921ce817d099bec595a023db4e85245f89d3d52b0cbd0beca165f58b722c725f

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4718056d5ee79906ec4b767629873935.html
Size

53KB
MD5

4718056d5ee79906ec4b767629873935
SHA1

df2401ada7a0472e06df9daa64f610a60e59da7d
SHA256

921ce817d099bec595a023db4e85245f89d3d52b0cbd0beca165f58b722c725f
SHA512

1a20c6f03322393e0c05f071688e0366d3df95a041532bd77f94e97629477b76c5fec336c5ae82e8319235df2854601012d09d743cde72c65388c26631366588
SSDEEP

768:a3pSgOriWNcaSoagG7yk5X0YYDFUfzMY+djXdwBDpsLDw2U9kDHY2ShU:a3p9/tyk5+UfSiBDKU9kDH7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410734213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1DDB0F1-ACD0-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005573d6995f774f3987d97136b78cd3ffbcf79165e001b1727665a0ce411a78f6000000000e800000000200002000000067ab71dd760bc6bc76f4d5878a8baf5f8122a1ee3d9b66ab89681a7f13a8794920000000ccc74dd12bbcb4b144072f7904bff726b835d2c6ba54dd708b37beac6f2782b340000000828ea4185180659c850cbc64e0bfb80b83ef8d9be4db7f29e0f7a494d9d57f8f3056f7f124c8a042eb63370781fbbaa1d558a215f4a4b38e2c7f3268d4bc972a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009afbb0dd40da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009936ba34925541102aade89507e5a26acb93073d6930bf5e542eeb6d318dbfa8000000000e8000000002000020000000833130af4a4ed2d9da8d75d9b9994a32df7590d6e4a739bcdc6dfe7e9e6940a890000000183f1641247a90ec70b0ad81f9ef16d59fe46fb13c5163d6c10652bbff13ca24c96dd8dc8f50c7e5bb36afb6cd53bd808a72bc1266901b1976c7357651fc27253ee21cee3bfcb9d1c162f081363c9db8b42e24d003c56b5b6e9b2eda246977662e7ce89ad4a953a995e5d29a7e09ef0469000183fd485a6463bb33014376fbe539b4d380eff74c8c915a1a8fe8f4801240000000a1da8d9bb8acab23edfbb2d8217cea29172ebbe9effdf372d2b19756d61f137bc4117c684915c7f6579a5fd5ec3bad4c31ca2690545c55188036cddb9b13d030	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2416	1984	iexplore.exe	28
PID 1984 wrote to memory of 2416	1984	iexplore.exe	28
PID 1984 wrote to memory of 2416	1984	iexplore.exe	28
PID 1984 wrote to memory of 2416	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4718056d5ee79906ec4b767629873935.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b3148dce33b81fbf287f69f8855e71f

SHA1
274bc426cd791e6c1fab566c0f899000e8e46b0c

SHA256
58f860d6753d5a0ae1008bb95a814b414973bfa2dd02e139ffa90ffe2569c06d

SHA512
ffe9181b54b08b085e02806516cdecb20dff553ee90b54a94a281af211d780868f40650104965ef680fe2bafa0fb3e19cc7d484e44c0896e87b9418babdd2e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
958bb29684b2e43db3557178578e0c6d

SHA1
d937fa4ff26e6a63157c25298a10374cadfe290e

SHA256
95dbed57f508997c8f713f7a8807688db843defcc91b72fd64732896afa634cb

SHA512
f6c5784bfb6cb46ace723b92b41cec556c152afe2de86da454ab8544e7171915048fcfca5a6e1b3e3ebf0168374e478b06d136e70183c30d778e89186d577f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5620cd1fc4f5c86940363af2ed3d6eaf

SHA1
078a9a327a3d5b4d6b992d31f6206d10c9cc9af0

SHA256
6bd14d6272364b88bd13b46c47b3b45857117b3790d4ae783c2001d566f01cb6

SHA512
8fc0466addb7094974fb51a1acd83a8f2ab04a8720dd60692277082cd6a3c172f11482afb3d144e6b7f96cc0c71264cc13dde24d57fcd442828ff1d39c6b2756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f116129c38b58405454377d9c0e8ab0b

SHA1
cd1e6800a66331fabcbb748987efd0e130013d62

SHA256
96338ea51ecd05c001e2ebe71ee0430784c630f66e8f3fa6b422edc2ea4bc2c0

SHA512
8a188d2d8c54dad9f892aa8f0cfa80c677ce988c3c5d4b4bbf4ccd8a07ac0a494c5e43fd6d5034cf872f8f2583e98bf7621ea3e7b77976a0ed8d9c12259d055d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
661156ad614022046776ebcf3b6ccfc9

SHA1
cf2fef102ab6fd87ce2bd8ed8dd15c733e8ba4ba

SHA256
0e55b5d5c882e3be8872b332d09e124e3472a5777d848836e25b21ca7064650a

SHA512
09668eb6e49d640fd5ef7345de5cbd598d82cfe5dde0fec9546e887fc13e189c1c6eba7b740cc5b419d74a6b1cba49f39b69b2ba197fbf364b840354deab9943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae14b4c13ef1a659dc73417e181930a5

SHA1
625b18cecaf229a25b98de6e946dfe70b97cb5a6

SHA256
9055dad0f5d0382f697446ecf058bed4c27ef2179ef52cca0f0da26b2d4bbaa9

SHA512
eb3ed4587061e89c69f2ee85eed693336e81fe372f99092720dfd4a229677adc4f04c46a5f7110c78a82d3893e93cfecc7cd27959cad06274f1042d19158b8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb1fef60361845e86e9ec560f981f4d

SHA1
581d2b6be025e1ecd226148a3bee892bcd963cf4

SHA256
a2a71360692b015953ff0c88ff2327b39fc150a6ebaae36fb80a5940d0482b83

SHA512
9b7097a41bc60ac5b113567d934fa40a714e0e0819dfeebdd4867dabddf711f05e12f1b16ef53c620b0ff3cf0745afe0cf6d5fed7806d0cb7680e56b27b0e270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91eb636020a176c86fca173472727bf

SHA1
c24c8cb3dafb51acbe9ca978309e5e706962378f

SHA256
c91b8f0d37349bbe1382116a9709c55b77f395ebb90d917268057910df02bf84

SHA512
17f16ea750d510c004ed2f156174f5f29fded0bc4aece48e2e79c57c0e84487071de9a3f14e5cc011277dbfc397ffb083d8966d7ae4dbf25fd6036c2f71d5acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
867d8efced35a7b45d78d643c04c70ef

SHA1
41de7baf3d90c3aeeacbe5bdbc2b1b368453731f

SHA256
e04a9832891a0475fa2338bf3e1596189fb0eccbcc4514c407f39fa12225f5cf

SHA512
1591248e2b88e2c92cd03ecd779d50d436346e543da9faf1d69b8fff22dd46fb9d645428406c71d5b32c76e85ee5243030d5bdd2e716dc159110435b85f7e993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c429bd29d78b66db778b0734ca5d55e5

SHA1
1ee2cf07582ed9dac5db47ee8092f41e883951cc

SHA256
8700d82beba96e11db68d882a133af7f3af26374f5680b5724eacd6bcacd2218

SHA512
4cc92a3e1f4e1f409d4173f8ca7f3106b639988bab2a127c7524c447f63927f38a299262319c58bad5b75dc74184473bb049bc2993f7e48c59a2823df06df14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a33beddb4ebc7a63168bffeabb7299d

SHA1
f252f493ef8226c678c80eaf64e92e916e568e34

SHA256
d2ec1f731705c93c83a2a13c06e628a2f519eb5f116b8fe1e3b280a551575c5d

SHA512
d94c06f3407a61048718f102cb093de2457338200b3aed88a4eca424ecd3075299b71efdf351976bc3baea1df25ab0b5e440af5016569c68f4fba1ce00d993b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a94f69d76c49d262a89cc3daa1d3325

SHA1
3edd84c89acbd6ee3876df63fee55ec00c91bb98

SHA256
f707350a51e5599a06d6c10d840e8832fed10ec6512140345ae297c225c64089

SHA512
5ffb08d1d13e26161d7a448e275c71bf28549573d207a45d8b94b87046d12012b4f1affb6544bfbf2e9e00cfed9f7413eb818ef849b22c02b4002efd020a7894

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE60.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit