13a4d34b7995def132711b309eb2f6258f70a87304ee3ad744e0bd0c82958e8f

Analysis

max time kernel
120s
max time network
184s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e1f6eaab31953e8a6b2a1a60c6b0a4.html
Size

1KB
MD5

45e1f6eaab31953e8a6b2a1a60c6b0a4
SHA1

bb603f687cbee9fb0f6c2e8963334621856c8f00
SHA256

13a4d34b7995def132711b309eb2f6258f70a87304ee3ad744e0bd0c82958e8f
SHA512

ce536a93f6f85cedb8db72db8b4ffecb6abe97445ea62dda44bea072da91521aeaef9de581f8c90165f4b5d72bda211519b0d852a66cea29c358e975d8852fc7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f9deb5212eaf2446c83354c59045df4ea25af36fd6b362d3eed2a21bfc545919000000000e80000000020000200000003ef5d6122e337c17473308e89acdb1ea8d721f81c9b743cd7eb0a536d212141f20000000da4bbffd541fdf63bfcefb431ea1b69962d856abd40cd0338f74bf29bd67f4584000000006c0c67a154c83772d6177f95f1b2f751e109b0fe5642cbda54338596dc290bf01ebcfae4b0c2b6467f3e5b1fceec76b8348cc3fcf2e2944867b1424645aaf95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70028a0e8340da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410695294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36F82AC1-AC76-11EE-A1AA-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001cc2d6da200b094f89eb76a614689b619958d2e560063fe9236187c6da0f2bc4000000000e8000000002000020000000f1eb67c387c05c2c8fa3ae7e4445db3dd8f154833fec522857d61c8c6882e5bd900000000141c4946c46c5b36abb974bb74ad622e91c874eb10069d6eea94c188d7ae5675854084d256ec7043bed369b5dd64e822d15389fb88b9d5280250aabff3becf76f7d440e23f4fedab1a3a80eeb03910dde9f3c54b88bf3bc7b5d7717c2bde5e746ca5d10df6f45da2b57ef9625fe872747cf84e4f24e61eea5fa7ae9750c0f2a3850fcc53bae0be0f9efdae6cf3af1464000000025dfc701c2a64388922a0ca860ca8c4916e676daa97ed101eabeea8462271b1387026be47c4c73afab6fd5dda2d5fd8a90b948218dc9fe24158e335b95bb6b6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1184	2328	iexplore.exe	28
PID 2328 wrote to memory of 1184	2328	iexplore.exe	28
PID 2328 wrote to memory of 1184	2328	iexplore.exe	28
PID 2328 wrote to memory of 1184	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e1f6eaab31953e8a6b2a1a60c6b0a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9afb0c69401e550e89d251f79c2f2085

SHA1
d01067e5f6741a7477e4f4735a249eabde13d897

SHA256
112bc250fb33efc688c146ce16fa9c66452d3fb2a28e37979a73f31ba190afe1

SHA512
96a894f18da1c5a20e4bcf88e48d34938855e6df53acc8b8897946fffdfa041f137b2b7b6b4514561dd0db1cfd525d270043d075b012559b1aa44256f4a79499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc39f15b1a0585c17c55cbdaf322d4e4

SHA1
9b15b93a557978b8bca7008a66fd5cf9d919d311

SHA256
0a780db2c7749ce6a262c76a1c5eb9b47617d208de30b1c9245d1a44e9b9425d

SHA512
c9f16af9822c1ac92eb5f6e8efec001ce10a77d5fa03f1976d1b2bde41cfa873940707ce8ff90771c86b2095ac21e6c38978efb6071543c0661cf9f827c994be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd0bfe38d73901e24ce8cf407970c020

SHA1
80fc18e2b1dd2a06f099fb5c6e40a1a71f99467e

SHA256
a313b0d1e141fb69ce25b03facdd930d749970e1940f3410d8b1fe8f3c0e0857

SHA512
da4e9ee015fdc2de2bc71d08064445bb732db9dc50d3981fc29c0e307f2b0aca9ffba5f5800051d5d77e5031f8e130d0ca01fda5bd118ed5c545eb4b9c7ac5f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b44f39ff9cfbf1dbaba269fd5f15ca28

SHA1
05d0ff063775b2ab9dbf4a50dbe45cd7fe80d628

SHA256
722982c51eb96c2722f7f06cbdc78dcc2edfb08296a796817789d17967cd5b10

SHA512
746c76866950342c9b3fe313c3ad08342ed32c3d26b749e6f11b11930e7d37310e889b86e6f996d7503d849b2b27cb543f9130f13caf15873fb082e178aee870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b13e46bf6104beb85c019826dfc5102

SHA1
0fde5b1d19d94d8725b3e8b7c040bd98ff88b8a0

SHA256
ee4890a2f4a9d86373740fa1275b93babdda4940ce1e1688a7aac4c8344cf120

SHA512
10e86e3e5ea4f47be098a83f4303ea2aa0ebab883bc4124c111e7847fdd000b97c2c037f29f0a90ac306c79f246a3bc029dfe741b4e79b3f962fe10a5bc0f1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab414dea77da5f2c40a974ce5173b850

SHA1
69957b518fe96ba385572e456f00f7d46ca109f5

SHA256
261683dd3493fe576fe587447de582d7b30761fd88039da086face857913b726

SHA512
9cecfea40262ea4d1bd6dd5016b8c2ba5e524a2fce87d8ba5dd18e29a2e756a200657c4f1fbfd433207a872dbadb51d326a3f61cf3dedad85b2b80cb3ba111e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4a37dfee7333624a470fe918aa0a66

SHA1
37e0899b48045e37dc5df456df2bd482f60970c4

SHA256
d70577b4858aeaba3aae27673056a15950e3bfba9c35dd8b7528f513ac88a43e

SHA512
cbd870303acccce44064ea4d1a94a424260a776e292a97c87845eef98298d9f52e8a280854f9d44cb5278315a5e198426eba2fd2adbe69ba4fdba791b8c8523e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c8ef1be541f5b905d17f4660ab3556

SHA1
6c04a3f127a16e4b70b9fd0bef6e516de8aab87c

SHA256
601c4ad93e41a269093e9079d3b79db822e814e034b4923a92c07504c4def213

SHA512
24ab346ca23709a3328a0e2b36707342e8064f367b3babd39fe7dacac4c4d7be83214569c2b1e4bf2e39f03542f46cb6c21e0bfb71930d17a269d182b74f16d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE765.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF7DC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit