6c64958b7615fd56e3a42399baa3fbe7fbaa60759127b7392c6b5c5a07a3f8cea88df1e06a537a5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
926c4d657c80624d36cfd5333903a6ec

SHA1
1009cc3c8f8c40ba94608ac0e3c19b9f85af243a

SHA256
6668c6c6cefac56cac28236f46ba5654271c054537794d9896b5330b40cb9c3f

SHA512
daf5be7398ef8043d104f0b7b0f0100f7152bee27c5af86fb327d68f3e9764ea7c37f29f251608b9d3a919a5b16c00eea66264bb4d341c233023879d8cbfe283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfdf2c0400ff384e2fbf1c3ef3538d22

SHA1
f3b2ae5c06e0700d7f774c699ce7f9482a562a21

SHA256
03f4acaebc6f034172b62f9c273a192a45f65d659790531986b3cbed4bc27ef9

SHA512
ef5127a55cbefb90e5d36f6238b1c0c3af28b7173b99b06e492ab3e18acb1ff659184fd1ed31ff4f058cd568e10b2fbbd015b9cb76b9a6d05d91acfb158e4272

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3C6.tmp

Filesize
32KB

MD5
8fe278bd8eac660d0161a869da96b8d8

SHA1
eac6f73862d89fc8c49b5331cabe89b6a57019b1

SHA256
e8a6de34603eb9e91ba82f555080758e480ab044ffa9c140028706f916eb2c0a

SHA512
b180b8df22e421493dcc75a2caed123f7c7756295f691579ea5c426c741f80e381b4960b5cbd6b5e87547d75e44ab654d1c4704fe34b4b743a57f334bd05846c

Download Submit