e55cd20d3744539a4283e13e3121873f8955bf9f590a0cc2814da9190a0f096d

Analysis

max time kernel
154s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c98c3d842f12f733025f920d0e109eb.html
Size

15KB
MD5

4c98c3d842f12f733025f920d0e109eb
SHA1

537c768a4b51a5db6e777d0c85cdf5290e7ee6d2
SHA256

e55cd20d3744539a4283e13e3121873f8955bf9f590a0cc2814da9190a0f096d
SHA512

a2603eefccd2afa8267681580b76fda70576a37455e29681dbd3b3be7af1c5e2e5afa2fc64e6962b959a1cfdcc3d0dc75a1a137a1926c50351b0f15cd13e6ef6
SSDEEP

384:F+kJy9x9iGj48aagZop0miA1Sc4M2oL1Mkf9l:bJ8/iGjyoOYxXT1MkFl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4025dea48042da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8E3BB81-AE73-11EE-86C9-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410914165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006dfa0c1358f4284227e19fdaaf1bdba6d4c86f11d4c1307b530f52886d671815000000000e800000000200002000000077039e8c29763c9aa535f91865dbf552cbfd1f47ab76da6ed323385c0b651dd620000000653571772af3f335199aadb80c59df0d45b6d40d20421478ce59ad273d1f8e7a400000006b3e85cd82ed1257afc88571f81694a914ff5574c584415e0a179aab4c06866462492db8e046f9537227366bd1b947dd18b66607b711e1a2847f08961fea4768	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c649489ac0e69b952527190c76bd16e3defa7b0c09d7bb3dc64ed42e4fecf998000000000e8000000002000020000000f7cb23030cf0ece3153ca1f977723c3ee86c84f940cbc3958843f92803fb193990000000730edd9602696f3c0c3beac1d63c0d3213aa545aeb1c4e022adbb5bb9f03a337b07262d1f94451ed3774821c30e70b76f6bf963a4cd93adba69b8ed5af89fd084eb7b40a524eda6ec6fc007937906ae85158e9f21f2b59ed661f9fa11726fa3fa30b652d28279c00ed8b944a36e6e10c520b3d4021aa9e1f2a1ae3917fb428727f9685dd888063d4c753e793369a05c440000000bcc5bdfdbe3f5f071b35d6112633c07413f131870ae48b4fdc2069355eb66139f90e49faa0b0a7d1222580d86eae881cf5724f87a337828e5fe477ff854a6226	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
812	iexplore.exe
812	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2392	812	iexplore.exe	22
PID 812 wrote to memory of 2392	812	iexplore.exe	22
PID 812 wrote to memory of 2392	812	iexplore.exe	22
PID 812 wrote to memory of 2392	812	iexplore.exe	22

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c98c3d842f12f733025f920d0e109eb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b73faebbcef5017fe1b7a9201122402a

SHA1
9e87ee54d871aba8569059240d1a5949cada6848

SHA256
d13c6dfb5d1fddefe9a9c87ff83b400be8a2d40588c8f1eed24d7d24a2ad1582

SHA512
2bf11b5bdeec5d739406863c2a789b65af74bae66c7a787137d237029b788210dfc586e226d0fe4e08c8742c135b56eef249fab45925a0c6c4014c820ab58a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b84e0091cf88ce25db36c6460826813

SHA1
f52a679234f8fb45c86d0d6e6b79ce47fb678a4b

SHA256
14a6b6d4c4a6243a87015c1066b3c1a2cf305f235a257aa81ac6d9a85dcaa496

SHA512
81d43430634bd1f6a443dcddabde388a12d4400c1d33b474b3ac35a6ba35802c472af9a6da34fc00911924ebf3f31abdc6e2e709f880a0c6730f9e322a7c5714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8abcc83bc73ff8e00deae909568e85fd

SHA1
590c730e31ca472095f4354ebb0660a52243c875

SHA256
9aff6dbdfbb03cd3547382d038b872ef23eec005c4529b456881a1cba9abccf8

SHA512
98b8b61bfde88a9c767e387d82a1c1c197800fdf8e3a43e376e928d00b3acec3511db1d6a94bf918d4941b6330a466e50a95490bebb0b79c2bbca41079631322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f629b3a29aa4eab77292501d8531956

SHA1
c99732723effab2da4820477dcb20315f6f809d4

SHA256
4cfd206513d5dea7e1ff43d5a940a8c220eccc19185fe0776a37fc8cd38002e9

SHA512
ac86c653741d695d6049b2a17a427ab0d562ce66aeeb04e243434742b6acabaa07a827ba2692c3641489b928b2ded7bbc9ccf12b9235cfc0baff2fd75bb06799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e33fbb8b947a12511bebdf656d9d3a

SHA1
7941a22fad7505dee008b8d7f862e77ee9b438b5

SHA256
37f83a27de233f0cf6565372939cf1902d76f79906749cb8e660b044fa78b873

SHA512
0cf2aae90a047af0b2eca38f577d7c596bf030bd91faa226b192cdde7829cbf19052cded4b27c4e800ed3bc4672e0ff2862b3cc09a0dc1bc253377fb46f1bca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
192ca4695dd2cb38ae061702727bd8f5

SHA1
30b8ee9b78c0f7cf515d2b5c11843debc9ca14f9

SHA256
26ba14742e0063a8fb431f0655dca0b043ee0799660a76d76cda9e2aadd2fcd4

SHA512
2a19e96c84b0e1317daa6564630bdd4d33561c0bde9b1122d50c7954496e302f49735d6ad5eb366463bb750d6623b606d5030d73c901292642f84e5452cc073c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6289a00d2996e1549a92454d8ab57fbe

SHA1
5c65643dd7c20f30842d2cbc24bf7fb718a8ace5

SHA256
4e74d91d7ffa88386aa2daa85cfc2f2efb496f0d2653daabb7375ee093682810

SHA512
3083a9e2f9630bc3f98dd811d7c3edf0b5037c0e7a4cf9fb76adb69c7cec8676ea8bc43d52fe0f24eb49a73d203e936e1009669284f11da5e345d0ff18608443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f966fed89905cf2f1c57ea640520dcb

SHA1
7b3d2e427b2d812b2abf6ffaf0ec434524783afa

SHA256
378aee9fa939071806036d47d25136a0becc30691cfedc47f682af703645b95a

SHA512
d7f07bab92e303877ace9adbb49518081ba0a3a9040452acd213a5c519f385b48fe29dec0ff2eb70ccce64083152685f352c59ed51e89fdb904a6303154985af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ffeacdbb9b76c4f9ab2bf44266c19e

SHA1
8ad2f1e97ed73e06beda6e567e49cc10231ba29e

SHA256
d5857901e6d2da9074db8d05be79cfd5d77b2cb034c01d96cb59cbf8fb325680

SHA512
62786ed9082240dbff0294124dcf770cd9dcb1d3db4ac2d5cbe3ca50d732dc44391a7dfa2360e1831fb09f0e462ce56e57e62b5f0fbf5d39625528614e141dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef5ea66141ecf393ad1341f0dff7fe7

SHA1
544f0d991f069b19313bdd2807c897fd91337215

SHA256
b935546714c56d4c9613eb0dc81c9a2e599bc39400e39bdbb40d5409d38c8218

SHA512
7bf5a678b39a2308b9f8a79646dfe85f6cc0444d642f74f45f02a8c56a8a37bd14492de807fbfccee467bd1009816a341439e811e77fb49eb84cb09a711ccefb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3feca4d4aef8fd4f2a0754aaa534d0f9

SHA1
545a4e516e3b52fc2c5a01aed7dd04c63ea3303c

SHA256
08b775065e98b0201e74d9b483b52fa40059589fdd42f065edda5fc0bb2c508c

SHA512
bb11d8af7cf6d3d82ece0540aed61f47a53744ab3fc78fb03a067b83140d9bc5aee100f71652e00a6b580620dd00f8f17e8becc4ea122e4272991a9635b84d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
399d465a77f84505b8ce98a76ab26206

SHA1
da9371180a6c64f4318412100180c54de5189797

SHA256
6cd64b84f8eeff44bb93f14466455fbbb3d17c8940be4b51b6076d3818a64e68

SHA512
861dcd37318c3bc4b7c3d7931067fe38eaf2fd5fb7fda9adb4ed27dfb8436f93d89da3c3b421a5bce315384a1ad265d5bf155537149689bb6774699328d2a34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601b98c1ee17e2834a1fa80b49d84991

SHA1
dff97792cc390a9bc3cab9babbfabf045c199a50

SHA256
105655714a247554f966b00f59cc4dd8667f2206747a826d506bb441ace4598a

SHA512
943ee9de0d429bb6dbdbc9ac696fdc15782200387b6adfb1a7173ddbda53a5d3f737331973b3efbb87b88fc526fe44ef12c189330fb908df3decb8aa907e5d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5671e0296bac5c989a4b181266e219ef

SHA1
0129cff089e82fc1005045f31b6df21cc5c8e523

SHA256
38aec13c26893663bd12ac5f26cffd090e634d895ff7dbd9f0ffcddc359bed7f

SHA512
f9939ae88da9768a355f6f97dce78c9d0c11d75bfac57576cb4b8fc0626dd43099d387d6e97ef7a36556ff0e0ee2d78037c99bf8c0201cf59bedf791ab873370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d089cc6c00a8a56ee9b5e10de1ed0ea6

SHA1
1981a9b752ffd167f17e051f24caa77a08d96bf8

SHA256
9abc932260179a0af81aca8b3c563d0ab8e1ed5c548ea88481d8df6f0d64bd10

SHA512
ac2382e6db343b65aefba8db4ef963c66352d4ee8d8dc822471aac86905f66c6c52f9776706cfe74464a6ab1a26810ac47193726d43153be2a3e5d7d9294784e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7357f93e9a3f231f45f0f65a7bde5250

SHA1
5bc3d9118b12403f96a9b6ee28e62759ebf4ef5f

SHA256
4cc7e81e621475b5baca4b55ddd4773b0069437cbf06341276ef481db7655d08

SHA512
8e433abdc2afc5a45811dac71ead8c911c5e198df57b1c71feafa0d0fbe9438c76e49de278cdda9af4614e6cf5a3a23a412fe4ec77671bd095613b4b17e424e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9417.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9458.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit