c9848fb41232404190a7cfb7c3f4f97914a35100809178a1efa67585616b97a6

Analysis

max time kernel
218s
max time network
252s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4936f9b8e7a1df2cb673fb07fef89844.html
Size

110KB
MD5

4936f9b8e7a1df2cb673fb07fef89844
SHA1

6aab8dc29325306602e72cf53764dcd10cc3f914
SHA256

c9848fb41232404190a7cfb7c3f4f97914a35100809178a1efa67585616b97a6
SHA512

c22827207e1a7257a5e2d1449a084f3eddd6a21876e450987423410d36f9959cb583a014f44ecd7469c2934ad1cb986536260a96e4f19509ee74dd5d3d342dc8
SSDEEP

3072:JQ16tacofkcRkcE3C1BWTOQtzeJLHjUU+sOKdXx:JQ16tacofkcRkcEMjx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E283D270-AD68-11EE-A581-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410799535"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4936f9b8e7a1df2cb673fb07fef89844.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4bb4253adc1f82b0e986696a735046f1

SHA1
65f67fdbc383e01e8a63a2f15c69a8625b3f28c2

SHA256
d9c5480c0038839aa1160452a02bd088616dafc8ce64f4bf458f07b7d695f16d

SHA512
64c6adcd29fa6c7c5cfd080de8e0983da339644cf57b8f54d279601e5855c8d0c76588cda94bfdcb0c2417ebe53535ea25d624ba66c377e29181b37784e46a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92b91c2b2725bc7c06ffb9af33109937

SHA1
b3381ebafff7b4263b359e09676bc84570f251e1

SHA256
0c32afc9bf8646e57910d97ae9b9186a40a81b6c7f43785c55d0653679ea271f

SHA512
b9994b15a96eecb18591c51ca53358ee7e38dc3bc3489a362fc667c0f6e0a462533ad8672f7fc9482b21a250d997db92f926d3299e11d1b80d32251841aeb5ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
117034bd5f87d9f223b1aa64642b745e

SHA1
496bae2901da8767d99925c7e4d54e8667f2677a

SHA256
cfe4dcce023de16559eadb57d62c1130e5af99b812cf69f212892a915f46a67c

SHA512
ddef28967aac618a8509e6fa591338730e9dc4ff6198fe456e2560b22652123c054f1abef825eb3bb5344b6eed99d85f5548b0d4c821e82931498a6974c38c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a06b38c668ed7783dfa8a3162e8b9c33

SHA1
c4661be7436aba2d3df709289478b41fbc63be3c

SHA256
d3c74fd6e18b5742ad9e3dc9c295358929588f08b6849fa5fb5dde2234c09d22

SHA512
60385609259b1961f7dd9d6172fa4d3ed01359273c0597844223e8f61406640229f04ddbb49e0213387835b3fa66ec7c173e566ec139196e21cb278976851051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47992a329934bc66f731b469e8571cd8

SHA1
b177a48bbeeba0911e7fc6fb3851bab1255a198c

SHA256
b17677bdb6fdb6e96370a7db837a06bbe0a6279ee85f0f58f407915e2bde15f5

SHA512
333ad6af88189a9afd887c4d0be8b7ccd126dd1c96114a94d4628c41a41243c1e67e21d337b65f0452f5839d84babe133db6c16d32f63faf55c816523995ee3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed3c9e29ff690386dc8881807b23e4a8

SHA1
77bb142ffacd13797d01cebd4a9dad1a0200de40

SHA256
f2606f4062d7c93e849cb4f5d1172645236ffca28a0ea8dca91be340f8499ddd

SHA512
2437f9cfc6857b6b3c8f9faa26284bcc45b40350521ed5cb844284cf7f6223fb1c8e87b0fc091fdbfb381da336ead7f88211c050c328d655febda317f1afc12a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6bf642d5d02645c41ee54ec48bdb9b7

SHA1
1b061d88abbb3fd6b12ec7880ac7295e3414098e

SHA256
10a3b78ec016e56c1f2a8ee4ae9d5c1fc538f07aa9e91b27145de00833eeb50b

SHA512
3eb0b8c92e29530987ee2fb2601ba7c85d9b2a83c42e317d5d4b3e3eb48731a09388a6160bacb2fbf7cb3d398cfa17ee9e31653494d7412892c0990d08560535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c3bae17562a93a54877003bacf09398

SHA1
2f5de9b079fea7ef8124d2a3c4b678e6400bea82

SHA256
62d61a412d6488414859f7afa4dd17f809fc2cd00a147d53a706d58d75e2546e

SHA512
6fada7521969870b6afd7b0c863199409eba8758053986b6951b3f853e6e2393edcfb95e354ae03795c9cd96ed72bba0d8bef67105ac9324391fb0fb742c9b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6079d269f19fb2f4ba18d39f360e2007

SHA1
38326786b3b0d163e78f25640cb6dbc4fa1cf77c

SHA256
a0d0ed356ba272e0c5bb3437bd67bdcb1353cfe02a2deed7d55f1bda00fd03ee

SHA512
12b1328147833a8f644d1971df7a66cdf0c25ba2a0096474fc98a9680ba0d14a2e5d91d254836360fb651e3ab686d385f1d71e878babd69d72268557ff232e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5572.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit