60b14194cd510a3a323e3b15e2914b6d668e9078aa52b9f2868c05632b7d53f9

Analysis

max time kernel
141s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48d97d9f2b35d341f26eea0b8a492d0e.html
Size

82KB
MD5

48d97d9f2b35d341f26eea0b8a492d0e
SHA1

71813f02f53de11bd59b31f9e436f82671f0c575
SHA256

60b14194cd510a3a323e3b15e2914b6d668e9078aa52b9f2868c05632b7d53f9
SHA512

dd473c2cfc26c3b76714a8ae2990d9dfe4c7a79411c109ab34f684a7ca584eca7ff5b2337292530d214c1a06c2adcb22b7752b06b21698d1ad54e5136f46fc46
SSDEEP

1536:WXEi5DGcM/au5FHBdvyguqGm6knZ2tdKQlqRIG4hqag4hWMekB3ddm:WXEuyrXxuI6knZtIG4FWMekB3ddm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cd2d1c9f73d58b9b04e01b638b0cd994d657219db4889711518cfe84a25d7694000000000e80000000020000200000000e4f1b28ad01cfe0b615be13a58be0275e3ea00cb779c4951525c57f5c28128f90000000b4e598b34f4b5af115ff1a97f6477ab2f1cfb669bb8e1b52a92bf60cc987782f15cb4f1e29edf56d9efe9922a40f53fd6786bc12ef6559cbdde357c39ef789390ea342ff4b41770a077a3963ce7d25d641e396483df6d3e696f7d1a53c0978fb3516ccca0b2602a1e745f7b93a2846e267f0985f89ad92542c3026e21c2a88060080bd2f301612717750ed3eec2f94a140000000d23f61a43ba75478ee2e7bad875a8477a95c5043f42c0d5f423cd9ffbba3d1181a703e63099619d69f2741fa96781f2bd501691135c8cd782f7f447b0d52bf80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12740B81-AD50-11EE-8646-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a7368f85749146c0930bfc7bb4203052302bf81f14a053932cc5a6cad3591cb7000000000e8000000002000020000000c3acd14df1d6fc74546424c74e2378e2a1e14b1365913fe3319d15177a7431212000000056e3cd35708af650f42d0432a67f13fd15d59103332ce095a762ac2a216e311840000000f4a2d6dad90d6845e3c7f4192665b64f2ca6b0e447886d11e3e4e3a0e68c2209f9517d4583c121c48547daf0c8386b25c9cc04c532abb02c744257a40b5b4873	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058a2ec5c41da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410788866"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2236	3056	iexplore.exe	28
PID 3056 wrote to memory of 2236	3056	iexplore.exe	28
PID 3056 wrote to memory of 2236	3056	iexplore.exe	28
PID 3056 wrote to memory of 2236	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48d97d9f2b35d341f26eea0b8a492d0e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e895e0bc5f0693f6047816179d5566dc

SHA1
347e5f2da1a32913a22a826923cc027a0770f20f

SHA256
af21b203ef714f40cc45ec380dced998971384a59649459e4fe1ccba9aa61f3f

SHA512
c5397030e138c90f9e898302f09e64478fcbeffd14033102667ef24f2396fb3af20c29b21e601d2ba9ea977f7161397df80332ffba10e3a5f1d18143463eb989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e5093d6578ed3a77090b05f2299c405

SHA1
0cc0bfaa4055208517675aecdeb846ef78a5a567

SHA256
ca3221ab0afb74c634122c729d22946f6483ab9d1321072b1b7feffea0291225

SHA512
e0120f5350ac291169c3e4e18f1df1de01dca5409ecd90548da6b1ffe099d8af32a3ea81e57292955a198807b3fb8bf3e48654df7f0a870972c1bee77c0392c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf32a2679d271ef98d372593a998661

SHA1
249d817314d34384f6127370f856c7f9ab054db3

SHA256
f0ec4257c386fb14bd110fe9be0fd61c3a777db78a0c6491cfd72c7be75e1e38

SHA512
533b292d71eacf06ea557209e769c6f7b75d4a3ad3bc9b4a102b49d832efcfd7e7827d548421526b6f95220fd82c97f3e812a9295de0ed8b5a5c9627b8b9adaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee25b35a7060d1faf609888a1e802b9

SHA1
b070b4dcf41d4c8a8c2430cf91bcb522670f6b2c

SHA256
318385062008d2dda3f20bec23706cc7f8a35117461e54de729ad5fd5c440538

SHA512
0a3ec032b6504d2724a78c5439442505a4332b6bea941298d51d4344d5a53f193643b1052bd192265f29ba4a999440b10beac66dde50b9a0987c0fe56c0e85c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c267ac23c4be088172480ba723e88c

SHA1
0513e1f9630cd903934ce986503400a72b225fe8

SHA256
66a58292c753ddff5a3911423cbaa87d3f093ac59e4f2e8afe9e729ed74f83a7

SHA512
9bd8ef63459c4698d44dd57fc301a0c03400faa56c55858775a3c1f63c7cb5c1e7e4aa80a15cd30ddd7ffaabbcd601cdb3342b55f7a360fd3f9c286d5886ae3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307e470b3d112a9e8c5ed61ef316ed24

SHA1
ef9b56fa7406eb6da7e15e3de175e9ffcc3f749d

SHA256
9e63b4a882f1c344ac43da9b6540f3ebd7fe4c1face48b2a957b6d134b49511b

SHA512
8eca260037f52c3a3087cf74b3fe82346e27f3c6b7af4956f01340210058bb22049145d4fba6c3e7bdd548f25c39614264e9219250a0a87c66cf3a862b59be7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8644dd1aa4b6071dea2949f173d5cfe

SHA1
93c2a9e36a6ba9921b75dd62c627a82349cd4c1a

SHA256
d74b8448cd10839326f6a6970396181e43f95acf80a92a1b35967526a4006908

SHA512
05b558e04a5a8884c0c888ee0b9dbe3aa917a2add6c6be5b87a3761838d1931a8927d94e4b63b1c471ff22c6aba2a834a19847c26661a7bcb1967ecffefcc6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f760574d1f7b0a29ffe51aa8ba71b9a

SHA1
c2786c077a5c63bf12aaf83c9ffb2c9a0826a766

SHA256
719bb8f58bb29badea4779945ff5e3dc5aaf330a8afdaaea1b5463418f1d5571

SHA512
ad667d60209660684ab5294fe38e48cf6e542a060878d8a0582dd75421740a29f81891100f1779783b1323a8d944c6bce97befe0645452e1bc68d4ef72b24328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cb5c80c97420e4d1055a6ddd754af8

SHA1
57e9a39e78bde333cd5daa7c4e9f3de8cd79ffed

SHA256
1f02fc0d6092e49ca97e578e53aad7f062c349a60c6fed55dad76b86aacbca81

SHA512
988a3b1673bce1158c618a2a4e7a2c7b9315f640cf9bc9009b1ae4821c0cd73dd46967bd2ee1462cf3191291de4a8f8eb718b9aaff8374caadbcbe3d9ac309e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974426db507cc93784dfae7683c645bd

SHA1
95e13ea72c5047cda6a32f93e86369e2f53fed9a

SHA256
056135f602f191812bdeb9d979de3fa448668f7df15fea86396715a0b3bb6bcf

SHA512
427c12577ded86205ebd6d541da02a25e716193fbbe16ac1b4ee5858a03f2fdb6570adca89d94961139d9069e3221b5755b38ddd3846a10fd32db96940254151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef5b20a510049154d38e6406c7a3c4f

SHA1
b4a7048f4c845f34195412cb735b8899d3aa5e00

SHA256
1cf1fbb05f95bb0ea7ea1c2a9b271f8602d29e6bc722c05b1298c4d42fb3d848

SHA512
e35bdf0b443312ea603c0c377c3d8dbb278511c40d01ec60553010f3929c8e4f3f97cd595cc9a561ac7f5a1295527f09fa2b349b0994476f7525fbdb78837d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ae5c3f84b8e19dc97f3faa782491b7

SHA1
904a29ad8363f91dc4a7e57636f527f6b452271f

SHA256
34cdb3275474a0e34e17a5b5ba1afcb49547e5abc6b9299673f49ca2f335f25b

SHA512
c65f135ad26dc3ba00857d4b5baf028ffb62f23f525872a5738be70f583a00644554839f6618772f45095b511c3209da437888900fa42a01b417bc71c8551ac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cf34522774eae83066ec0231100ac07

SHA1
5a194297e693f3ae7270c70761907f2d073551e0

SHA256
29242a62b20a1845711f7d3fd86836a03ecf3e58caa31f24b1b8d163baeec737

SHA512
c76e20935ba566091d2b8ed07ad97b976621c871c130d2b17dcbb5f28bf8344362364f29f266196f403c3889c57e1a4acd53019e75036e55744b5c0f752f40d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd37ea73f37adb35dc087024dab79229

SHA1
34304e87a830ab40c8c9d083c0e81446bf0e8490

SHA256
d66c6678bb212040bd7002ef6a45d3f180f26a03bab2cc9e7262d9a3b8593e33

SHA512
7d6543226ef0ff67bd717c24dea26c41b5a868c13174558d8c7cc8f0764c5df7cc53b1b13b85f407547c1094a71defbf46f7aab75fa32a1fd99a53c5ccfd51a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea921980266999e27984888bcc7c3240

SHA1
9c1df3515d244385ccc8c23028028a1c1e8170bf

SHA256
68c5ca543a1fa6c042507297482585bf5ca628f6814d2fc2cb395eedca13621c

SHA512
8a86494aa2db138bdeffe98ee02d6e2849afbafc19d1005294ef77f5c6cd36f7fcc72709f4d8d88a2cfaf5215c1dfad46c6583e494642e09a1a7c16c1b877bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f64a96e5c925db78f9a259f62c91e06e

SHA1
7a11a3a605b0e17609c82832a7c6acce5b3a76f6

SHA256
455731dfdf680f0e6b85b51c32c182f912c81cc664b49257c01534de8d146a20

SHA512
ce52320162c7ed4ae0ed973fac0da7fc1548659726186601db782c8b1e5b52340b99f20337f4b36ae108d236a0480cb0775fe5b9d0f610be2ea7a6cb127a6cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10662ff4cb0ba46806292d910ec5b68b

SHA1
12a15fa31f36c42d538583707243f157d93a214b

SHA256
aad447e3483d6ad9635aeba7dbd848e03abede2d74627135dfaf6497031f26d1

SHA512
e9effd4ba44f7ec7137534e32b8f2afd3f64753046f210bf666b775870450c086317121b3ed12433c93efc5a39364774b6bf5f871317a0d9a01c486cd8b3fb1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C6D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CCE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit