024d71af67b9027108d8ef760c956377d342def876ea6a3919fcc35cd985d2e5

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

464b3422410444fa133f4eb6606ce50d.html
Size

24KB
MD5

464b3422410444fa133f4eb6606ce50d
SHA1

f64aa4ea4d86e7d41fed3779332d59bb037fc651
SHA256

024d71af67b9027108d8ef760c956377d342def876ea6a3919fcc35cd985d2e5
SHA512

e15655ba284db5ec6bf7b24bc87f18e8304082277060045d20b906e13cf84af8fd86700456de8400ed98bce5b1ccb5037f0153e92b0feedc5f7ed726e9d012b5
SSDEEP

384:scWRxrc2wZvqkQ5khWnYjXfOsntOpj/lJeSXuEX+:scWFwZvqk0aWYD50iouEX+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000474afc1e023fb99ce9070a39fef7033e7035f774f80c296adcc0101d50c699e9000000000e800000000200002000000013abb94cc273d4b35486136305180de0872ad6e97fc5d6216751e2ed97dce25e20000000f7dc83ac20b966ea2f11f9af359c7786e832cded9a9ea1aca2137d3570630666400000005180c80f92c2db7d1b539b53d69bbc754ccd0172d1795e4798e732dcf0998ef1a7cd1d7fd47b8cf41ba3f64c43233de124f0834ced524c3bc34a47a109c17f7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d028db9e3972d6e412dd334c973e7d31c71b85ad5dcf884ab08aad4f19f86508000000000e80000000020000200000004f3cee43aa0280857d98ff798f4c3ad9b92d821437fd5c1fe90d3c893b99d7a4900000007def57867bde92fca16fe3f9ace4cc979faa8e2093947699ec7e44e9b201dc7db02a43c34802d99ca5b7cf8c515ab8cf8f18680a9f3d0e853e9ef96cf1204cb2d0c752cfac4e7aea49797d2b7f4445dd186e5c507bbd19b0bd987d66f301df62bf20b3f05be1b8fea7761b1fe7aa377f862f9e2e8d1ed9c1a74242f5e5864fa47b6122fb997d63ff78dffb4760d112914000000052ff49c19bc22989a98196168409e43bcc18a915f023f041524b17daecff3d3d14ab79b15792ecd5fade7251eb800af222e4ecae46bf30cad5b4a5f4c4ec849f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2ED2941-AC93-11EE-B58D-6A1079A24C90} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f94ca9a040da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410708009"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\464b3422410444fa133f4eb6606ce50d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7863374baa5286ebe0ff11b3b2535703

SHA1
6fa7fd0f6688ccbf9bf2e854916066cb337cd861

SHA256
a4577b87c785287826d7de93ea49fb44429f77a660bff4f1bf17de2dc2f9921a

SHA512
22038c05f81801c483c128f0559b6288fddbdc1b65ad1a32cc7c6ce920ef391c8b925bbb21b459ad703b665dd4ae7e840f4a2671933c25f82985c970acfb55ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cff6a1535319055b257720721ca48eb

SHA1
467b0753379d88a8f6f41e42402d2708db301671

SHA256
3d74d9368b8a3a62263a1e4ff1d39089067f9e306a3397ae4d4884aa7ba13468

SHA512
6efa923752d915ec54a0492ab4b4fa88b66acdc9a397571f54827101ebdda6629849e3a174262fac64e7c81678e68f568b6906028bb77a2b10e0a61d808accf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f8449bb3c91675912194fd2916c6aa

SHA1
471123de18fd476ec0617f2bd0047dfbc4dca52f

SHA256
195848b6028093a7c89e8ab387b1bd7b236315125f3652d926644f4e9becc435

SHA512
6f28958fb1d931e982988207eb0ed68f924867c2a832593c6dd41abe1bea1d6fed7fe861a8d82c1561562617289aa7f850ef692fb6d91cc8770a58f3b871a042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c59ed6992992bd75eca7a808f4394f27

SHA1
938dcbc5a8a7501adc8350412692090fcde9041a

SHA256
206adca2924c7cf0e6e498e8969d7ac71e1c879028f0bbf19d427f85d79c97ad

SHA512
98566f90d6c65be2d9240fb6b7d654d12a7af5e2f8eef3d77eb2d7ba06903015e277b122de839ecbc086f4e07bcee2913492e52dcd38de6e051187cf8c6e1b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b078c89cafe1256408e8f97d7c328861

SHA1
cd4df41dcb588f8cb9f15be0dd16ca788e5fef64

SHA256
a55f260f1fb13ae4646eb11830e678a9de0d4188bb5fdccff43e0832bd45cd2a

SHA512
dba548bef03dce54119328c14ed2d91cf305516304f9ee05313d32b3cda29d113bcc006ed8d4b75c45152d81b923ce16d4cfc6ccc754053cb4130aa4ec15235a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78267b92a7848b4ce9320ed7c2ba8277

SHA1
43603190b622d32d2d60406444cabcba98d295c5

SHA256
a56e2dc98f191f1b5280873ddf5c73c101422d03fe06d91785049a6410da2994

SHA512
fd8d924cf2eebd11da82a187c448ebc631364962849fe32f19a0499667222694f052bac0b89e35beb63f7b6886cc96fd48f8650530f96ac5d13828d35706b235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea4953aa6d52aa5bc489c6459dc4ffc

SHA1
0c8cf8c5f75fc0048d8d8e60e48aca06a19c11e7

SHA256
cb95c22b857776e82dc57d18cbabe50b621b72306705229058412c4d50a8aa97

SHA512
dc4077a68e0624519de25b8b1dcf2ccdd92eaed1eafbb288ff40ad3c29ce967be24b371e2c7e4f87c5492fce9c4dd15f161411641c6bcebb2ef7b6e1d714137b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0dcb27f4d5a244edcd5c9af214c9a3

SHA1
b39064358f7edcdb0adaeeda99b188d355e5661c

SHA256
49142f696e462312e508d7681a2a68974eaa8b6615164c7d04ef90af5aa7713c

SHA512
6e47ed9876e1c9f6f1da968d01e04c1559dfda200b658c43c7f9dbdaa5d42f70e58e7295c0264632849a24645b354ad43f17b2c58ea332a879c200284c703f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\geovck08[1].js

Filesize
6KB

MD5
ff056f5e62d322e0ffb8006810432ffa

SHA1
6808ed4019feeb2bff2dc335ee8bb15b2433465b

SHA256
3250a0f23574ff6897cbc4f49c9bc4ed6dbe0192de6e12daa2fb01d64c04ee99

SHA512
94f02459d6b0527cc553001f0379df19eb10db181c475b43d60115a3ce434af96cc9bae5b372b960360570ff247616f09b7279792b6286ae2ebbb5407763e084

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DA5.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit