e5379683dbf2c587ab7f8a80ecf17f320ab1dbcea8ddbca94110ed777633c61e

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47e36f077d34c02dc70c893c7219dcf2.html
Size

36KB
MD5

47e36f077d34c02dc70c893c7219dcf2
SHA1

79ddfbe9b89d6df6e82c9e66c2ef64d5d21bff66
SHA256

e5379683dbf2c587ab7f8a80ecf17f320ab1dbcea8ddbca94110ed777633c61e
SHA512

d4e2034160d0c610370bb704ddbe925e1594af97c67fce999482d193d6227f63f7908df273f86cae01596618fee58dfef1595722dc3fca91f7de80e514c48512
SSDEEP

384:vQ/mvM+Iuy89ZNnauV6SB7gqgEs17tPwvB6OF:4Y5F5s17t4p64

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410759540"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA282491-AD0B-11EE-BB35-72D103486AAB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2520	2940	iexplore.exe	28
PID 2940 wrote to memory of 2520	2940	iexplore.exe	28
PID 2940 wrote to memory of 2520	2940	iexplore.exe	28
PID 2940 wrote to memory of 2520	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47e36f077d34c02dc70c893c7219dcf2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
807495592c719cf4a1cc2bb28de54ed2

SHA1
a9b79e0ebea3a97cb5aaa6ea23e0d459a94a8f64

SHA256
eded72a7dd3ffcf7fcf3c78daad4b1c8ecc34ef93823554ec127b9646d9f23e9

SHA512
cd6522dcf5c4adbc9f9407515355e49569b1d970a429ec96e140f9efe90e8645bcff8e8cb01dd28f17bd58d0a3f9b9c61e71d79d899d7189dda5683cf448cefd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9c224d807776d3e78c2c177853294b8

SHA1
e244c08516502d76659b738de87a4f880ef71b96

SHA256
6c504bcfbd61fed4a9276b211ca1f26e2c6ca08702df408e81e074b6498c8cce

SHA512
9b2acae77561c59330341264c1b2f0d47082eab29c5d5ee894245c36b16e063ec1cbad7b27668b312d50e252fe21008df75e5bcf906ebb471b600c0b7a8a0ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce8b39fe52181f04ed5efa0cf0f4eadc

SHA1
05fc5e4261340cbc291d5605d587818011e78238

SHA256
4d5218ff359612d7f7b371d2bee65e51050af8022c01a6278dbea96ad79e8e41

SHA512
4cee4859c34630bd368c078ba2b4fe496e0ff048ef0b350a0688f8455d6ee33e1ff1184c506a838b5d1a1e7677e958ec7eed2452889f76aaceff7a734c826885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f90fd413719e098ecfe08ee6a42ab7e

SHA1
63cdb6c16b15984a6dd4e820f8a7d34f9ca91fd1

SHA256
7023232c76253a7bb67545f58e36c651ae3d6c17728ba8d7104eb093f3c059aa

SHA512
3cb7c335e04dbbe0768caff666cdac38bd3b991a8b708b2761beaaea9c3ae5dce654e48242d15774ce0dc274059ad668e632c9a00374d49f695a8922099d6577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2167555bf87615573966ed72dd430372

SHA1
2d32214bc6a4718ae5cea21bc5b9aa2f9d374d10

SHA256
67427fe04cd0a14ec1db319d8bed2aa0a9b30615c31161de5f4be65662efb838

SHA512
1de21050ccf443c7b8978413ab7eac8e793b121090f86ed8571794e1e08a3e8597f15769e423a707da952ce3e459bb588a5407707758e04cbda3b00aaedee3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7873bc9ca4e8f57e6911c4d68bc367f

SHA1
c2bdcd23c5e57b2ee271f8f8a0862fda5703026d

SHA256
5d5fe80fb36815ec08ba5e0c96718ee1403a6bc45bde019e9fad96993befae25

SHA512
fad2669344d1a04d1e61e79cbb4af0a1fbacb1e61052987cc011acae23d371df1d5be1deccd12a38abff8b88f438cc5fe21faaa4930c6d612878adaa8689540b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9931330cd51a839593f3edf7d387e0d2

SHA1
bcd52c0458dc98e343984bb50c58d6a81e0f2296

SHA256
0d36a676423cf4f1e30208f63511ecb701acb1cf9833218fc9f373acd82e5991

SHA512
5b931d05642516153a5a9257df447df506013fbc3cd125b07b212e78644d928dea85c9e2e5611cbef2a0fe76393a0fcf65a002695d8ff6239afcc0f8088cf5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc99a390017888197b52721a8421c5d

SHA1
d0c403420d542ca4d8c5f098da8bc6324e5d4b6d

SHA256
c1f94a3715d1dfd4fabec0ad1b3d393d7daf86764479bae6b187b6ddec53f2f2

SHA512
bf8c0c6c007a3ec263051b594ac9e01f7f8935b69b368847ebb19c9eb541479368b18775cbf45cb73f8ecae85d7c40f71f75353519b53a9b0e8b1edc79cf89ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c4c68ce0f0338794af6bfcdfe0e48982

SHA1
d6422b57647266bcdd8133391176eb56f43982be

SHA256
a67135ddd7c52c11ef22b3c112104caca1ff08074cd325822de344e1bfaed4ac

SHA512
897bfc492fcfd8a5912e08e5d7aaf1cc741345c7f0f9809751e22cd3f732aaf74f539b36c06449d924de6b47ed6480be834cba391b7bb3abe2aaa883db83792e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar121F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit