356abc6c65915b05f57b3fdb80a7fa5a4518b2ba91a99e95bb604ce171f71d11

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48c191786fd37c9aef186c0f1ce7f153.html
Size

75KB
MD5

48c191786fd37c9aef186c0f1ce7f153
SHA1

d5ad4b1ae0f92890af59ace7a38b94e4e1470c67
SHA256

356abc6c65915b05f57b3fdb80a7fa5a4518b2ba91a99e95bb604ce171f71d11
SHA512

81b0e35fd890ee8127cdd88139f650dd3d09b2048a1ca142c3d1e90657ecd3eec461431536567288a21d2b55ed089c7cc56e204482f0467aca028301d25e7f81
SSDEEP

768:pNCd+u4jsnS4mQwUl+2duD1NkI2UtBzoTDDIHnnFWQ:pNRQSjrK+znh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410786021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d25f63c70cb04482574f9215b1434dcd93b2100811bfc5c8d1f36076c75642ad000000000e8000000002000020000000d74a19726a637fb29c3fbd2b1ee451a4fffe2bda7f6acca71682c5becca5bc42200000009542a76aa56374f8a2c28ffa34517446628f06f783b6444132cc9fecc8c5b53f40000000871d69795ec5da39e253cdd2984c2e7fdc54f97d454f921ecd222072df661438145d6aa5844ff306458d2191914245b4511b3c2f00396e255ca706dff30f7586	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e2fe4767c94625c114ea2917f6313e305c7490c8cdb0a991542d77bb8d78588b000000000e800000000200002000000042f69224dbfed65a9bf79c9c9dc01079e8bd2859ef4b3f97dd53fc33f92ab475900000008c2ca4d01822873cb673dfe8e01db4c60306ce797d1ac97bc986fd7bae2be15b0749e8d8ccb00b59cddee178f503573b475b1d884fef9dfeb1a3ed08598368704272cbc2c362ffa06adb704b894c0d9933d82e7b46484c36e9278b64785c716eef8acefa3c0160cbaa6bf1f3676843098041ffa3885ef062b0d87f02a51317c49430a3f679d2f456b07fa1a67c67abf240000000e709284c584c2a7ae11e8ae3d99b50e2089071f60cebd4daa405db7d6e656473b70630980f119ae23371b10c4ce9225b29cc597cc6934d88e513d25e67627299	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{702E1471-AD49-11EE-9B34-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c2d7665641da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2240	2132	iexplore.exe	18
PID 2132 wrote to memory of 2240	2132	iexplore.exe	18
PID 2132 wrote to memory of 2240	2132	iexplore.exe	18
PID 2132 wrote to memory of 2240	2132	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48c191786fd37c9aef186c0f1ce7f153.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f54216a15ba0fb7d2772cc04da2859a7

SHA1
11ebc1e3f7b668b91e6d47540fe27c1cae4cb9c0

SHA256
2096946ab1818fc374176c0b2502b31773a876f17e36462993b8ae5acc836343

SHA512
f18a192d483d01460079b29d82c41de615b667e3fe0fc7373ba6ff0e62707de1886bfcb7cc6177365d9cf56b90bcb952f2c8989319b9b0182d018b1515494005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018717adba193e1a06c657df3c1bf783

SHA1
87231f690ea651eb5a5e7728ad774c78422db3aa

SHA256
6e040c27cb1c2f561536949a2f530108b69f7448479ea720981614351d4b7ef7

SHA512
5ce81e38defcf42b1bbd4d9b7c5797727a6c2f91949a4a5ab9bce4e38a3fd11afe76967c0f3a65b1f91d0e25728e1b6fc7214dbd89e9ba53698e9bbd114f566f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760ff5adc20454d7c53c91f1a65a3b61

SHA1
342dafb84aff601b4011ad4c9075eea84a84804c

SHA256
022114a9c4d55379f5c5c7e81fcd06bae2c111371654a8c72a396b538cc28e51

SHA512
89103b7cbbc5b33698fc27ebb88dda636c9830456d038127725c040297b52331b4713dc9b730b8696b86f6031482218f4ea619984816cc548f368a391bbaf0d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c624ca288886b623071487dc0230d33

SHA1
604ed165743f65a6265738a1a08b35c09954726c

SHA256
eac61588233feab92f2f3b78964345ec92d6d50095d9148874ccd039831f48c5

SHA512
ce2a182cc7665440fd8b556610ff4ac10d0a741202aa26fc6f3320a82c4a3cc7ca4ef4a32eb178f9e483a8b0a251e9d87ccfd64d64b8cd45c23ff4d074dc68d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b41a84bde2d5787630edd845dd39f25

SHA1
c063c2dbda8b258576b9fb139a414df846aa82bc

SHA256
352b6219cae57cd2747ea01fd82d46ecdd32949b33190137e11f713e7c24b6c8

SHA512
8d980bf3f0555b18c9e41b7113d824fc27280dca24a0f32f0d15e0f87141bdc1a425b8b2144df30279309b52d41a826829b3359b7e389a7172854b9fcea9b070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9ae8311e3a160c0071572f8359f1cb2

SHA1
71cfbed187e495f08cd596fa1936356e3262752c

SHA256
89532e1ad37003f723970ddcfec53600f57163b7525421183339ed8c9e528363

SHA512
5400ef9eaa5fc0f29c131ea3635a91843f344920c9fcd8111d13c87d251ef5f5bfdb8476fc6f3d1785c1c67e48e68f24c355cad50f37dd96efd904be2ef13cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e3f7c7148be4f6005a573c89869475

SHA1
3122c390845e317f3442b9d2d65bd58e70d1e65a

SHA256
616602af3645f505d167856472599936c8cb95953e77a369ba723af9e4aa0f28

SHA512
d48c53a8e5d625fb509c634d56edd14319997e4d933226c74233d79b3ddffa48c70d2c918cdbcd53080d68f9b014e29cb559dd395e5f6a6f453f3cae35c88345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1b0e2e097c99457e610744a9db793ec

SHA1
db13520609950f8c4140877c7d94a736f72ba6da

SHA256
79af6622762340175b7960dd420e8bd72ba97d22b25ac361a9ff32445b5e133a

SHA512
6ebd5f25e301111991e03abf847558ec29a7172c9a76eee3780b9ace2b992d0c386d233ebc9d11c8443b9ab5bd46c5a499dac75194e009a4caa8f4adb07b76dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8bad0dfe7c89ff4a1c1335f1f36c7bc

SHA1
dbd80e8c36e09b340e154c8ba8ba46af76327fb8

SHA256
54dba9d77ca7a149407319ec2d1feb8c48b59861cd7ce1192e3e5ffbba2a672c

SHA512
1688fed3bce7dacc3b247b3ab7bea7bdb1b1f8597d1894d8ec42b76fc08f8a30ec470126ba46c6f02a72538dd25b9fc7dadb1f0901d66b4a663e3810dbea30b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8254ad46f9dcf9bb83e7b3067e8afe9

SHA1
3149a551437a64afcc818b0be88b90f1b1338f9d

SHA256
ac28611f407fedaa599271b8de3cdabf22e99060bf336b1811d4bef66c45647f

SHA512
c2b6a60242b8c371a1505c9204ee3d0458d61326897529dd203f473f1629c74140243500ae649f1813a274e40218bd99a35f63a73b8d7dc0314fd178a765e6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6ae5bfbadb543c86eb5baaedb357f73

SHA1
a80ed6958875a52a233d471f77b4a7c50c136a5e

SHA256
82edd32ea0746b48fc9ce57d9ea974c99acb9e2294dcb315ff69ccbfd59609b7

SHA512
fba0d70f365522bb36931e18c08b6813cae896080ab39f44c18196fe561b432f102ff62d283c2790472ba38a13e8eb6fde2df3cd12b41da736dec55244fec522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1dd34dab2b279c3744ecb88256e4dc6

SHA1
eab6ee2f6f8832fc8a9fbf3dcd0b344ed5e59509

SHA256
5e805586229e1db4a9d08a5fbc50c1f2f4c0331ed4daa1e54d8f6d598ca6a1d2

SHA512
67e547d6a168e726ff6ac2bd1bb101732e6360408c16dd0a22948324f846b11779b295970fab8b5ccbb445e88916671b43adeb3e68eab2fffe0454038207e85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b10cc0a55802cef1a47884f9b74757

SHA1
6451d28b65f7c3c4179fae6c8ae0fb32450a7636

SHA256
4ca37eae3fc35646937fb4fa0174f7934541fcbeea38bf58ce09024b5b4993f9

SHA512
eb2f1434220b96fdfe4ca4c50ea5573529c9bec6367fd555784505817b2a5442a1655a903dbf6cb38a5d55d6ba90f866ac33f59fbb04db8ba7d1a2f0596bf45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddb40ecc7e4470ceb40007b561bd9ad8

SHA1
d87799369b09901640e2a70b94297698e2ebb378

SHA256
6716477e3b4bd66c89afea60adde8a81b7f550cf346464f28cc0bb1f9559a392

SHA512
6cc05480c2fb22f0871f230a5c6c978cc944fd769e79a90ab1d41ab3eb2019e5a62944b586b62b4ebcde8160cd1dd251956e1b85f89e696868bce5cd66e533de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
748f52f08edd280435f571039b3e9ab8

SHA1
a3c479cad6065b6c2bb29523b02f4614ea963f0c

SHA256
3f1c8518b1d6ec57631458256230803ed263688a584b390ce7822f10fbd0287d

SHA512
7990ca6aa590dd0a8544f039553290dc46edf122b7316130d447f0c82f089e23b002d24a8f751c254534a825a235ad82742ea23c13016989d179f2030cd9a195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
384f9801ef7359b2e381d01408b0057d

SHA1
36687bcac19e054c48c066ef751f14be35f7ee5b

SHA256
0205af8637157b60f447b2ecb49e44db339126fba9d978264ec769a9efae547f

SHA512
bf75ad80424cd1dc27a80f0483226637ebb7a8e1da74c564481e809640a97fd91e58081e34c361fb25d74115c021a5bb4910eab18f6c78d54d77029707247d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eefcd78a41ac4e404c19775f8de2140

SHA1
c5bf8c46d1f139f8c775c976e7080cb11597b9e1

SHA256
9ff5359fd8e7c2b9c07afa942bb86ae1440130dbae19d5790e2cd7d563ee98fc

SHA512
e63119e848f7bcd183eff3861131735f925fe30e5266c5dcf2cbc979f0660f245bfca512275a8e6c253b05983a56f2946eaa133848a476715023885fa2eff449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb7db9ca83803c056ecb353de5ee3f61

SHA1
d8c967ebd8b8334059f8be1592cca55a87767a70

SHA256
bdb1a7fb5573320e6610973e93da4d0f54ad4993e497e0c7d31faae6d2300ceb

SHA512
0a89761d19b984b4f36aafa9318d4645040ee1d2242bbd8e64eef3c160e3c748a9cf8ea1073e45e67fc8c4ad164e5aa719dd6cc41cbec13cc673610f44887dd7

Download Submit