6f2d7101d1aa0e0430b7118cef419221f9eb84bcfe76c454e509d16eebf75cf0

Analysis

max time kernel
12s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

469161f8c761373e408f08db5b323c35.html
Size

430B
MD5

469161f8c761373e408f08db5b323c35
SHA1

9bb8d61a2f6f5a0e348f875120a3613ad5e349eb
SHA256

6f2d7101d1aa0e0430b7118cef419221f9eb84bcfe76c454e509d16eebf75cf0
SHA512

4c58f5f165ada449ed8fae619cb66db1d5ae8271a3fa5ab3f3f1f31fa5db6bf12904ad29700be2295883606e6bc0cf92d97ef3f07442300b0b3421ce9687674f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ea65a2b440da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB3D65B1-ACA7-11EE-882F-5E44E0CFDD1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000bd343adebf6e68922fac4ab286523c81491b0eefd67749b1260b80d856ef04fe000000000e80000000020000200000005ba6ee6c5eaae6e2ad6a8ba40ebb13a31c08ea0b3bedf54ae13f1319d40d19e4200000005be1a7c0eb59e03fd42b1203f3f91cb52e3236df8961b6bac0543a6016d97c4040000000b9f8ce6ac924f66d1050cceb5135ed39b90e8a3e2f5a15fb61865e8e68a26bcb4e41f2b471a10a7aa33a10dcca9f4df1b88f248f06dd8f6cef6b0ac831b66cbc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000004216f361833216d6e2a9527495d65f445dbcb3cbe295d0b2b5a982170d3f47c9000000000e80000000020000200000009073428d5f1ade83c9a13d0e8e2c281519888ab6c111a455773e6b10cad0ce39900000004dbb4efd72e9780115428157ff518c84e2f3313df131b7ef65e15d461680ef710dfc0ba885fbc337be32cda2178c6c4a9804a0b3d477e6c936c0fff8c62787473555c20458c4a1fae3ef5caff01ffa24bc641a353921600433f1aac3ded42446333ee4896c4688fa365254c0a5156b36e7b53809e342712474c27de25f2f9321ee68d1b5251a4ec8f34e1ee629103226400000004885bd57934be42a2c494b34d6630e397fe2e2c83d80ba3e15db4a25356fcf7a7f9d6872208e2c15fe7013ec8a10d59b2b87c4dbb0f21bca84cb436db010daf6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28
PID 2784 wrote to memory of 2848	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\469161f8c761373e408f08db5b323c35.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efaf80f0105b0bb088a2369e377eb4bf

SHA1
2362a71a1c37005eb21367e3c51cfe31b4dd8ff8

SHA256
b89adcab9239b3d075fdcd8c3195e74f02bb4377744d822d27d91590ca15cc41

SHA512
fa05d14456d3c5f9b5f5a935d49c5bc7400d7b173b7d09f97ac6957bccdb1d81123221135fb2b6a39225fa00cf1013ece4ed9d65ade9525389e80f6dd0630ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d861a737c222b8157fbb491fdc35b8e8

SHA1
0592a7641f0f419ee2330b4df918412c3d269873

SHA256
660e02e43c9136896f9844c7288cd5636badcfb9cdb9989e52dd96a0958fafc6

SHA512
44979bac32c0ac7b4a1e4a953f90c0fbbded6f7f7b0858f6acb05adcef161632f4f4c86ae107e6b14c28d3b1432c7e7bde1ce72a8c2b7d8c5fde5b447272e656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513cebc678388b9c52b394cd4c56e51a

SHA1
710dc2e576dcff9f338ed6fb9b3a2e313e5db02a

SHA256
deb33079cf9220a4b4bb1d730d69060bb629e9223c51634e685f212c99f8c16d

SHA512
ea9ff87ba232d7e699d4414e069853c2bb89e5b65632c0e26fa9b6675299d97a710ab61a788920d7a86f83f3c0b1f213d7b472fd1558af33489077683fda2493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8a11ab9a1e98050eae990864659560

SHA1
51795832b2f0d13ea46e823c36773fe9ac47f191

SHA256
a42eda7d6fcf4e86175a1a2d1e4694e8abed121b9b2a1cf635323f42905a3aae

SHA512
9e425ccd1dd2dd08d1621104299bc253b31133fda877851c4d243c64ff91650c36096533b8f9de458bbf49a2d767c9ab04b251dce893b09db3d3f97913c55a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3fc3ecd376f941463009bb20b38cab6

SHA1
07eee74c52491fce54c526d448a7d19c7a032771

SHA256
b0afd8634e8aada44183933bb7b97e5268858b9254303e1b37cba3020e739242

SHA512
dc6963e3f399266bc74167c737dc26891073c375c4b7ae757e2c74b58609ab76c06e900fb6f6918dacec537a1be90e7902d767f4cf5e4e28e1e4f8f7206f288e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d445ef5b571beb60471c63ef86f084d

SHA1
e47af3d2eee2697fba8d266f3776d554b0089c56

SHA256
f7db6016d4b9b31a56709feac6a322adc132993aad9e564eb8d4b6ab4de387c1

SHA512
06a63f64b4771e0610fbd8c76ef420a7d8d5f57b6ec119fdf79a293e5d442bef2508368663236ce2667fab131885aecf82010542edc21aafddc29ef41ee456f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b4a95278bcb9bb1eb85f03e298789194

SHA1
a47e1d0106f77f837dbef9b47f89b805e762a072

SHA256
e183c9413f3f6e1b84d92555b5ff698aa60a54ad60a2b9269cfbd2f93cfcda50

SHA512
900c8a045f0dafb0b624dfa36d70ce5a85cad995151f68fdb20514a407c5a4fe86af8a20aedb07e0083bc1cbea7d883d4f19b07a5e8404603b75ea5afdb2c1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e131aa7b7e47ce287cca25a2098a69ab

SHA1
eda461c9cb067e5b27eb81c2e5f2ae4640166c44

SHA256
48b30287366e28c6b967a837e648b65e84dea52d82c922865e9283143342fb72

SHA512
0ec6b98fa35d31702f82fc06b1afc05666c2905209adfbd37f4c0a8721462ef8d7c8dc28c774d48c114b25ff4ff4ae454186c4e93a96587c767fc30281701217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

Filesize
1KB

MD5
c57f22673ecdf363dbee02c24a427695

SHA1
e9b683458185150417f62c125ab6d3b85714d52a

SHA256
2abf2ac9e86f2668f5ab248b211150c7b844a6ee9faa341a81ea5fc24bd02a9e

SHA512
abc4b6f01e3df69ac644f6f8a2d081e8aff7927dc3de13402f19fc532fea153805a49fd683b51da1cadf1bccc0c30f6c8e09b53c1685d532ef43f9b2d4226e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KXNF89NO\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit