12b82b573eab56812b28006ee010cd048022401345e77564f5f92fb2894b819d

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46636801550c4279c0ccfec0f9ba9e61.html
Size

3KB
MD5

46636801550c4279c0ccfec0f9ba9e61
SHA1

f82fac85a6c26ef3e8300a896e37492093b83175
SHA256

12b82b573eab56812b28006ee010cd048022401345e77564f5f92fb2894b819d
SHA512

e1ede6810a7dc59661daac8e9ea50b27dc3485bef5bafcaae9dba31f42f90bde7c2a67d51c0679e1b039d802525f0f6ff20a503012cf13665eeec441b8995b99

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410710824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508fa944a740da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6025D811-AC9A-11EE-8232-4E2C21FEB07B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000001026904debf5703dc37ebbd937d4acfe9fd8c757d52672159f5023a3f3633b90000000000e8000000002000020000000aff356a72eeb965c9a99bdea8c7d061203ff42cbc67255e340fe5a88f8e78c1520000000e7c4045d020e982a5f21aacffff45d0a0688bbb5a82740920e7ff20faac5ade1400000009b691184164b9c0427fc616b17ea083415db6defed6afcf779c474fc85986a72135ee866248a8bc482872948de8348ee14c70c299b76cb9c4d48885734bd97e6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002f72865bb962b9b62d750057e9bba81517deefe2b8e4bfcae821e78d1de57dc6000000000e80000000020000200000006c5255089235633ba21e1ac4554ea89fda1eacc8946b87b37e4d5753d3ccb61990000000ea9a40e3147d778eea13888c9f37a0dd32142483956488fe4f4724f610bcf1cb8fc9794f3e3a48b11eabc70efcb84a9c0d3a1a487ec11787d6e817e31315267c5a4f91dff45c11b46cc7d26033fe8d2d51c7efd3599030f2cd5be3893e217aa528a4e25858c56cbb5fe6c44d01f9ab63c6885111938970444d3b17cacfcdd366f2e1f381d4f35b128a848684c994acf840000000dca31733552bab9444bf2d0e53b9153f5a5be2dd4583160782c909af6ec50bbfa8ac0bb518550767491651a0d6f280caa88f18c6e2555353f4bbccc5e41babba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2284	2112	iexplore.exe	16
PID 2112 wrote to memory of 2284	2112	iexplore.exe	16
PID 2112 wrote to memory of 2284	2112	iexplore.exe	16
PID 2112 wrote to memory of 2284	2112	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46636801550c4279c0ccfec0f9ba9e61.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
21c89ace7de1f022a19892e2bae5d362

SHA1
70903a32069bc28573197379ce1a90b7872b0662

SHA256
6b3cc617f6891d2f6bf0720a1fca6115ee5aceee972cb93dbb867b96d8a1567c

SHA512
e2c27d4908697bdbe6c77d2e3c1f67f0fe197ece587f8031b3d0ff068c750e6ba5477515d2b779a2a09b3da6d00df2ec773e89a9159387ff3f462db681162071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e67f7ec7fd73f568f11be7e4dec48e1

SHA1
c8417414343f4bbaf8e3f19c80f6d59418b9a49c

SHA256
dcbf65d5fc805cfcd0ff69ebbaf875c5a0d6845238279b9ac5396064b999dac4

SHA512
3c7386b1adeb2e6dd8b664e27c01814232413f3b5d998b5ee7fac687c65fc7dcaf9e12cf679f1845a2a792fde3fc8e518a7e9d1d03e6c051eee0f838a5ff341d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8d5976cbf8419e1987544f48e4eae75

SHA1
dde523c42bcfba5adf5bbbe2596cc16e093554fc

SHA256
2fd7e6123e70cec4d3a2b6aee7856c9f1976556a6da9f6bce2130d34635702c2

SHA512
cafa95a35f8d6432564234a4c7c4bdaf0643fb9c7fe5bdc0b3e9788b65b0f5af4e7d6a663f2e5c3b9bae43bc033658d37ffb6bd460a9a72c340ff9bea7247409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e4d8aa762554cd8480b7aea48dd740

SHA1
1ca2685ff164c510ebfe56ea341c855a8f2c82e7

SHA256
f74cf26bcc9ed8bef9d33419b0d6ffc2a38cbe35912dba419314394d5b13bfde

SHA512
1d9a6939c79ad61563c6bad8fc909ec2010cdcd42ce54ec663f9254ce8d29c3db8133f30c62e555b43658f6834af51f474f38508fb266ae48810d77ca033c087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70b882d5e166a30d35a967eb4d4f6e82

SHA1
c193c0393542888107bd9b1cf400bddc38ca4964

SHA256
92b6f330f6df1f0920ff6aa0f3d4c9908370afa8d5e940c87d504471ea2ca9a5

SHA512
3b79d4a121144a52380645d7b9e4d27b76711be9f700c449fabd91622c286c928474f6069f52fa675ade511eb523b3384193d1c4819d5f68512490fb6b924f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a072fb61f6a4e064f6b27b3fc48a28

SHA1
5173c282c44c8328c5cb4763d6f9eb365420ebb2

SHA256
0b78b3aedaad31dc0df12f7872cad331c5e1a1caec48944db6aa427b8230c65c

SHA512
dce631899eb2d624a027ad33df5d0354ee0d9e46ff41c59586e086fa12b666192572aa646badca9c8d65ac68c1c7061aeb068f6adca73d23562da4ac0c640606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8500066366dab2ba32442f7991af84f4

SHA1
dd37dca893b759f0886636848151db013ac9a593

SHA256
071bc8ef3cac6f91f76b8f0442bcb75e8a40da9d1be6d579075ab4e00357491f

SHA512
234937590228136dbd0774e82ec6da76661deb19ab797e471b26921934d38701d3ada84254457ac107e416f505ab726959198263e9a33361b376738c2a8db5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0baaad3b44b519c6f365ed0254f76151

SHA1
1351306a44d9b96856d583abbda6516c2e4c135b

SHA256
e0a93f282203468c4399f71d2c4dc2ba62c1f376104c2ef3f0135e3b22cf2ee8

SHA512
8bd3b1ae902b9f174e117d5e3f6046a2d7b1c4d7311e03df8fa7cf23148659d2ada05b751bc7bfe38af90ab95766f5b2fb22e8701f770475e8f4d27b3009f674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9af7a08dba3ebc2b2fec7c82fa48a15

SHA1
2e8cbed35f04b1d7a505a77630f3f2a32060073b

SHA256
1ed7ee086d50e01173ae635d58bbde4f445317c6819fe39bdda352e222f1ea8c

SHA512
840a0ffd156f2bd282ebe84e263180b0a2758320711b0ed5c264c233d1d20a6576786879c190a031d144f5b69268ba6f9f889302910832199fb1a6e7ab39b421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2ee0b4f9a8963f920d8bc6723c1173

SHA1
345b3c847b9f092c2bd68850bb166eb13832d7e8

SHA256
ee60f305326e8e88040d84094b2b5bfb128efeeadb7d309fde9d880e14f0d4a4

SHA512
bc681c80fb44c9e2478ea1211100c2724a81a142841510c2b7b0023f23ba41547b88c9af31c28c56fdc849c67a0c1b0b9c89714d5982092e5d5fdce3b715acf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad9044f8787a1b5a16fcd31505c2880

SHA1
dad9f6685693a58c5745e14b3129e0c91b099720

SHA256
1d83f2e7dc23ef91134982f8f60423906825dbb69ea1b7e7280d0c9e37445407

SHA512
8aa6f2d86c23fa6755dba183744bfcaf4c754732e12998d0c5df253d55d0bf2fb8d2501287e2e436205836691268d808bfeaba4f1a0ef35f0c6d2c69c1b93260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d779def094d5e011468022681298c3b2

SHA1
8bcbef721be905bf36114c03cbb4729ddffa1b34

SHA256
70054a812ad7758b0c22f5b121349f5de9f95a290c62b06ac85784bdf51a9393

SHA512
cbd247186a9958bf5f60032b81497e67f75c75440c16d1a9fe815af6374041a37cb1a3bd4eaa628d7eb8f236ee803d8832c46eeeb6529bde1739bd4c15741af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7bc3392be975142dc79e21b8401cef74

SHA1
6b4f02acd33381b49d0bd94d13719564797fc91b

SHA256
790d763bb6c3c65f38ff17d5009db26f32ea577369022d13596d5f65445a0870

SHA512
ba2c0a000991079c8d18fdc70ef502543697b050c41d130c8aaa3a5e1941984fdba4f114e8f66da7f2373d7dda00c3393368b65ad1bdfa5033acee22c231baea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FF0.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit