d5bf297e57a42c69074f8a5d8079a1d166c03de589b4b8131846f9088361d956

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46159a545a6fb7529acc39dcfc7f161e.html
Size

94KB
MD5

46159a545a6fb7529acc39dcfc7f161e
SHA1

f2d39295b5e98960cafc7fb1bcb26e004f310535
SHA256

d5bf297e57a42c69074f8a5d8079a1d166c03de589b4b8131846f9088361d956
SHA512

71a8c72e1a72b1cae0d86be565dd3c4fa9563bbaa46462db78d94a4c94eebaadb7d8b12a902bf4a2632d5c3adab57db9c5ef0aba721bcbef774ebe4b05ba9d38
SSDEEP

1536:SkjkJUFd4CdYjmCxUu/EsUBivnJoDmo0/mYNxSdx8/K:SkMUFd4CdYiCxUu/EsUBivnJoDmo0/Vs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000daa22fd2702fdc6e24cf14bf830bab12eaa59b0a95a7fbac9b3b0572c1da3eff000000000e8000000002000020000000a8a092eb41b8419b07aed1828318c02906aecbb5f0fef2c656467cbf6c39bc5c20000000531449b27a7bfb929861aeffa0522e46a48e69c13aa874b08dedea11fa2a9b3e40000000b75bb8b6a0208ca881b84948e317efe016be91a90a7e8d9a15966ed11c37f7154aff250219db0f9b5d7e8032dfeb9ce372d89d218568e7ebf79a6b347eafc9a9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009bf045c583e2b631259d3922fa709af85cca8e3583e6aa11d13275089855338a000000000e80000000020000200000001948fe5edfe7542c4bd0ab8b0c804d39473bf16d7f55b49f439cdeb240ecb6009000000052e8671f1ee35448054e2754b9549f0ae3a1a578102f414c5d235e70c8a63973ba1f296a496188b1762768bb7e77072af022fce102a121d7de6208a53576b9a63c58107516b6d7628a5ca16a1b290b11ca8c28df98a5784f1ac2fa452c8a86d9e423005526bdad9ed80d4c833610a8ab5f3508793f8d744172f4b0dfdbcf64aa1d511a8562fa9dfa384324e46f4a279340000000f704764ff27da14403d44148891edadc2c685d6dcaa832385bf8fb7c82bea74b9c9cb891bb81eaa61e12990265732a0f392bd70610116cc975a5ea24cee05221	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A55E18E1-AC84-11EE-8AED-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601b8e7a9140da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410701502"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2780	2904	iexplore.exe	28
PID 2904 wrote to memory of 2780	2904	iexplore.exe	28
PID 2904 wrote to memory of 2780	2904	iexplore.exe	28
PID 2904 wrote to memory of 2780	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46159a545a6fb7529acc39dcfc7f161e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65073b16ee7504efd6e879c76c311d31

SHA1
a6b37cee52d09aebf095077850d7c4e94de4be8d

SHA256
23551f646f62fcc2fe7c20729faf42840d97d4f6fcba9442c6655c661922ad8c

SHA512
5eca60b6166c3061c030dd07ed13fbbb2957ef49e5bbc103217a954546fe8de46e75c15b694e3c517752942319601a3ff8e6933f866e9972e4fb6cd394c36cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95ecdccc2cf60f9399d2c625f8031671

SHA1
247dffb60d9eada9d0c8696b7b202708c7ea6aef

SHA256
6620cd0fcff2fcbacf6329b51ebb5ec3bebdc28f2e02bc467d12fdd1d93561d0

SHA512
093849e8976dbf970759b793e1b2a7d01b1e538fb19bf453ad5c88f53ad8035f837cf5c9c375598c63d7412c26fdd431c75a9fce45ec60dfeee5c00d701bfbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9295b622a7e92627140d7531954453

SHA1
8e95aa63acaa509b39d0d94222d9bc54f24a56f4

SHA256
14e229f9f678dd2bef1b6203c28a59b856f4800a3e9eb7161fc6334b00bec15f

SHA512
122041e37b1c6e46fe2753689d7da69f0ce2d0c02d7bea854be649d3057c3a310cae140a738edc5a12b4a02c1cd8ea88f2615ab8cc94eff26e60651658906111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263668f57d8785946e0a17d74dd79862

SHA1
413d22e2378192360633d93644a7580a6a04ba8b

SHA256
3b819c74e36e44423194cfa57a80079fd4809f89b4570ae0352a0d8c7116dc50

SHA512
f511eefaca6d706d43ca79806f4c08ebc0974a94178f1cd08034e7dd3440fee5ed42e5654400c0a803513f787a37caccfe3236d6219a01af6d3bd959e1add09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b926ee2b108da7dc04b9d11baba31d9b

SHA1
7a0443a7eb8b77b525dcaa5f26ed0b65863f4dec

SHA256
e8cc7ab8a8d52ee48d9e65bbf75c6e19aeeba1e33abb50ed05041da95d59ca23

SHA512
44fd9aed79f113401fd61f139264c068d38a46334c7b0cffed56e20c319c3caa469a63fe6186a22e49fe162570047330359c823ba864720583622ea8a8f662f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8371abed736d90dfb97efa46f042f0eb

SHA1
aa3f28eada7853ada3d8a7776a7de4a12f2ba7c1

SHA256
972e2e4dac16a2b1a4bb7394bfd5f71437d5d4965a6e6c53d1169e2bdb71c4fc

SHA512
b93f125472feec91cbabb87500787d759439cd2d5c811f2d96b2243a1613e5ec74931e0bcc881980df1f199b43799b03ea84b7ce2b39a0c754d7078de342ac6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
620a81d59352097a1ef176376a8d35ca

SHA1
a5243051223d87ad71c21c594b45787395c71b03

SHA256
7f220c6d46766a1860676ba7691a9cf252f1f60157035613081f61d3a68eb362

SHA512
c1928eaf27673431823688995703c9684b7fac5bfb1ea69e10f7834f699d4ff830624b0081e5f1fef85f7919714d69435fcfb203faab8b532dc4e1a1c448bb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8405430edf51989c03855d8c0810f2d

SHA1
a6e652fcf1703407ecb621d0eb044856d83d750b

SHA256
c1f6fa8a5f144be87bc414481fc6b5e87d2acbe023942d0a583a50c0144aa224

SHA512
f874226d3a2d4d5304c3c2a3a19b2b5f8468e027e49d5d68ba1ecadba1c3ef7f66162361d440345d04f845844464f65a5ecc58c3cc4351781c12a66a45f57bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8646d73471ef12a68a8af657be8bce91

SHA1
2aff125a97d259f57e7dc792846f7fde116ed702

SHA256
4366d1893afa0934a37f401bb8d56de1e9cbe1f0b1f1dad25a04de10e142b5a1

SHA512
ef298c1104c9fe4fe251e53cd4a558b21b2da218a3a9832ad41b3b289045fcb2d122c26b07106956147baea14d0dd7c2f0310d5a1cdc927853f2acdab1862c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af4e1cfb08b4b0dac107e1e52b7f6e97

SHA1
3cc06d9ce2705324fded1f2cf484ba47a15443bc

SHA256
6ec0fc2a83c1e2e3f15372aeb7118155951da611cd1eb5d93a171bd1286cc977

SHA512
3e0648afdff27db4a859694f1eb9e8e089f729fb03b94112ebd4d956d83623dd6bae1339d8edfc523f9a271a88bdf01f0926ebba1f8dec7b31bc2212bdf6cb7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab870E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar875F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit