623d1ad7a54a1bea5998768201f0161f3fc6aa874c1040ca6ce847410b861194

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47cc58ec9b9fffff32f57ff75f7a9ba6.html
Size

44KB
MD5

47cc58ec9b9fffff32f57ff75f7a9ba6
SHA1

d1dea4083f5df14377e2dca96e92365e415ef72e
SHA256

623d1ad7a54a1bea5998768201f0161f3fc6aa874c1040ca6ce847410b861194
SHA512

42f1fbb40985c02074241c4f2101ab49610ffbc05644b6bd8b9b0fab161adb4f3a375e62dccf8cc4761ba82bfaf7b870f2395ada26d6cf6068a5db6e12885eb1
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2ozSelgARiyshCdk:mZJtdSelgAe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86AE6591-AD05-11EE-9AF4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300ae7811241da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410756847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003ec5894c80161bf0d5507edc9d65c6dd49f2a2c03e9659938ea086e6e7764ab7000000000e8000000002000020000000f5132dbb4f9acdbf53baaa7e1272726ba97f9487f74a53b8306acec5369379472000000053ccd0fc77490cc01da40c3daebe0c45769c1227f4b6b4ec1fbe561f5eeea41f4000000052c8996eac034732d7aaade09e6b42926c6cd87bfb8152c6dc74bd4c32787f4c92fec20848b9c535cb3ee176b20ece35790b3a133889d1d1765676a85abc5c94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002056d90fca7c6402139a84708d81e50bce9572350250b0dbaddbb137e383a3f8000000000e800000000200002000000059d6b3d6cf7c97c9ce2f53c170f3b0ae6e3210e3a28bb3cd5b38afaf3a323e7b9000000096a6c5200dc916810af43ce91b83635c4f25f961c1cc369953590142a066a9a9f6da1e5142e6e3f77f9a8c1505691c6562064cdf84da8637eee1576900f29b607b456927213e92166b450a8ad69d6509b77832ab25578ccfdbf3af88fb6350bd3c038ff9714c2544aa706d532e78a0f252c502382177dd5bce266e3183e45efd119cfea85f47a54710facce5ced72c904000000066025fc7100116f62e5cb4c8714aa9ae667cafa5a67a79b2b6bf5109b0109a2fa959dc88e527b2f44d7e850e43b5f7a1d1da781fb8bcb3c36dec3553dad7e748	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2424	2204	iexplore.exe	28
PID 2204 wrote to memory of 2424	2204	iexplore.exe	28
PID 2204 wrote to memory of 2424	2204	iexplore.exe	28
PID 2204 wrote to memory of 2424	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47cc58ec9b9fffff32f57ff75f7a9ba6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76de00d9409062629a0e8e43fcb24e76

SHA1
ec9cde2e61286b489eda482b9513693dab6dcf29

SHA256
5536ae3a8cbab7830511621fb42030472a4a832455bfc45721558bd6545e48cb

SHA512
7d4325bef28ce102cb3b09f25d306482604440f40e432e5c22431d33f768278d5e9c90f349b32a1295684a9b93beabc515746a9401a42efca97e7e1dcdebc6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028664baac837a71debed5369be75931

SHA1
589f9aa6ffec76d877f60af3441b23d5f7810c9c

SHA256
2da7f6166ec7d25346c29b3a1359c5791b82e9e1bd9d2e75ce1ee3c5626a7450

SHA512
0974bdd063c2e4ccf2d056c154c6d0a16f8b29cb2c8da08e6b69ca26051eaa3329ab2174a61946312bfb3703c3680cbb0c8e736726fc04c422d36cbf789ad2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe45c2b026fa8e6f76eba64cfd0d9b2

SHA1
6aeee4c5af795a5863c92c7af9555a0e7c0e7995

SHA256
a27bcda338fe97ba0b3db9fad5eeb620ca163939bf98f92b83b68fe83f9b0f1c

SHA512
001f63ae87538a188037592eb1de33e86c6b8d3246f65344aa1d76cb81173609cfac982c69bcf1cefa3b90d1dc7e2d922fcd47d3a6cf120f5df91c5c2432f403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d4fbac9684be7f7dc8715d925350515

SHA1
607ec2db2558a7ce68d94dc6e5009e1903ae3f73

SHA256
558ae634c61155da2252db2b6837bf0fd0d87049e43ccc1150119fe705edd525

SHA512
94f65a21f325925b8323b4cfbd3f5f01578427006bd0e73d4df23bc16b8ddd46b47f1001ebb6f987987e28bcb015bfd52958496a3dcc1c70687e0b8978607b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92aa1fdc436bf8e26231ed1ca01e16d0

SHA1
6526140c6cff420fcf286c8fcbcd6c145958862d

SHA256
45fc40e93c875beeb5bba0e627a1724f9cc54d3a7b523873b179e3cd64a78115

SHA512
d4a03259be9d79f16f8667ca8d6386f35a70af41e2e2cef4c7d15c2b0cc3ad4b0f25c4ad69b2c0fa08ec9fcc6a9f20ecd7c8dd390bbb97a9fe345e4f9cc8f607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c49a4fda5b8f73d7931e9a0db618bb3f

SHA1
afa4bc025c8b65b595fb57a1f01cba783fad4a97

SHA256
79ea0bcd1ad977dfde70795714b40e156e9887de9325c5d5acaf158601744527

SHA512
ed2a35946a085b265649c61c780688197d108b45e2b1784904297c24da29edcf02fe5e01e2b4f6621bf48f442544e00afb844d37d097eb776ef026cb4f475207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4cf6894d574e34dc7f6656db74a63f

SHA1
e47e6ce485c99e950610d613e41de9595260b3c5

SHA256
57d1b3dfa0009ddb8419e055807735418350abe8b07e5da9e2dbc5cda772cb92

SHA512
b6ac1c523278d312f318114e4e4582aa0bb1948f6fad8d5621112b541ff2ed00c601940f15ea0e36f8cfa31006c14dbdaf354e8bfd7e1a887d599ee2ef5722e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4256415bedc5b57d0afb33fb6211b1

SHA1
e8c5fce196e7944a2f022038372253955882c6ed

SHA256
4491d2ba1d5e46651846d83de5f8d63907d1e90a3b822262967f7c8c2d223929

SHA512
42d3598739a11dd67db9c6a27154a0b050dc50592f6afbe43f39045786ff7afc468893036e7cfa7618d8dab26ebd05eb442264a425dac6a3ba36f93d722cefa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eaaf3290c0c5d5cd985ef812845d30f

SHA1
407c2e590e685c47f7ecadf6992f47bcd700d01e

SHA256
f4d39a7720d814a78b12819f6cd7a0f71d253b3949f825df20d831eb5adb4d68

SHA512
47739ab7c5eb6552991b33c4ddde3701e8cd1738b62496b9d6914beeab2a8b1c77e869e7f0b19130123b511cdd9a14e4e1795cbbb063396441d1c56d64465329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f68547f2cdb8cf19991427d8ee0355

SHA1
58ac9b2ffb9253cfe6403d121b827d23451d87f3

SHA256
c0688948b0c95ef49482d62b3f2bfe1ed68a30f32660a4119d4fb1ceb5ce8279

SHA512
4a5d257fba53afdfbe6049aa40f33bef98eedaf4a10a76c35d5821a47dca77c386df1772991377a5ff77191905e38910025a9f128f21a9dd961627337e3efc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7439b4393daca0b1955d88d7ed65442e

SHA1
9deaaf807fe6139d3cce8130b9f86119f03a2468

SHA256
e5178d59e45dbe8e9b19455d69795b67b004438f699dfcfa5349893bb992021f

SHA512
c280a63e1a21585d4fbc3d7cf2b49780387cf9b7a047b923faf11e6bd9f1e762365c5ca8df47fa5b75e157f04d260d3decbe17698cc41ef9660c147027a071a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
358f10f25e4afe59e3dbd76a78786b1f

SHA1
e0725342ffdfa50cfa14bd12e414bcc5e170d7fd

SHA256
43f2ad18d5ba8aad3aa04984383881194a1e7a4240d14cc545a34f32dfd425b1

SHA512
3bf1e0bf41cf7c95b7ec2722aff56fbabb598558485b8b636732ad426fc4bd0b8cff7f0a573607f6276a256add3fa58b420fef75014f9e59e546c52610e15706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9fa4ac94a00d7c0366e4ce9d094b9bb

SHA1
4018f205232db635b3fbe2d8fb607cc379ade522

SHA256
85cdba173dac81963814bd3ae1fdad51e7335af621ead8f3a6c6a681c5c73401

SHA512
3723cc10b8d815eb73a1ed47f38811adff267aff99812b80fc201eca509749566337d73ab25e0e57a7185e463dcfddae282674877d7a076fd083fd8898f78df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b0b3753f6760dec274bfc7569e18934

SHA1
f78dacde2f691da2afbcb84ae81b6cca37698b70

SHA256
e1a852b09ee35bf025b48669922546be04bfd121cfd49140713641ad6318fba8

SHA512
8a7e478ce352ff700b26499daaff7698e652bf1bd2cfd2c38e8c64502dab81650058838d769d8263d68819c9a9785134416017c75b9e41bdc913ace0622cdecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2e3afc2b09525ed946f1d266cd54d79

SHA1
ea82762e9b5d2bb35c03f0fd1bc876ebe3b57598

SHA256
0a26670202487959cf03aab0e7797cc84988797e6017573b3b6e4ea46cfdb2e7

SHA512
4eb4c29323df1d20abbcc5b804f898c5eb874f520098d29304ac4e834b4dfc4e316f55bfb5a8cacc3bca82c64d9da0bf23e8cd41304e5c68a7ee6c37864a6e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0a195cdbe6abd4a9145b92f7ce9e4bd

SHA1
13951c76ef7095457e7d7706e4599d0215a26644

SHA256
21c885458ec02d2288a98c412e72c7e18ce0785031b5e65aa915fc1503949ad0

SHA512
bccc03d7aa830180b7edfb13e954292f4386276e48436a0cacc6fe15707b8241d88527e97ae66e2e10de4a19dbf31d1ccbf5ababa2bf727cceb169d0cc01b03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4070c0f0bb38caeb037c3032fda1c073

SHA1
5222d6d9885607a93329f6478371b3048d6c33a2

SHA256
01d14e7d9a5b02598cd3098dd4c91ecb64456d74eacde95d3fddd24fc11f4696

SHA512
b9f75ec2c60220c3177983afc97403b92d3e8eb1a56b03936e54122df73e5280fa56c9ff13147776275816e64d0b0202b922986ab38dd7d33f2f0cf68a437ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88FE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A98.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit