3961d745a24c916bc4185d95e0ccd5ca4b87e2277ac9c8f9b5c32241600d1c62

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45f0cb3abc0637175d12751fbfe2ea78.html
Size

64KB
MD5

45f0cb3abc0637175d12751fbfe2ea78
SHA1

57ebf732d9a7b5c6ea772f7b537d878de00f24c0
SHA256

3961d745a24c916bc4185d95e0ccd5ca4b87e2277ac9c8f9b5c32241600d1c62
SHA512

f0caee89255be8c2c01478afad005ffec68a604111c9014353b8e709039efe76688cbdd492ee418d41299120e3551bbc489f977019ce6af5e99bb1e1db266a27
SSDEEP

1536:/84T+5pRXEOhR1S507wJNZLY9flhZGFmCgJDUE/tu:Uj5phT1WqhSmCgJDUE/tu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F789671-AC7A-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410697096"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e689418740da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003afd27beaccfa10d3946ff2072ec5077fc20817e4576c527be153fed3f6c2dbb000000000e80000000020000200000009f2fecca31c5e807d51f361486f34184af9a09281f39bab73bf1b3e609de927c900000004d1949a0259f5ccb5f0e9e7288bdae0fde9495ada585accb98c9c40fecfc9bd3d2f3ebfcdda54502e82e9f2a87c57948d77bdb27498e2df0676eba16959340aca0a91aa3f8cba309276474b5a7cc815aeb35d67d2c2d46761f0616334d002d9b39cac201762d4bc752203f3db8e8b39daad47c0107e9a7cda36a9925f8f232b9b69c2fad22ff8c339b9e02b1d42b05924000000070cdf900f1171e038567b03dff70b7a420cf613123ed1a65ac9fc3f846c699762e51fc76d0d2786116f41e4fc5414acbc1a5d137444b70e4e2e12c8fad193f21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005fe193fb563f22d6f0baafb7395e49839b1cd1751116588da0ea086ea6123842000000000e800000000200002000000023088bec3174cc8238cc6d270eea4655de22fb1e7f869608915f1ebc8470b4ba20000000185e3251cb3a612f978812b54b10146b91161a0e6b32d35c19f7de61b8f84b6b4000000061d50fcff3337053bb3fca5731a82b9a52f5449f8f27a32bc9a1569cba2d9c010d45aa5aa18927bb8cb74e0732cd9f2d0deb236b7b66f5fa79313d3f118e8b8e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2320	2888	iexplore.exe	16
PID 2888 wrote to memory of 2320	2888	iexplore.exe	16
PID 2888 wrote to memory of 2320	2888	iexplore.exe	16
PID 2888 wrote to memory of 2320	2888	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45f0cb3abc0637175d12751fbfe2ea78.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
9f78b650287349c369a46ad1f2b6d515

SHA1
18813d9e873681703b6668e5ba10f5628ffcf4a3

SHA256
e665732d1c5e0297a24fd98174a08c57af503ed96d9f66537ab01cc5833361db

SHA512
747eb4255771adb6fa68da8aef56b9949cf0f054b57920286721b7be83c371a8982ff6b927c256044801c28e8fb22ec80b3f9d4e25926bad279834bedecc6ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177597f00914940e2772a84891c67d60

SHA1
65a13a4f0fb0dfe25383fe77ae82b862df2f0f63

SHA256
46637e01ecad8c1b4f2c98cd00abc25855000958b81e04615e236a0d103590d9

SHA512
590370cbbe9babdc65fd1643f4a464ff8374ea936a5443611e194f08529ecda7740c2b66a38589bfd41548d499a5419bc4bee36285ccbdf187a21f7ec4c9635f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
970744ac65709683c310b737bda5d469

SHA1
84b29e49ce33b39f72d411e007919e3e67b28a6a

SHA256
a26cdd7b8726fd0ed7a539fc79114178331f27e2bb98710f5aa2376868b3362d

SHA512
39f53e9fef1346d6039a6148d97bff2701f02803f347aadca742aa14ac907e71853bcf1f62e4eeb018058266c8f493b860286bec9c43217590a570a26bef9f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2c3ee14af64d0b3df2dd7d0fcb9e2636

SHA1
6417829bbff2e33e96c7ebb048fdf819284169b7

SHA256
b526426d2ba55f66349091a32d6ba55c31850d8444e5a07b1e27a569d9c36b37

SHA512
1292301d27ec628d228797b178278ab94c8570cf9bf47cb3b49f80e271d1ec2516376302dd8ffb26d428fd1ea9c4495d6e1557eac0a73cfa41f1a2e786e22d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KZXBLAPE\platform_gapi.iframes.style.common[1].js

Filesize
21KB

MD5
1fd4bd70ce209470267e6f12e04a9ec2

SHA1
7b1a69d12e4d9729cfb090be7bf9b85def691f8d

SHA256
89c214ada7e763bdd43e23995b25dd445afbcdf341395b4953e59f3c9757e933

SHA512
0c253b7107b248689a40daf6bc53737b1393ce3d67e578281ee01c386d9322461334ccf411b73d2c4f27f9bdd5ac2b8f66dc32a8c1eb78e866852ecaaa8d2d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUBRC2YP\cb=gapi[3].js

Filesize
44KB

MD5
43fd21d8c863ff4053cfe98ffaa4471d

SHA1
636708d8afb572af42b41b24d14fe51e52771dde

SHA256
41d0af51dba232eaef1f2d2fb6ec4b5b336c088fb14308e568a9ac5a0fd7e272

SHA512
59e470cbe1096365579a0abfe6ce4fd99b1e0ea356182fb5a1c583400473263226623df0c19ef2168b8a391f5e72600ab119f478d2e1824ddd9f22f10cb8551f

Download Submit