795c761f8206637a9a25614f7e6470996c22ac15aebbafc1a224ec484060a7ce

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4804ae4f5e11361b91d253050b4f9ccb.html
Size

23KB
MD5

4804ae4f5e11361b91d253050b4f9ccb
SHA1

cd346265ccb85f46ceb29cc7aa11969a6c4061ac
SHA256

795c761f8206637a9a25614f7e6470996c22ac15aebbafc1a224ec484060a7ce
SHA512

e14b1f72177ec2687ccc08e290473ff90ad4ed9f152a73abef9dae7cddffd341c9c815ae4f69fec804b83067186fe6311868ca59fc1bd6c14b683b113216592b
SSDEEP

384:cmknA4ywwG6p11pJztvukeKXXTuMwbzrbfRKL24UTpNyOcn8tvG5nTDuU5esT8a:S1uGetWkekTMntKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f2c63f2141da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410763242"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006be3118b7e2416a71571ad3f4d273cd1dc7bac3d9153afb05d653435b72cf678000000000e8000000002000020000000c194af48f7f4ddb1b85fbe6f54a07fbf15f7ed191d8cc0ce14f7731b852219cd20000000544f742a208865e760b3ed22178a58ac46f4c36673127b413ae712622dbc6e2540000000552674f51867084bee7f9c94af4f9ca8480113b154ffc8e22aefc634ee5eea32329b9b95221e9629a75d11358fe33a70f2f6211d4b9361719fdacee812e48627	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001b68b145ff1cab1216a1e9c8bc9e7c47afffe38c0e6fe56a9dcd6499c8362d41000000000e80000000020000200000004cd5f8139a403368dfffc41a56200ea50ca170d7903365a404b87c5d0042f796900000000604c898cfc913a09d89fbac0af69233a9e90dfba7ffadd64a5a36b6ee780e8428c2990cefa281bab24e701ec219cf246bbb3cf9ca7a1ed2af8360607bac33638debab7c6ca4160dd4cc773f0eb74137fd2e75263a4404c3eefaf1e7a93645eb31558b09e7c39e6534d64a4cc56fa27f5b26aad4455d2a7ace26d7159a945eb0414a6fd97524da30b3a6a07d3cce654040000000abd5993e7ec829c63c4c01503b5028ee779af2a8c5defaea7d41e2d38d0aeedc010695ca9f731db2b4a3f6e36c47da6752a5c53e631250c1bd9e1796968edf50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B1C73D1-AD14-11EE-86E5-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2768	1980	iexplore.exe	28
PID 1980 wrote to memory of 2768	1980	iexplore.exe	28
PID 1980 wrote to memory of 2768	1980	iexplore.exe	28
PID 1980 wrote to memory of 2768	1980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4804ae4f5e11361b91d253050b4f9ccb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604e535c687fe67b18b7a99635e03d06

SHA1
89b9c3712772af557003aada07315301e82d5f10

SHA256
eb2debc0f37bb6254739b62448937a300a3fd573a6ce0fa7fdccbcae108b925a

SHA512
7addbcdc288147de2417871aea386889727b9546150c910bb5cf87aa50fc4aa10f868b01aa3f4fd5c094bcac17d2171e2e2dec8e855de05546135d4a6ff93c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb5fab33454008244d9ee6b906984361

SHA1
de17d05720e1b4d6c50293c2aa4ee60565c70ad5

SHA256
77dfea3533d835d0f83fd0076480d7389cf2afa8765415291e3ea40536308736

SHA512
63e9f5955246f53d514c447b740e0c6dae8f4803831908b849393dc69de4acf127c9dee89bfc759da69d0a64c5bca19eafe00b871f0cb07e72096a1c3491efaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
171930b84c4b61d599ba579f1d86fc37

SHA1
be0d2ab0edc092d2cdce1f31b3f194058cf398cd

SHA256
f7903c9207be4f12ce06a3a18190468f6e5234619e980263eb7015b1ccdef1fc

SHA512
d2689f77037e8bc115fb6177484e0d86e90fac5180ce5b55c92ecfd658fc8a4b70682e408be23fed9bce017e1fa7c96af2d488e86524f202480b7da95c883aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30743d094654c4ce21ce55499dbdf88a

SHA1
e4da05f3941f67e92ce654e0115e268fc2635ce1

SHA256
e7bcd0020e5f58fbdc43eda30db18edb6f0021d22fb67b68012e7f4328176b1f

SHA512
6e7a0198e0b9b3c5984f23c0bfc51c3ef00138ccb45781ff7b3671a0bf2ae01c395a4e47b7006bd26626106bf6d8535865af9ea5b77a2d58a32eeaed1ee46445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd56e8f1fda285b3f9107806223ca8a

SHA1
110b09ba9d0b8eb909eb648c0e72c1361c11f4e9

SHA256
1aa4b7baf0d853f8d3e7e721b05383d15ede9f424b412007324d0271212ca121

SHA512
b7aae5b185e319c4526326d61950a905049ffcd681f8f517c6617d4579b625df25a949cc4ddaacb610b14a84edf5aaf1d2a14386aaec6e87ce7891636936ffda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33cfa0b94bd00dea01bc71298dffe5c4

SHA1
0a9c9e1a8d573cc9fd36537ce2d7e68cd7c79038

SHA256
bb1b29f6ef292427b6eaf6301fedfc3d0f6d869e159418f329d64c2bef8e5929

SHA512
e03bff43a653ad1d8b844dcd0a87c83f535927d902957468cdba97be91d7a43b67373d74889f4a6dde0734b46a79e1b1194e9e75d4e97ef7e531efbec3215e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf8f7b43a20d054a5609d6cd1ee9f56

SHA1
af762974c4455ef1e78089e8ec6c5994cd4d3696

SHA256
b4fd0916d618ef70c88a604d46bc65c432e7074c3496d9e420915312b225155d

SHA512
d49917334b0a1ee05df55c0ca982fef43a244fa4363438d7fa69c8aeb0e59c2b3ec85ade0ff02149a4aea0aba4ec564283ccc42cf2048937c7c8e467c679b288

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EF0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F7F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit