eb9756f6e578fcb811262414e452ece1709e4152cbc5525f8e42b44c5d1d2f43

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

471326e145ba6929b58228ac872ca7ba.html
Size

15KB
MD5

471326e145ba6929b58228ac872ca7ba
SHA1

d6f59749871c423581af8eb9d83dd7329d043ade
SHA256

eb9756f6e578fcb811262414e452ece1709e4152cbc5525f8e42b44c5d1d2f43
SHA512

1fed9166ce0f110df556ef3155fc9d2fdcea06d1ea2960446ba192e44c581020d8fb9670cd176904c314c64035e0f338e447ae97adab9b725410a133db518b87
SSDEEP

384:mbknir0rZ0iI4D8dpe1X6q1DXmAkm4CiyRxeu:mYXXkbCiyRx3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000aa6232a849284a53c4cde5454ead3cf736d68405fc7a653cbcd94a0e71a4de68000000000e800000000200002000000025575eb8596648a6dbc7b3bd17b252ae540e413d4b5accd2f2d38c1f770cc38420000000690b8fb49cef3e71edc89bc7ef00a31ead393058de9cb8ab507af106b881f737400000009b7a7fb76cf6114587f04ec013ea4a8c4807ad19fb7276b8fea3adfce8254bb273cccbc41fae8898e0d1ee6686a9d0d47fa2c2ef970b7a0ca2032add11ece9ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3043A7A1-ACCF-11EE-8383-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ef62109faa78f4ed78142376a06645f90b340b8ec44933cc7afe8a5d95922f65000000000e8000000002000020000000bdec05b26a1cd6c3d4ddb13d7e280fe49baddb918ab5a3896ea0d4a683776a76900000007a3496fdcc480c38b24028dc47b08d3ac0c36f0faab76782a10d092e4d848d9f9f93fb2e8251e0ea3f68bd56a45388a125218bb266e075b498c059dd511409a0c821eddbe34c3c5007b06e71537d69c87ca6861221335b62e2f0d66844bef165c3ef9a977ca99f13210fab795421c0750bc36500a5869632ed2c70e1eaf837823de4bf2cd4e7b21d322373b9993c277740000000fd12f238c7e2dfa3116c0934a8e56f180ce0c9d93c5d84533830170e72751d4d893f63841325b0b571ec7932de2532abc9593a063c00c4e448d2d8941b46e430	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410733524"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3096320edc40da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 764	2560	iexplore.exe	28
PID 2560 wrote to memory of 764	2560	iexplore.exe	28
PID 2560 wrote to memory of 764	2560	iexplore.exe	28
PID 2560 wrote to memory of 764	2560	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\471326e145ba6929b58228ac872ca7ba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f2ae93edeab7204758eb2b98a48f82

SHA1
a80e249067c0d1db5f68c8e5ded8facbe6365211

SHA256
4123b5bac3301dd1a5daa731f35f21165029f46ecc92f4c70822b30ddd91bf1c

SHA512
4814a503314fb01e80e2ace9a3875decf928dbe308dfb63d05192b6b8b33d3ff50394f3349092869b75845b0326aa4c1bb90eb1b509321b3fbb4efaabef35d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
651add620fa3cf3ba7571ad14097562e

SHA1
0abc511eaf7c1dc27963e9af1e2eda8be177a096

SHA256
f624570504850d890e8fcc7aca994bdfbed08366cff2a8237e8c4c341ed2d091

SHA512
d8d2ca6bef00efc407bb7277337a4dc2f63e4fce56bc1c760a4797e5124a55802b6578ee87c16c513688f7756286a21ad9d2c57229ba92c4cbad005e738082c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06f3c60c18634e9f4de0e5dcaa703ea

SHA1
111b94e9cc30ad93643addc9b36241ae2103342e

SHA256
38932b558ba9670e640e00231c26f6fd00d1c561178ad0d47955c9422315116d

SHA512
c503feb29dfd323e82a4b92d2ea64d84131e2344258d76f1176c7ffd7d006c4c0769bdad2b218def9575531b3699dc4500b14c2ca0804e107f2ea3352e0dfcef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab2f37bd1f276591013f134562a62e8

SHA1
a575ea6dc77e2daa659eaf7ba7bbcaeb80cb00d0

SHA256
8653394a8554fe239c5b50cb64820c2d9e18708a6cd163f4cfb9d25a39610f35

SHA512
55c8ff2eb442a96a687043bfe93ca6091c06d6598355d07812c8fc859a802786a1a1cff970b970cee4cbb421c01d6f12e10558dca342e13f5bf16f9dd4f08888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
738d9732bc30d1c42982a6c425f030b6

SHA1
061f4d0732caa6bb44bd4b4ecc35437f66ce22d8

SHA256
27e1e56d141d4f12b6806e52a0ab821a0c051ff39c37e066039032d12f49362d

SHA512
d07f440d08e6c2cb6f8ccc3013fcb6c871b8496abb4f32e18a6361b3c43a77b8aa6e8137b200bb1887b21f13aa40d6e273297f5d402d8ccd6ea737baeef12ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffbbc294c5d3039dc20adbada1c4b1ad

SHA1
d23e73c017a2eec168896aa6d8ed0d3eb1e82484

SHA256
fd19114f49529faf85ec845faae754c35d47e3511f489d01126f6b26f5381c85

SHA512
1ed86d8d5901af09fdfd0d3626e552fa802d070f798a5ddcc639f32dd11381a6d4ea64db907f104918e75f771f6a850cfe845c2968fd6240fb152df2f22cc6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4cf0c9ad4abd86de9cd7de0000ceb89

SHA1
18928a58e912338b7568be3b468f05c266918005

SHA256
b16f5c7661a928d1c22144e3246bae99814d6d394068e3376a0a854f97960d1b

SHA512
c683bc9caaa3c648c629839bb8452d74a0d5b65916000a0a8bc9878633c081b8fc80f5833128e6be3f3c6e382bdeffb3a525b27c5296742efc48f9ee156b188c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
304a920530f1b31184c2eb679fba4660

SHA1
9cbbc47ec0c9f710cfc70f23c72a58f648d848b7

SHA256
b37c23c787e8ac15acc6dcc478b0bd26698a7b5ef1e6e91d80971ce148e95f91

SHA512
6e54380ceab57135c912f65a53bc2b85a50ede09505d805f6d7e96ce0844024119ccf919472d3953d85cf1cabfaa87f50ad963641bcbe500ee7cdeb19643c417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc58377b1bbc6f83f3ffc88e30b17d5

SHA1
c5eb7d8baabe8bef4ea5b294254dcbce5293c920

SHA256
9f6de010baa36a16315da77504a07a9b6d4141814ee80830c8fe70fb3be816e4

SHA512
20f6e8d8cf05cfffbc64d6185f10b808e55a1ea15236d2949c272494b29d9996df5a0e20d88f2fa543047875cfa95532702dd0d081111aecd4a646bdee46fa31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36790a8ca3aa7f847bdcd4ccbdbeb32f

SHA1
fdf818be34dab4ef78643f6d53a16f2ca2de65e5

SHA256
463701be7d695a9ec8ae02895080144ddf8b92ef63032fbc9ec3ffef11263734

SHA512
eb25932c1ebe508ec0faf9525596db4b20af1304a51f1716335d54dbcbb5eea63d22f0fde4548ed685b85b88285d1a4f86641261bffe7f4d7d34e34f3165d76b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit