e029e3d68dd83d67353b64c644c96ef2899d8d5aabc3cde8bfbd784314982ffa

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45c34e9b9ee8a6287383729db9b38e00.html
Size

15KB
MD5

45c34e9b9ee8a6287383729db9b38e00
SHA1

1f5ee51ac1989a8eae0048999b164a2a0a727b79
SHA256

e029e3d68dd83d67353b64c644c96ef2899d8d5aabc3cde8bfbd784314982ffa
SHA512

af4e72b9842f800986e0d66926ea9f9fe878b0ffd11fa1af8b7cd7b9af38cdbdbce28d677a5c19e77ee28c336a98ae3040e687272792dfdc6a23a33a4660f908
SSDEEP

192:g1f83pKqkWNKoW051w0n7mwGd9gmGRw5XnSQsW:Qf83p7kuwEmwGjgmGCxSe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000018ed6804506820153f9dabdfb52018a396ba410d51d49c8322e20d769caec1f4000000000e8000000002000020000000ae45dd62d8519fd013112f478d223d62b9cc575f2f2c20a8b04e50df1e96cb4d2000000008731b59cfd84595f8a84e5dabfc78d9bd719e20172e4ecc4386dc7593ac26b8400000008f6c7ddb246919771d5e581ff4a771c12a2ae2ae0dba1289af45dce18c1253a9d5d20281176bb5b470df1739aa3e3861f373c60c0aa6cc0ed5a0d1f765c7bde1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ff0cf87a40da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d92d3cfc78386e452847f42656489ea7933db56b18626ac5b8aa2256e74c0a5e000000000e80000000020000200000003b78e1fa6d121ad98d547922817b69a533bed1ae6ca85e9b7d9492f2606bbbe890000000944553f39420e7b60d8413d2ee42ce3b34ac6dddfdeb427fa225c3a6e9c1a149e1a29e550a48d41d7c0f92a498ddb887a29863db1c8baa5c7f35bd8025a1a1759f05d5c115bd3f7f9fe9ec1f4a35d980b776c1bd81b31d345ab55c8c1c2a0099b2933e3d5a09f15b0fc39033e2de79b0c0a777199aa7b76fd047ebb5201ec823e4131ed8b3ccf9401daae1770db39e47400000007f406a8c5452e8a2035fefb4b73a127d5e12bbdd6d580ac76496c4d21bb92f5b7a452c4212a71337bd175d8cc446e6675fee5972d4514e24fc8d031c171c52e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410691738"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDB2F0A1-AC6D-11EE-8809-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2332	2060	iexplore.exe	28
PID 2060 wrote to memory of 2332	2060	iexplore.exe	28
PID 2060 wrote to memory of 2332	2060	iexplore.exe	28
PID 2060 wrote to memory of 2332	2060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45c34e9b9ee8a6287383729db9b38e00.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
b92e8d29cd0ae0d024043f796040ce64

SHA1
19096116cf15fcd894574c6c15c78318be96314a

SHA256
fc011253defec8046920d884ea4e0d556b343cccccf0b2b901eba2ca896488f3

SHA512
9e0ec5441838b3705f34dc5e63d011b045b67e22f5c69d19d244b27093170a185b824eb8f8be89e71f2746fdb27bfe717609066407a3eb5f0d8bc526f7909fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1540ce039546f470db1e87d29424e1f7

SHA1
fe507cc8f314b4a6466d2b36c5e099b957676eb3

SHA256
ad5042b8b432d7a8d32dedf61c6b06ef213c0bf1a237b6207e6b480dea7e5f75

SHA512
e47aaf4b44165e85160fc62b728f6c8a3f17610ae15f55923e6f8ed4894ebcf49a6110cf14225881b9d9379c86098ab1c6d25e94f3f682079e3bfa7cee8b4f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701516ed719087a1e5ea8fad09a9f552

SHA1
bd9905dad16be9151ea7d218f589a18146cae211

SHA256
8a4a35935a4f59379c489054824a075b0f72b7b9a39db1cde953bf07187d505b

SHA512
309fd9451a027ff90113782ab25450279f3bceabd89f4dbcd494d04016a1af48c3a52bfd3163c2cdf518136229628e3e740a411555da41100fe509061986d29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0709eed20b3c98eeb67b4a640963f51

SHA1
a28edac1e214be31fc6929ea805b125fe30a291a

SHA256
e2c36d6c4eb7e985a0a76dbb02ed6b6686d6eed61724c4feb6522bc917589805

SHA512
0707a349c7470281f89403084654e574e0589d3de0c42b2b3c58e157cc9cd3ceba60427f662f14584d5d3d5a014eba5c4102b32f4758bb6c16d1c6456564c03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a4de332a00d3663241814171fff4b5

SHA1
43aa7bfea69878f85fede08a50ef9bd57c5c68c4

SHA256
038d62065b3d6adea76f8b9a465d3135f1d2b10c07f485727f391efea3077396

SHA512
18724613781ca06cdf161c548d759b8c6df0729a64ed07ed671b72a9bcb892445a8f14ba2c99b59986112574c43386bc3d523da6ef4b73efea7080ca1d6dbf34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee07bf43298feeea6deea217b2706985

SHA1
a86d3ab6debd1066573ed7629f65c55e7f002252

SHA256
7a45f582d9f1e7dea21c00266bcec147f476d4c81d79278ee735f581799d5a89

SHA512
2123ad7f40807cbb107f2c4f1a740043e5d6018cfc764d8e5cba58435c087d392e060075e741ec6c8314ec7e2d91dd8e688488d5067eaa94a337454fd54fb497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e350ad2effcd552cfee8cc6d13639a1

SHA1
47016417ad5ef9b1fae14b7e4685893c01fd2e61

SHA256
0b2526ac2fcf534987362c174412b2254a5369d4a2045eea81dad941e6e238ab

SHA512
2a3163d99b1d2a5a96e6c04cd77fb8ec293944d548b85f2f26339ab0d4236b067e3a939ea619f60300174b24e9cfb8c56e67dacca653c63ade976f4771420708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f701ab2eb31fbcf6634184004203cdd

SHA1
186e0525a7a0b47c7c660e37d7847539e856042b

SHA256
f0c6bc6d04745448558c633a2a689ffb8dcd34d9aecae22e6b3cb27386c27833

SHA512
3ae9c7844e751ac4b69e37702bc3d830c8e99c6efc562fa017b3f0488b9fc2d691405e6227af017f45fb01ae7adc971313ae2c79b31b70e4716f3b66ed83b903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b8b1abf646775b409018c35704d387

SHA1
f0a866f5a639845e4d22c1d7701a18e4ffec9ff0

SHA256
8dd260fd61e03da70684324670a0c6b529c02eff1d79778e1adbcffdb50422d1

SHA512
c6b1ef341d05b95bccc81c2f3d95fdf40e5dea5858607ad80278ea1c722a110d26fc2288c515926bec9877b96a4dacf87cbdc13324ea3f72554e344a3dda67e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c93a5044d185e31c79a0b9236e19e74d

SHA1
dde55f62001776d66ed2cfd4f0e99def1a7cc57f

SHA256
e44846e6feb90525b7f9b67abb631992a86b10199b5a26a2ca3d71c23c8f197f

SHA512
019ed179e37612adae49aa3d41f58540e7da72244a8bc2bc86b21594f2d574b2d21887b8a12734783ab5fdc6f040222da003b99e1ed89204864dc741f398c0d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33292d7a844da27f20a26b410ed78abd

SHA1
903b6143d4b1bfc899e5015de0521e8222fefe62

SHA256
a2f7e7118855534ac53d3df94e0c109a9b31c953077a35b90dbd8a292a93f4ce

SHA512
bcc89273465d39431e08539909dd5e58921f0fd191395e4751bcbde5224a38caaaf7af5da577f98601ec38afe17ab567ee48e1bb914f43b4021839c7bf977a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a62be94672e701618774f44e28302165

SHA1
c048d7469e950b76b4eabf947d00741eaf6e1b0a

SHA256
7f3d53d8687177c390a238bf16f4d873a50621e67a459e40cc18cc9ce9b87d7e

SHA512
81b39ac499f6ed035a4ef605d38be09a0cbb9566ef95a1ea25f2c073592476e1e86809aeadb467711daf36ff6cf84209db9fac802eb1ccac518f802592768d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cdd45c1b20eb7ee78074776877d9031

SHA1
0def907cd9a47af1c76d2df477a61f2f839f7ff1

SHA256
d4f311d403eaa953fdac033bd5d4deb313622b6db4b484298cef4a9f2475cc4d

SHA512
c8e69463b61e9cf60f98ade35586e39d9f0c8d57368b8578529c2784819c8ae8382407eac6a26263c2a3ae5a7460ef034dbb9f6bbd7d47401d027842e5d4c9ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7827a118c323e871a46e425b7a61e53

SHA1
de412f44c7d4d9af67b314dc31c3c403d435d900

SHA256
85ae5ca7d10b28b3b46ddff54dbe4ed32bf96f3a702b30a91c9e372f64eaa447

SHA512
be743abb0b74542cd2b7f1133d1c186a227250df9295450deb946384d2d5e37c2a81cf1243e9c1ab2d9a487bc76915660dcab3c919daf5e2119e43d97037b052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d350a451245af3e6e0f637f24d15102

SHA1
806263d481637d2bb612a8e5316f70963d98c86f

SHA256
67e9be01fcd8688841e0c1b03d44612d3b05370e435217a67bc3469c91fce83c

SHA512
4300989facfe755d6312be5fafd40b5221be2977220a0ad5047074f1ed4b49a205fe4c07ee4e0df5a49d01ee46eed2a358b313976a250692a8566bb29400e407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4617.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46C5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit