7b4c17b4a29bc3e33d2fe7efc47d324e873f0d2d0097345c05e16389551b6c8a

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46485cb05d422dd5ed8cae17695502b7.html
Size

57KB
MD5

46485cb05d422dd5ed8cae17695502b7
SHA1

c10216c08a3c35259ad59ba97671810a7ade4d04
SHA256

7b4c17b4a29bc3e33d2fe7efc47d324e873f0d2d0097345c05e16389551b6c8a
SHA512

146b82c3383143ab1c1d9f3c4532d42b6b6d637783f0dc42256643272af89dbfda998f46188a5c9cf558934a45875f684d632411d903373e48379fc2c042867c
SSDEEP

1536:J3IRIOITIwIgI4KZgNDlIwIGI5IMJ7StIRIOITIwIgIfKZgNDfIwIGI5IVJ7S0us:wu5nwntsQD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000df2c0f219b93dfb789d80535f1bf3d14a41b53f7d6ab0a2cd0bbc6be33cd95f0000000000e8000000002000020000000f0ef63f97ca8fb12710d7b2f6180ff95a0c9ac79cf90816a29efe3345e03665c200000005b9df3bc5fa12bb94e92fc1660dc64834f505faef4d966bd103b81cde693f45640000000480f11b9b82e78b40526666f5f71e4cc2a282d64510913a462cfe117ad0ce2899f24eb529f122005e3bf098456777922456b52481c8594a62475d68298e7ee43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000006d93933a60e2cdecbc73189fb61e4f80f3785fde4a6d3cb02f34269ce8c109fa000000000e80000000020000200000003f01498518645af0cf166b50c8195c8f154381334a0f3473f69a078fe2a5b1a2900000007499c55790840159a553a60633c21ff13a0d32ef379651b946135ba1179a9523f3c0b3ef10a7040e65a684c3653b3213d5b6e791488aee1df27bda3d6e31c0ad0e145f8fda8bdcb64dc24c4a8f301c6a9ea031e23c89e3baa4630edb2d7749f67825d67013f4f3fe270283c634bd35da103cbe648b66192c4d155fb1c48acbd804e9cae6d9be7fd28a6aad0769b12aaa400000006e2da3e5538af1e54f1ce58e66883c97c8665ac07ab6f28efa5674fc9e5c83deeeb4e1a4fa14233934b81be726f7d3e1be18f22acccaa8388bef89a54273c02c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410707628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3EABAB1-AC92-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409324c49f40da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2648	2092	iexplore.exe	28
PID 2092 wrote to memory of 2648	2092	iexplore.exe	28
PID 2092 wrote to memory of 2648	2092	iexplore.exe	28
PID 2092 wrote to memory of 2648	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46485cb05d422dd5ed8cae17695502b7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60b0909cd33d0138d98c9dc3f3ed1e31

SHA1
5026ae92d23a47d3c02e547693789a6f965fe43c

SHA256
2e5d395369faba6b1c6a07056560df97ec31c6e305a7e2e820b42106ffdedb39

SHA512
99b4054b42e7d0a6cc0debdef2118bb647f39666d42c5f3da7c89b165afffe2d6923aaf6938f3bf6dbf3202720e7988853aa7d6a3965f18d4d225164b4e4efc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a068494534af7656ab73d6fa6daf38d

SHA1
52911eac7c3b607234dc2e5909d3998fc7c343b6

SHA256
43f122ffda378376f4a63ba9f8aaddb85c603293acfbd0a8a9db4c8b48c08a34

SHA512
d5c799788da9babbb2d0e7db5e822194038f8fbc65f3c62f6e873cd23a55676a626b133932606fc60b843a059dc5f7b4e1529ac7a619575f5b1a0e3ae40ba244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f7b511609e176d0e47d044b17b1bc6

SHA1
e4af0e6a5ce382f60ce50baca262837a2661a83f

SHA256
ec3625c431fe25d00ee505c305997f8e80e90fc723738a63f8c243590419a2a3

SHA512
71ee6c79cb353a42387e1d82d2df0584c635eeb1bfcd9f9f2c935a1de981e1ae341295d8a49e83bfde43bfba9ba913ef228cbdd27faed7eae9ec38d8fe13949a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f3de42bcacaf017af237ce8983d516

SHA1
c006bcccb830c1e47f12c3bba61da8006ce296e2

SHA256
f268b6040c8174d933295bb4cdfd04faabb3737c259160b8ff4eca931454d387

SHA512
515b8e91a3e41c0ade72217978d79197bd19a9d86c79b0712c99cb7e00019096075e4effa5d51eb458e50ce9f5ac01f797fd187130911453d224bdaa93d50e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a88b550282028f9879703899e9b7a9f9

SHA1
e40526b6b9c9ce225da372271e41fed2bb0fcdc5

SHA256
008c65ef725719e271c8e2e1eef60c01ee59efa9f3ce3e2c0080ecc0695146d7

SHA512
ca911852b669f0b99b1563ff97f644dbf632588d378c83b24f1c05df68334b5a1ecfc735c0279d0dd30a4279b5875bba6e076ec48c390673289b2354c56a58b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04bb145f427ed2f5a8574702c41f7798

SHA1
c33a2b4ef84565f301a89957c161e06148acfa0f

SHA256
5d27be33f579ebd81c2fe65389632919c99bd478f52591a7e34bb286b8ec40ac

SHA512
1f2c1e7bb987a5e8a6d545f7a0c0937a725cbe932c39a672d05457602c4c412fffe7e90ca55060724eec4fd2920aba27fd6bdfea5402f61483e47c2ca26a8c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5d1ae99c2cd1f0470fbfc8c7492973

SHA1
a3cadde1249a839e8686c93b610237ae3533e47f

SHA256
2f3a6f184693711c5b49c8d5303f7d487111605aaf35b5d26c20df8c21d2368b

SHA512
16976d1a4ac958c8320a2782baf177b0497386627e2ae05c83f7754657907ff5f9c8d098f091fb6ff364331351ae5d3d0097180d5f33f99c3e46fd6ec0d3a3bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca52cc15571f8839d50e1fa62800c731

SHA1
86dc31825c86308d83457c54f4ae362d94aa0c24

SHA256
891e935744d5b39d9ca5a318883b156af955898cb74b9f4667bb9180cc398cbd

SHA512
7c5689525e31602a8a85a5eb537800f3cd98ad4e7cf79963a4c7a9a6a1ae56c0a8439bd3e1df1ddc5132265e0b724704451e865746d82b38824100ffc56c54cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8076685d22fb9fccd3a333773cffb736

SHA1
815fa383b87ea4e6eb77e119223254afa7ff159d

SHA256
bcef03b402a25ddc64bf3521406b962e16a852511f0e3d135b4b5f2ee78534aa

SHA512
ccaf754ee7c62c3e9a947c8d9da08ea59f4035eff254642272e741ae474659fdb56f349fcaae5b4736d817ebfae9e0dea7e30c2f2ee11c8ca4f485a39386270d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbe0e502ccb3f162774920c524afc50

SHA1
39d4ae11ffa7783fc883914191f6c5d39b3afef6

SHA256
782b06c40dc642f436f8e0884c909bce7079b1b6451a11709e0193321cb58f88

SHA512
b2b7f2c16d99cd56c44efc9e9fe0107511627fec01c095acb8be20908c8b3e05494556499413f59b84dd662f3531a4845e9ccff366b666414590c8adafae507f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8634a4b67342f6ab9529fa0500400d3e

SHA1
2ceea31e6516bf02194d3766a2ce7f92a6080d4b

SHA256
f56ec9c12a1f5d2e523894a23f5b4e3aa6d8b0316abe9cecdaa05b2a0501cc17

SHA512
c5cd71ec6ae9018c2c9af2e8a25ab180e62c3c27d3cdf13a72a21f884cebb85d604123afde85254f84a5f5541db3cb7013361f0e1b243bc535b5adc1e5302d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a21efe36221b99643e2dd45c50b591

SHA1
4b39334a6807540152b949ead606995ef90ce4f8

SHA256
689d2883ba7e883607a408edfdd12f2265cf8dec87249cc871417d99f918bcb3

SHA512
9eeb6fa73930c9f537966ebba64d3fe49826a621371f6fc16e3eb7a995608d2696550ae2cf9eba15dba10a49aa08d7e1899b91cb769c6cababd5c8b7b0623230

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA779.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB91.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit