44580f73219cf6fac1733115b75ffcff77550fd91fa6ba9d3b1dab959ab987de

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4822e18dbb168ecf803555b901905802.html
Size

144KB
MD5

4822e18dbb168ecf803555b901905802
SHA1

e934d81666c21dc1f6ff4c435900d53bda3a7182
SHA256

44580f73219cf6fac1733115b75ffcff77550fd91fa6ba9d3b1dab959ab987de
SHA512

a6b18b12497571a75fb38fbe678f305ab347ffe0de87833694fe409390fad5b618c3e0c9e88ede05fcb5ce408cb36b55a26588136926dd5ac4bb65dea81d8299
SSDEEP

3072:q+YORS23XssZF3G4k5QhLpOatVScCIK6KabEcHIxvzV+R0nzMV22wOoS/0Ib+b+T:lz4O3G4k5QhL8atVWoHD22wOoS/0Ib+w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96075AD1-AD1C-11EE-BDEB-D6E40795ECBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307494712941da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000aa7154a43ac276b1262ef521ac7c03e26fe47cf8d3abd612a107c2fafa437ac2000000000e80000000020000200000004ae59f241f57bf906036a2c0eb3c9102cb46b4aec93ccc422ae92aa3915ddc9190000000b9d8ab2f4e92ac805758daf898e54c27d6b17c5022c79fa9b0a590a8fc7dce89682dbf6a7cea74dfd7d02f6ebf982f119cd7fd5ef3f8d1df496d45247c3fae631ae4d97d6620de16d36d35f41399bf15c5d6982cccaa67e945337201f28cea4751fda4d120167ce31771d25be6d5d73de2e0b70d5350411ada3f95a65c1b7bd18591ae553319dc8664b0bc57e9f527fe40000000720c7ca3291122d090021593292e702c74cdbb75def708bd88dfad0aaa48417e71a3a015bd50296f1fba1fce11c515dd8c9027188b43e83666d16f2fd7325986	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410766752"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000000d00e7fa92f34ae90a5cbc115ac79a548ff9ccac6def27cee9f77fe1f754ad3d000000000e8000000002000020000000a9e7e6757aecaf525b762b4942bdd1bce18e8d9a154cfa05597a0957d3b982ad20000000d9b9ebc9e44516103ab7e9423e407613b08ccd4c965d3c550b0ee4e3dcab62cd4000000095dd17cc3b343e10020edae95d6631fd9d57d0d66266f47d3404b5fa3bca326a83d48b11e70f919f4d50ba9131ac3fbf63305cb49efce743738fd4fe2e848a4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1136	2180	iexplore.exe	16
PID 2180 wrote to memory of 1136	2180	iexplore.exe	16
PID 2180 wrote to memory of 1136	2180	iexplore.exe	16
PID 2180 wrote to memory of 1136	2180	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4822e18dbb168ecf803555b901905802.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
59c85309bc6b80319b397f8878f63def

SHA1
2c90733526b78c00d18ca57ff93d6d590ca973cd

SHA256
313f9ab986bb43921affe714a2b09d418facecd94c6a4a5cc4b5c88f12aae49c

SHA512
8df4cc6dac996539df154c64ca8ab9f62969944994036963fa4ea2b875cefe72c28f081ad3d418a2e11f324dcb9cd42699fc514013bf268c679c9bde24f83954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6c96790d706da89493d9cd19de3745a

SHA1
b3a5a374bd1417f07b93c2248dd67ee4b68b3c11

SHA256
354cb710ce16648906f1b0a3bbe739e289dd6d2cca162df953658549914d386c

SHA512
8298fe366844b892c51903b2d2b8d7efb7ab17d79855f126630edbf7091f9612c624147fed5265a05f30d5d0a40b7081cffa2d8f7cfeb99306e7aceb5c42ef86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6568dca5074be4cad0bad3d7285cafc6

SHA1
31f7196d666e9c9cf16bd2858d3fa1eb2fd048c7

SHA256
251dfa390915bae9f5937f77739f809cb9d32342c688c449124090fb89fbbd37

SHA512
680d651bc09d043dd27ce0b68822f914e4a8d86bb53fb2a4d4cd936abdb3702d39022aaefb46ad2b64462846d0750e898db6275e0aa1cb8d93f5ab2e14172166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20b70ee588d0fe8cea61eb8bbad2b1c3

SHA1
13b3b11ffa676f9b5f0da9920fbb1040925c758b

SHA256
135dc114088c2ac2ad8ab18878633031acbfc387047cdd24a9984557b2868613

SHA512
bf2780eeb70b7cee1250be233769d3ec84359806d3900169d3e4ad53343b9743b781afa06411089495a61f0c11a405341fb8dff681ffdf2d82a397b41ed0b7f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ad99d36af0a1df2a8eaa0d2b327b7a

SHA1
03e95c28ec2b8281002258f59d34124b8a516669

SHA256
48f04f0c803d02193251288ae0de8d6560176db34b0224a04cf981e6e6c028b5

SHA512
2b44a172349e293e91ea26f12ee1efba2f5abc34d75ba0c2aea6744d319bc37dcd5cf15461df268caa04ce5d0c9f43137558e1a9a79d890368dc0ea5f4b2784b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
629b2a51454e09b8f0d506e38faca3dd

SHA1
8f21d4b7b4443646b1d6787bbda558123038fbcb

SHA256
a3ab0917f2622a6bf158de950e141ecfeac6cffdc9f48b324b678de870e9e60e

SHA512
c14a2240317fb88489303ecdfb121cb005754e2b7de383769463ce886e376237f8a0c780b4c71b6556ccc0d9bf9d727fd24ce0fa296cdac9195083c3c7d769ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21ed54a1a57ded3749a4c1d365d5e861

SHA1
f35eeebbba11b2d7ec88560dbad53ad809e4f3b1

SHA256
49595426545c409b91c573587c36168ef7ee8b93f5f61e30f70827bca2f64892

SHA512
291b7c9dd89be26c531f6c3fed2150077373964aa35ad2745753b84962e632a12865881b6a51934d49755aeadef6af35cc53a31b7b2cde40d41e6202d26365a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b08844695148b465b2a488d604e0f8

SHA1
0dad4d948ceb6ac9b33049a2bcf2b7af359c6a22

SHA256
f6cd57009dab04e1fe950242d02bc91f4e0cc10b837e7ef89b67aad9d5b4a782

SHA512
f18b48d28a6b96cb50227425a3c8d27af341ef2838e96d99573f5674578bbcf2609206ff955e0eba0124145a6394e4b1cd13967bc3e94ef2276d8df4b0e5fb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df42221d27a203931aba2098032d18d

SHA1
99a9d6de98308537e912f3d1fdbbac5e767c0327

SHA256
1b70be571d8244631df124abdf006427fc9e4587475dcfe22236a8e4fed30a1f

SHA512
af1019bed31739a1a615b5e8d83e869b4014ed2c8afab238f83a789df752d25d9f8bfd5f7d2145875b81b5ee0897b57a807dfeebbc784309758cb3d495bc1f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832a2262aa6732343f3d867c3c07b9b6

SHA1
cdedc69a6633d639fe6b67a3fca2d2c9977a3048

SHA256
69e846f45baed76d7b7cc41f2a7392b44958874f46cf24b0c4d2317fb3836b5b

SHA512
f9912d063304300b7e3e05f756c0549f1b7d31e5a82c0b984cbc5cf88848370350181c1e23563466813a2fb5e5c4e8411dfd4092db69843f8e633f6012d882cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5332bffbe06ccdc7c9eb8be77318c9a

SHA1
502f0c4a40b4e9e68a8970f660f3d2ceafe1d3af

SHA256
885e41eba35ec7e9b3725d77628e5a8f9f076711d1e0a610854813f455cfdd76

SHA512
2f7d32a986a2714bcdaba0c7a921b92a4e5d9bd05e5df1c4a0e95793855174e627ad847475b8e479f68a832cdc05c758b380ce170254887aa778fb66ceccc58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2784295f1a62e0fdf7d70ecc95a0e5ae

SHA1
1d48eda41d48f4dc73504d977452bff2f56c9692

SHA256
df3672c3d2f5799ffcd2e332acb5ffab5ae6fca7b667dc520d204a3eeeb66601

SHA512
7f8ef97c0e8e170cc4da52ccc4603422f95c1861131c6c1238a32dc5aca68a68b7dbdea1601f471079ad863122cd34bc58d92c40ee1fb9ec1d0cf226ebb0f30d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1403deb7ef8707ff1d2417774cb2bbf8

SHA1
f0ad9e4c1b3db7baba0fb2803aa80d008a506280

SHA256
9dd8cdf3a12c7931d395d04739ee3749ff63294f7c4cb58c11a887f9fe968614

SHA512
c0515bcc4cb26423f0d15423ca1491a3a6735a27343e9c9f565997e34f3064bb8a1a85bac714a0ae5996aefb7afdf94a11f77b4d9e6e7c765fa29a3e12990230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8455b5f430761709d50777e1a11b9037

SHA1
70a85ea1b439c6e1f32c90cb8a16b8e02bf1bb3b

SHA256
b219bb796913241e26b66e08f81439096a37ab64fdeda1910127aea02d084966

SHA512
1d2b2e3971adc6e0cf6f95d6b1acdbe3d3f6f7a942af76d0496881fca1e95a7a605528331071730b4e871528bf7110d0f18ca08c5a934464d133a5e2ce36fbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit