e5ea24f6b29e1044258798a7bddbfba9885ad28229936cd70e08b2035d7071d9

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48a81411b9e2968de0a1d8a6c118af90.html
Size

23KB
MD5

48a81411b9e2968de0a1d8a6c118af90
SHA1

75b9a196698390aa738ebff32c2ac1e055373a72
SHA256

e5ea24f6b29e1044258798a7bddbfba9885ad28229936cd70e08b2035d7071d9
SHA512

3eac8179209aa58bbee289a1a4d1748b06406642a3f4be786e4509732c0c3273c4839990d523ab39a1d00172ea18f5de0bc669d105042ba774dc8c9283a4982b
SSDEEP

192:csz748AYS/tRKtHu80AGXoT1HeXXdSUi1HPUHb76f:cP8AY8tRQHcAGXoT1I0lHP6S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f2a3a696867fac2023af93426655f4c143b8301c14feba815800d300e854af45000000000e8000000002000020000000042b38502eb714d9e1fee36cf5dad73fe1a34987f27e7208208b8ebd1c7d589890000000448756b89e169029708354ab4c40bc4ef43222ac628266abe05df1318c67ea05766550e07234a2b684ab7e51b03ba82b24c0250791a5b540337d9b31b71683f12e0a7f4a888ede33042be2b786c01be9e1bc4a8b7911d2ad2937844624f16b3b7d7471e73469f10e5d646d88193f284dc85578cd771276d536170ec0f7f3d8d1a2a968e20d2225bb030a86a08aac259c40000000e2ec4aeb5f405fb4ff5c1607ccb8551b1bfbdfd264bb1303f1c3cb4af4dce615b1411fd74c0caa6d1bf2df221eb8e42c2d6950d91b60678a74e8ab12e6ed692e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000de11e29e2e7f0e4ee003868763e69ea329dc57de8c5ec178da286e3f1c6ffbc2000000000e80000000020000200000007a549ca7838a4a24a50a9bbea2b98a63e604c97f1c8029af55434874bd9cfae920000000de6618ade964b361149f5dfe8adee0c21409476c87ae658bedaad8c45061f23040000000f58db2410455fb1b90915b6480a6d19f69e3612bb9f1463eb31a6ba4beb2d6fd6515f7eaa83e6a767f18b0aef2699da1c850cc896042d871a0e193710cbd4d24	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0587a2f4f41da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{589D7911-AD42-11EE-839C-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410782971"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2452	2116	iexplore.exe	28
PID 2116 wrote to memory of 2452	2116	iexplore.exe	28
PID 2116 wrote to memory of 2452	2116	iexplore.exe	28
PID 2116 wrote to memory of 2452	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48a81411b9e2968de0a1d8a6c118af90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc418f2e6509ff89a7cf7b80d4f298e

SHA1
e08b17532d2582933d16bef93b6a0aab023b406d

SHA256
bae3754c4c5ca4967c83900069647838b8c16e8e82f84560bcb5c81185011c99

SHA512
699a64d531b9aec82590b421bf22c9b108dd9d6feee78afb18e82b19d713ccfdd06f65eb005355279facd4bec1acb0e9a255539eb3dfa609b3b10b29f6a2e780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e610716154948968492d4194c516e497

SHA1
3ea8c49f9abab1653ce81f1b71a21562e2390ea0

SHA256
f02146aefd690465f3d1c8b52c664bdc829095d29b63acb38bd26423646f0da5

SHA512
c52234d497636d54a4ca377a15c23797258784a6496bed07d94e85fcdc172581d48c1314b8a2cdf08b5c0e34a9f3b4e270571d9edfe82a255d1a117aba70eb2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc1d8fbff97324562f2ddfa4e1041cea

SHA1
e68791d97b065067304b304dbddac3abe923896e

SHA256
45a441b2b2c69f05cde101990277e20c68e6c9f1174019de24fac3efe6ffe79c

SHA512
cf8b42b798d1560e0dc3f442036050a59b6c21b2cc605ce89e0c9da058285f8eebd884e3e4c80fff7887f05665e5b715a3e87cc92c2a7a6e408f3928ace164f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7fec8958428d8fde2b3eba3227b8a0

SHA1
fbb0b760c169ce1d403cad44f99b361f1cf8afc3

SHA256
643ef859323e7eff014b32d8c89b642fb0adbbef0df76cc75c3d0bda4639267b

SHA512
ffadffcc22500a594897040accb0d90026350d5fdcef336401edb6f7642d642067b34483b6d77c9366ec468c097d085f5583b00b837a6976f0baa14ec5af019c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66293eef22de3dd14e814424cd88f2bc

SHA1
7710cc44c3cd9c0ea96f17a1feaab4cebc7cae04

SHA256
9904648f1d5701c5688f4ff0dc04723b9045cd8faac6f41724dc3cefbcb42a71

SHA512
d69d6b3892a25176267a0070143aa40aaa4e4fdd0adab8e18fb844ef4cc5299f84df7d31bd684bf28ff87552dad0c0394cc802d589095954eb0db19e09b06d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7648de423110141af110f976431b623d

SHA1
3beb59649ffb828866cf441b35ce57262f5e7918

SHA256
ee2002d4b9626109aabdfe72c263eb5ce53c4d0c84a0652b14072787e724f690

SHA512
05d9cd6684abc83db869ca087c42837daf27b6630cecaf360063338106f98351b9833db321dfa57eaa0f528ccc57fbe61f5d4ac7df8e9ca4e616f2c6e32a011b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5983c5f8ecf3e5446dafb24bdbea97e

SHA1
20816e007fc87766e59ba5d9300d677ae12fef19

SHA256
2c427127a7ca08dcdc56c677e34764ae09c61682ca183dc6e0cc09d35fa5df96

SHA512
8c4349e076d0efddfabae751d1ce6e957e22381a486e0e316760b8e124f39bf7a9b8a5b52c9e8765b9707d7e7751f691fda51ee47a381e1dc5718435240c3892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5213ffedc4f68e56689d7f1a86de258

SHA1
7e926e77dbfecde6342a3595372635fd741c7c14

SHA256
90b73657688175d3a51dc88636e81a8241771fa2a8f53d1b0871c4fd78ed3d10

SHA512
77a40983e5cb0d22d50048322dcc8b8e0a7017ca912a2436dfc03ab1ea941fd9a472dd370a0697677cff0e9a640c8002e5aa4f6b08f9d322c9a5cb00c736809e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde490dbe8bb653220ef6f4cc7bcb4a0

SHA1
5894c9e0cc925b35b546d389ff7dba42b1fe5273

SHA256
5068b285c6e601d67cbeda6551a122d7271db01fd5b87427a275dd647909b5f3

SHA512
cb53032edba0835066a7e120ac6670b713d758459cddfb2496817a171085f6633dc15137013cee46a959ec7c3d4b7bc7d52a98ddb645c734a8a494c97313144f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbdd563f78e8c05888d8390e471d6df8

SHA1
cd0aa6e62a57c309f659c2377829084b6fc0a252

SHA256
186b6ddf997f2a2e4b361f786a34e43c060beee809b3b3a5e0241cb087940aee

SHA512
41f2c59e46a1997df6f62b4180d8e2637860efa9e838026def737512018b3a1f5637e3bfa2ebe8529bed1a83a132c4872e45dc5ec981f6e237c41d48de49a2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c9ac507c15f705fbe19b85856892cf

SHA1
6ef24355975dbaad7ff12c20bfa8fd942afaee69

SHA256
9f710548a7fa0b23bbcc7bd8fb8d4a0d054a0bf51317870e97aa4f2bab3f26f7

SHA512
d5f8ee190a7b2cbf0184e7ca3073c66ba6728d44c16c114f78829eed248f5718d5137c2aae210dd24a9702b010a0f2acde5b2bd214c3626358ee21848792605e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bb0d57a73ba835e428cee90555531e5

SHA1
af769aa28cba1c498c69db62e3f7b79a8a7e4207

SHA256
0e130e5f595db931d42d7f1fea8694828aa8ed6f0afce34ae603aa21c3007f58

SHA512
f2dde5c6f88778b40c92273bf88cd27b390ede0853fa9ed2ec0b4b74bb894307a869eee32fc76f71fecc56dbe93c7412ee9f2fb08f8e82ed7ed742a0dea2cb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65dc306d489cfe0d876f67071f6d1b1f

SHA1
6cbf4db66c43547610111fce8e213aabe0b57c26

SHA256
bfaac1c38b3b5fc4421d93c449bbedf42353d8d145f028ec0784b2a8b4f6694b

SHA512
56130ed103162309ecbc8dd939bc944a790827fe70f88cd0b87d3fcd32fa4e87ce1ccdd0e687591a5beac04ef633aa638398415d7f05768243df22441352b8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf737f035de52745b0e1ab78226e158

SHA1
72478da8ded63aa06b15ebfaef6a175e634461bc

SHA256
319ac5196c7be50a629b0fe9ff4ad14a2117e2b55f114a3481528b24ab4c42e0

SHA512
182f270196ff369a735ffb4392b6725c316376c147c7ef8a5028bc8086973bf395e6ff70c6990d366ce1d53710a604434973e454a14a36f8ef23e0e1c09e2181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d64d5f9861b72b510c86db9abe8634b

SHA1
5c50609a267d7d98c2fea9db4a9a140d7968ef3c

SHA256
69ed6198f466258b0ca814e5bc6c3a772d7e31864084f3671f1ed5926bc9e1bc

SHA512
de0beb21e218723f9a8683bdd8a1b8a6b96b9583e4ba17551075e3c1789345cf9e43c05eff8b2b56e1693aff6bd5bf66d83f02dfd82f4b98d5bf6a3448271069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab5f6a5005cd8af7292cc2fe73f33a8

SHA1
58626544c046c3c3cda75d9b9c84e1566be69369

SHA256
1d192d47cb6b0e9bb010adf267c3fc616b1473ead449eb8fe37415fe826593d3

SHA512
22f7ed27f8e3ed4def6cbc15f18d5a2a15bdd5a09389bac3f1ef4f97c4684b056b717cda821751beb2ef90c195a100edbc6928b6aebb49d06f94fd2cdc04a9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec924a89deb4e805706358d5625baac1

SHA1
03766e22c80936d05f2767c77bcf1df26ebcb879

SHA256
b17fc37955cccb96a26a274909ba6b13e1e7141be0bde5960cd151fe4e3ebd95

SHA512
6ba3ee50fff6a06315ed66166af94d087c87bf499a373b6abd1794d91baddd540f292dfd3902d612e9c9af1e833ecad5ddc08e30c630a473b83ee716ec57dadb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6980.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A3E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit