bb9fc5892bdd38df55f6dba9e392ff542e58e7c4cc059a400c6ec80c645665a3

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4639d11ae6d33dc916c871b6cdb0d920.html
Size

10KB
MD5

4639d11ae6d33dc916c871b6cdb0d920
SHA1

2e1dca9fe616b8be8eeec40e50297918a5b504e2
SHA256

bb9fc5892bdd38df55f6dba9e392ff542e58e7c4cc059a400c6ec80c645665a3
SHA512

abc42074040d631a2d348fb3e1c0286e988fffeeadbeee0897d45094e5a7c6f8aac445dc8a32c02df559a3c2b88614f578f6c2b1892c6e8d39952441495cd573
SSDEEP

192:XG1l9xVw1CDq2PZq0josGLyyWa9qVEuf8Yn2B2z8zVeLwC3ej1dkrEHhirCDpL7K:QlPVZ8YozLyfaYVEufFecrAhirCDpL7K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705856"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBE20991-AC8E-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00011a39b40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ab59f45ce43296a0bc75da9c7289be4bdf6822780badd69013dc503134c66b54000000000e800000000200002000000056e15f0931d3e5169f6071b4a3da472b516ba2b47e9a37345c4d9494e7ca9ee3200000000e858c97a4b858d7af0ef937db34829805c580498411141482f44e19ce80028f40000000987918ac78abc9d3a2bcb9af981313bb3039f00839be88403f93796ee4f8fded109e87fcc21e1cd3bfdc3eee555027c6ec83b55ebc8bc1e3c5b5b91154a78076	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000814d1ac0d6a74beb9be65c291bf6bf2e6565687ca8b6983733fdfd4fcdadf809000000000e80000000020000200000006235351437e5fb40eb630e0c92ead8b06fcb59d0e32207198fa32105f08d74b99000000065a345bec5021a28e03edf155b2332fa71b6b8cf37ae96d66ed34e8fbbad24821ed650fc92c9417ef314e5d712775c869acfba76fa7a619daef197eb3421d974ffc7eb117513bda74533571675c1209cbd5620ae8797740bb3421f84181ded83fbef4cc69a2f1b6bc295f3ca638fe8ce5b12b50d475811d22b80aba4e95e9d3a76da5b64774f141c03b03ca0ce6b9d6d40000000664a4be33ecedf8023cf3859e55ea7c269c022eee751cd9a624a95be0b45acfe9ebb05832d5de5b0873882a99d6dd938952eb907cf425c103ee40f778a3a3852	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2812	2780	iexplore.exe	28
PID 2780 wrote to memory of 2812	2780	iexplore.exe	28
PID 2780 wrote to memory of 2812	2780	iexplore.exe	28
PID 2780 wrote to memory of 2812	2780	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4639d11ae6d33dc916c871b6cdb0d920.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d68fb351c4d6df0b02abacc7f4c8e3

SHA1
7ec2b56b8870b95524678eeb41e68808f6ce1ae4

SHA256
f6549b399f8fbc865f5c87e49549eb2420cb0d6add0f68df3570f2152dbe48c3

SHA512
8278860a9b0b2daf24c2a601ebd4d6de5a8e288389fa8679bf332ad8f1473d41144b0bba223bd57657b7329fb2f08ec434cbb69cbb8b722c3447df27f1572ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3bbef83a7629deeb17ed82708f5d601

SHA1
9064ceffcdcc672c9b6b81d187ff8366554cbb90

SHA256
1a66279f4b53137dcb2eb78a39ce00962b7fea25474c8926ddc591e20b9f497c

SHA512
bbd0359db1be9da3cd20c0fa683d4da6ba839e734753a4c8dd1ad9d1808c8e2477775ca1425da52e6acedef72761e3ddcf5aef8ff734416f8ce6c62b424162fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e349145f9cfe95f033f30603d0874b2

SHA1
359ad9ce9cc2b66d5e5d76d81de39ff073ee7a14

SHA256
2c3ee882bae214e83e352cbc4dc3a8c39ef225b09cc0e82c989ddf2bfd5db660

SHA512
40ebc4ef15241a7796b08f954941e47f185628e019ffb3a2f5834a271417a12b26c5229f21c4337e8ea0da7275f664a9389dae2ba28efbfddd38a228d6f1bebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cfbfc096c910c596f2ef4b4daaec148

SHA1
d2714c41a86249b4013a78ff9a1cf359513688ea

SHA256
f593b8a7a91e16752142621d6328898dc8276256dd3a028d86f2c1bc3fdfcad7

SHA512
f2128d822c224ec4f6e119c787fbeb44c0a83f460c1b0043a2c351061bd9ae0c052f90c724683b6fa61dc2344c4238f4903034c845df9c3e184d43e4d10c30c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1adb972846f9070e79a9f3ee966cc85

SHA1
d80e7a176998001eed721a47f46402c7659a5537

SHA256
bceb82674d59db47c0a6b00dfc84dc2726eff0055aa8e0d0922625598065551a

SHA512
a5d9a90a5a8d1899525277890f10fc2150ccd0c7a4bd75b2c453446e52606f98e096724829d39b4e9b9e391d772e8e127f37a1e6e7a07c29fca152684c0f1a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d958ae742007a391d21d2d7dcb4992

SHA1
163cc7d65c4ea74a26438b4d8b50d79c56583f4e

SHA256
74770429bd3bcc3f5ecbc644d3be9277e8182f82dc4b073b41089502a681f2f3

SHA512
d763333287fcc4b0b49c6a0d2f2940b64fe70a4cf1ef2107ad8028ea91baf4a0f755589d56766cd5418bff500aa66f257a9318179eb07d17e90f9139629e9fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974a351e2844e23de68dc061231d2f40

SHA1
4b916bb40a63515073f373453f8ec891455fe6b0

SHA256
7ff811af3b518fc64bf8b6fed4e268b331d50b26ce2619b021e7bae43f6f6c21

SHA512
843ec3d5b6ebc11bd176af26cd2002fb460c7ec22dbdd66573d59a57b890410e56a5c61db66887ee3e85a9d636a89984175451beda4a682bd7148a23d4bd6d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f563d0c0d9a5fdb799b9ab821ca7b7c5

SHA1
00271f9d1f09d3c27475b3d6b0579306da05f4a5

SHA256
c72c41a04e7ccd170ed2aa2d48838b56e82a91686cfb8e7e176714fef2c638ee

SHA512
8927fe1001d1f49263f96bc2b1cb93b0b6bb4a4f77edf13fa33157cb191797b2db865e4e2f02f498ad92781a55b930ede38be0adab0694b62ee366faba6223dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e132da7b8ded0cc3213823d368f0b18e

SHA1
13421e66020b6961cd8b9ca85d82365a375102fe

SHA256
61cebb978c1fcf1103a8334cec6292404725a8df0ab9d6f5d52dea51d847ec50

SHA512
acb9672f89d873c05b3dce04ce8e3f8ce3decb73fe59a140d13a830e317eb8d0ad88a37258c4d322a27544600297f2ee5c6544889ebda8132d888762ee312375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c72e2af67902bb317434197ff1bc60e

SHA1
172418eee9ab5b245fd8f44151320966c713fae2

SHA256
9da93f1f0e6bb38c2be4b84ac14555de5f467b86885db138b78d286373cc02b5

SHA512
34d181a19fd35453e52cf942d162bbb57b99b6c6aba9aa9159383ad52be6901b6b000d9df742b4978ef28214762c28c9f25675a92d7eeecc7e489478cb4d0709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dfd6412bcf6d83fd3f668e5f88dcd89

SHA1
ae84346309ca784f193187ab42ac6b1b804e3769

SHA256
6927460314c33b320d512053b188858ee1693683dcff761f55c9c724e14bc83b

SHA512
c8a8172fd31b7312b7a6ef338da4c8461ce0c5913e7788ba63777611f3e0f24eeb3449c0cf360484c14b87e149ac92e2d8e9e0341a1cc51c919eb0d557a08fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7448.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7525.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit