e3badd702ca4c88c617c88fd39759b4b8e4fb2d7b7b2e68f51cc83a3c9d1bd70

Analysis

max time kernel
166s
max time network
226s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45c6b6a698d4e3cc73894bde6d4afa53.html
Size

14KB
MD5

45c6b6a698d4e3cc73894bde6d4afa53
SHA1

58978225bea3972c6e332df75140d2e9a9161329
SHA256

e3badd702ca4c88c617c88fd39759b4b8e4fb2d7b7b2e68f51cc83a3c9d1bd70
SHA512

2636c7d8327cce6e33d2fb6fc7e5ae5fbdce73d817610b6be32ca9390e8321fb07f02a5352d87fd694d9cbb9e68d699386f823d8f4c665a61c8f50d95e8f29b8
SSDEEP

384:pfcTPr7R+6IKWN6tGRA6Z9urH7SPjvmKyvu3vSuzM/iPvzf6PvR/2w1PPEWumMa4:pfmv2Ks/PLCHlXNMWfMV/TcY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01d75d87b40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410692140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD6EC30-AC6E-11EE-9B2E-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000002dfbf6095d8a160b8c3a8fb08bf5fa089114afbf854c15aca82caa064a64aca9000000000e8000000002000020000000d265e81395eb187ec2cbec29bfb139a28b2a324bf078d962f487963adfb5e76490000000d6d4d67cdd624b5f11886ba0c86b1a499554c6e72f23880860b4a8f93d600d4d1073a2f8e8095cfb94b24f445e6d1c9fbe0e8537299f41681c992d7fa6e869ca7bcead89f814c878b5a94ede29ab7840c2abc4bb4d9bceb68898ded8e05f6d74a7105240386bca309837da0012d3e37e350a9e3344cd8f8126fa07558d8298a366027ad13a92c4aea92cf3559058c90540000000fe8f19e7adfab6b3bf9342b20e742db35dd9aa439c82914fe522434638322c6bb8b802ba0038ecd09a59791fa9b3e5a4607e44f18c30a98e239575aa2b220351	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000008453f3a9ba78939eaeae1ccbe2718faebec96eb512fa86a074625761ff7414ab000000000e8000000002000020000000c181f590f9b5fad2b6518d7829dbaa4b160a39e28bf3ad83a5786304452ce7262000000021a2e60a5a1cdf558f53fa5dbef0b2ce564da40451fd117cd3543715004960a640000000937da25d48c3f2bb8a7af54b6d0c6991948d3b2378659771a849268d4a31bd6d9d8debe7f62fe565cbab5ef039a16584822c999dc4255f3ad7265dcb1453ff77	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1696	2728	iexplore.exe	30
PID 2728 wrote to memory of 1696	2728	iexplore.exe	30
PID 2728 wrote to memory of 1696	2728	iexplore.exe	30
PID 2728 wrote to memory of 1696	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45c6b6a698d4e3cc73894bde6d4afa53.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f87bbc75c9dddb6415913589cc4c3d

SHA1
82a1c478caa5312e48029e46f2db77438cf8d900

SHA256
006ca30426f41dabac873ad4d1c29112089c76f51939fd8ef746e9d12929525f

SHA512
e60afa2b74e6d7fc6044d94e5e687899aae7bde41c63d032b15b500b2eba11c8cfe0964c5d32df17634c5467a9d724c0a37d5be396a00f06a7d1cf1536f989e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eb4854a163fbb6f62d323056c00b343

SHA1
6c42a92b6b7f055c9aa8b5e2e206bed194789ec2

SHA256
170ae1757cd9cfc72e30108bb3366d31d6cb1844379ba1392af793a84ad3c76c

SHA512
8b9066eb5e57a15c81f43aa67304ad017388fa7b65be22c6e47f55014e5f678572421b3b4af4f670de6d960fffe909a3d9cd8d36ead3a678b6942c9e939efe9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8a69568568aba07ec268b03c1a29cb7

SHA1
d8d08c3e1a72e2fb9ba1af7a2e25d2a2c113593d

SHA256
eb08fc5019efde580a70efca6ceaa4e7c8ffe5597da7becac7265766074e3ba2

SHA512
18ca64e53906d48e46ba417d56dba5ec977dd6b4459dad86beaa34ff029616cc56a41398675d5b4b8f0990dea337aa25c3847c3ce383e6ebeb3ce062e4cd7766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d3e9e17b0d8315d1a9d0dfc8c5b3f1f

SHA1
5d424732a627e84a6fae037cc6fbd03a168e8ec6

SHA256
48089c7b2172b03e1b91073de25bfb6a40a6cbecfa28e77c64625e829796fcdf

SHA512
a3c4c04598fcb4a7da20766510f90506b111f87a77a74026e1a89b842adfa873aa3feb11d3f12ae80524e77836be422507c82556ea01a71a2174260fe4de34a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a4b1443b979fe724cf3454550218dc

SHA1
6d1d5449744cdaefd95148d10d531a59f09ab7b8

SHA256
eae3d029d7aa0a3e48492b0795994ed02b14a4d7e2e0b521a02e7ccfaaa5d9b8

SHA512
2967e3c6345abeea6b64c140943a57eef522762c96613b477fe33a961a03bc5e414870358c02fb9b678348e5bf04c0f70cff97d9884938668bf0a785ce9ca37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4038ad5214486477029d02a77b7f4440

SHA1
b836f34c672b78c7957fab0796ba6ef589835f65

SHA256
252984b11c32ded7edc1702015493d3812cfa348b2c1b7df01c150ceb5616ac0

SHA512
ad2877ab220e92f699d35c56b452cd81beadaee01a9939b417f4679aa145f828b393eaa83d948e99fac2eff24c762c9f621b70a4b163a35e9c40659922f8f015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c7311804b5aba38ffc45dbb6c9ae560

SHA1
8178b3248f9a521c33abadd188be949048d11f1b

SHA256
04194500893fbd30ea896365079d2fec9e53806e5d8162d07a7ac84816e1de25

SHA512
5a30f996ff1c97328dd2dbceffaac75f7638a932074f0865ad1e871fffc597aca6cd9a41c905319438fdf11666477bec6052c963adfd4e824c89031fad958b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a53525e923419d8011de12b73cb08be

SHA1
804d0657e3bd4a11a5d7cdc58e76525fb78c9d46

SHA256
20ce39c26cd652f8d7134e8c6edd3f9edb0b9dc9e6a160eef8703225cb2d4d99

SHA512
56d9e309e3f42db1c34920ad62de4cb4a33a394bf5ab1b07eb0a2d30745c31f2e17047018e2a71564613b7d05ff801d976e8688ba676406b0b4d7d39cb102962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd225850964da8b75c16dc45e8aa28fe

SHA1
ac9fc3ecd29cc302ff574d0a822909d7926c4246

SHA256
3a6bb439ad49acc7a33d085043a7bed644d39f0d2b2764b936e4f115bd6a505d

SHA512
87f7fc3e8baace9a1b86233535052f5ab5c6a1ff282320a6a18afecc0a5ebda53b2954311d2d671213101e79f2ee1f2f79f041c45aee8d040a35c4ff07214c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7669b459b570103cc5fd75d69bfbec5a

SHA1
0168faf14aac2a4f406a1fc56d4cc1a44d17c4ab

SHA256
8df6ce163f28bfeb40c2c75a442e7e98b8617907a931eb64837d281e4df3ac8a

SHA512
baf01ea30c7faa6c13efa6c226b47792b89d0cb53fe61c343b948b53097dd3de504e7bb000b11657f9e8da30cccd8c7beb85ab3d7e554e3d63fcf908f3c0dd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbfdf091e00df5c5e99f19d2298e7fb3

SHA1
3343d3acc2c0afb695e7a700b8950aa9b9683ad1

SHA256
c840eaf96e39936721350185202cf804d0c381215c83ed32664a4040df8f1963

SHA512
7d8b56a2495b8e2eacfd16f4000204ff9cbca5399ec602c80bc867bbacb1f214f164f2a5b0a4d7ba86150d375db03d5bc7899e8e4c8b418c572e5a2e5ca33ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB550.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit