c483aed2487ebd8eddd5696dd7ead0be53e887777049328c8d950443d01ecc96

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

480950c463fa215fe9c6bb485b3a3d75.html
Size

2KB
MD5

480950c463fa215fe9c6bb485b3a3d75
SHA1

b7467ae013249d0bbf8fe3cbef0415ca153d102c
SHA256

c483aed2487ebd8eddd5696dd7ead0be53e887777049328c8d950443d01ecc96
SHA512

ea68a2365eda0d1b3309d43d5c5550f2a65487f463779139c809c7c4895f1cf53b0ecc266b2621183b03a0fffe4d51dffb73251c1ddf81454d94046924abfef7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f7a0912241da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410763811"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a595fd653d0e1025112c07b416525d61be35da006a36483ee5e28903d6ce2d45000000000e8000000002000020000000f618e4e3ee8abcdc1ad06319192a5b5542a605ba16bdee7814067398b605e08b90000000142a6bfad563294bbc1f4df7a9cfb00b2f3001092e6d3d46c9bb33b966369c903dcb52e32406d9aa15c4518eaf2c25dc58bddc56c76b43681c06dd7b74e9508ca1549c7c7f54b0e5eef780cd91dfb1aca501004c10b649be11ef2507e93cd5c94b1df8ca2c780e185381902149f4efb228ed2c1db7489563263a98006c65975c4d9f15d6a2224b40139b695a875e16a940000000797d63a152cb62cfa9a05a2464690363f0b02707ecef9b371b7d54009cad09a8b9a8a35fb2880e7f540394bb7b2cdee80a4f19441240d30bd03b654f0e533ec2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD16CA91-AD15-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b6e27469516d57d0eecc7367628964a2f812e40db32fc339273c3959d44b3a85000000000e8000000002000020000000aa3306012158769220b8042f2889681311d5474b5d51b10ad688fd79c202534b200000002df9b737f988985760cf0f48816fd0a624a2326f3d985875ec4165a26bc820b640000000dba53c83995f2bb27a5188b19fdc8fb328ac070156a246d01708bc8e59406b8083fbb97f883739f37b0b2c85801725ebfeb78271a7648c4590af0b9c5452e03b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2488	1664	iexplore.exe	28
PID 1664 wrote to memory of 2488	1664	iexplore.exe	28
PID 1664 wrote to memory of 2488	1664	iexplore.exe	28
PID 1664 wrote to memory of 2488	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\480950c463fa215fe9c6bb485b3a3d75.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808966a93e259de448be14311ac41c7d

SHA1
79bd9b82ebd242b86b1e3291044c75d029053f7f

SHA256
6357c8338205169da4c287382b20fa54428277dc859f0a8780f772074a2feb60

SHA512
58f8c7435956456b9edbdc4a74edf02743b751816d6be099b2547f07e2f392435aaf9342842b416ff8d194f1b8c6c1c45bb33f6248ed185f9fb4807fd2e3adcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5810550904fd494bf6a23c9224d8bc31

SHA1
e99ab343e69d3c238b6e9cc6ccd5ba6878fb53c7

SHA256
0eabda4d4d863938ce71f35a2cf652be1e3816fd3657731041fee401030f5053

SHA512
52cb42adbde1a8b6d83659f6c414ca5bbe2a355b10ea89f27b74ffd743442d94d6cbf7aa8f928793d70b77dadb5d5416749930924d835bda461360ae63d241eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ccc1f7cef1a96ef6fce9f15fbafbee

SHA1
2ebb0e5699233056118a69abbf53fb60edee90dc

SHA256
70bf754732934f1a00ea1dd34e129a6c2d4d00c448e3ac44c4b07ffaa53e04ff

SHA512
20b51d6da869c1532b56878418f2c7d0ed504fa022759e9e1b389ff52a410ad0d36ad0e03c0da4d45c2ae371e2a3027b7acff29704800c591a5d7be7a0a44736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7daa17852e5fa4729193e35d98c9d0

SHA1
a148bab4b949e88e054fbb248a8a8cfe45d1db1f

SHA256
9fcd74f74c753932ba47c18018bbb46891e8017f7387d14171c8e1aa8f5140cc

SHA512
289c74ed5b5c0a211b7d597d8e99fc6359aa4bfb3d474ded06b8a1994655f63bc3a93b69d349f15d365724ea62e357422c0e379e214badfbd0accc7be9d97c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb35f1d581459f5a9fc483a4570a1efc

SHA1
730624f02542208510cd462c190af100a300af82

SHA256
150be3d7187652232afc5d8e3efd97eda462addaf90011531c4fa2c6757ef812

SHA512
3549fa697e48de20c300fa895ca1bf54f9e289e08392a2d4dff4520382d086f7df6bc323b9e0a692167e48c4203f86685e2950bb9946e4f95e21aa1cd5e752c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9028d19faab3c1cee47a32f50bbce51c

SHA1
7b4d92ed125be68f7ed79c90443bfe2b8862d7ec

SHA256
f0ccc793be61c9e2a50d76f1ba3756ba5eab34b8b6e152a53646b3f5678f560a

SHA512
241f43a4cd3682598869f76efc20dfcac0e5955102f897bf96e271268ee18ad490cf8a8bbd2793be0f3a67114e6fd8b9d83db059b93fdd7804f3cfd0fbd5f7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8267de700941eb56a0bfd5f5f133b826

SHA1
a1ab6c47776a98103e66e7543b4f19334d555ee5

SHA256
85aea24dcce09836a8f8b1033b7abbc18fb008f8e6e29b2918bb11342e5a3321

SHA512
3895b6b28b28e4cfa5cc64c44a7be7bec37f5b01dae0ad48b9a4e48a9eb875b221d4efda4e8e02c9fbed3c8b29f517d9ed1ee73ee7c098801a85c615e9e0ee73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd1bc0b82cc4a941278db8c81f3d0023

SHA1
6cf480fcf13bad79fe547514cb4651676b956c34

SHA256
d059d5d4d25987a505d32034c86471847c44a8286c7c1df4412869fd60b702ea

SHA512
85076faae0f6d810569ce184e89df953ffe83de41125a947c2edc4ed3c41b28b47d6778ee57d1d08ec06a190d4dd70bd0ad20b9c9d82a8947e415c1d3dc11e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4107ca006154b468b1a29279f5f84cf

SHA1
37cdd349e779c3d57ce5ee59aef58202f16c9bc8

SHA256
feda3fcc721ac4068cc77db12aa5ed8cc6aecaf45c35c7ca2e1bd8b78d48fb3d

SHA512
ba3173951930d96ac87b1c75e51534338918e1a7e543568656c6694e6404cc2665f9bfe3a7c8abbf3d8b402925f49a9f03c7867e2269c3b3f3f948e2a7458947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08c813dd0740672d9651357d0d1b8f7

SHA1
d1c3b5952e1d24297ff82690cf19ef64b9d2f905

SHA256
3d8b5511b065114f35e14c3a9fe6db449c4a2d181f2f868b55c2dd364fab994f

SHA512
af64561e5669564102a9573d5c646b989a0c601bab50f6073585c2652523e73fea99284818c7b2cc37461bb11e294f3f3dfe7d273e416fe0b079e360c0b9c702

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2687.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar269A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit