b4f14ada0459b265fb4492d970d1d37b5b8e73c45e81aa93da79bf7a11511219

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4caa5665018583237274ca0e84d6a07c.html
Size

27KB
MD5

4caa5665018583237274ca0e84d6a07c
SHA1

024e13b115521e27010ee1718a257666958d30af
SHA256

b4f14ada0459b265fb4492d970d1d37b5b8e73c45e81aa93da79bf7a11511219
SHA512

5b6a30e522097e52cc3e7083d6bb5798f9f23af8ea073e0e8118338aeee5953334ac93e0e5ea3fc65c1f7cbd7b7ceb233655aef81d741c6e85b662a0fd01e48f
SSDEEP

384:9w9hFdLEukexktOAeT0b0l8vFNJ9sgPHbiANXPVlpd:i9zdLEJ0ktOpT4x9xv+q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08c85798542da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BEA3C81-AE78-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000008b18955cce6ed2e3dd01aaf86efd38a921d8cba1a7a6c188d3ee5e9b6cae25ba000000000e8000000002000020000000ea624b4435b48045659a857026a1785941223016bae108c09c8513125310d111200000002a1f594b44d9c413be531c2030c27093b051aeb7616a7552273cbf1c248a954840000000a49d3d978fe943b9186ceac30b6c6785673ea1e80842541d1495b6c92f37470c9b8410d75ef7e3b115abbfcbdf66ae245797bb2e37f6464d43c47f47b603472e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410916223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000b2dba0c3a1060dda45b7010357dfb1ce8ee2ae00303509c77c9ca2aaa2682e62000000000e8000000002000020000000a52ffe679f7ba237e58e18d4d946a89b4891658a11f6d15440206218a8c365cd90000000434efff25cf518ffa4854849f2e0cc3dffdabe48ac29212edfcd10bfbb09b59961f5caba3eb08f377a7ae4f0739a2f31538f8382e4e21e067857868e21475fb6ad1f539b764aa7481af6035e130111be0b3448e192ba9d94fdea9d2825f0c4624e97e6522a63fa4c6486bda7f6d205b64ec9772305e0a3019660afa1ce79dc8f8f74768a2687ffa529e1173e3352fc6040000000c48ba2d3426cd396fce8420183d403a1b5da293aa6399491befd267051392cd8ef4c48cf9a0474d70592a743badd8dcd730c6ae07dc14609cadf1965f708c857	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4caa5665018583237274ca0e84d6a07c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a8d4403df3eb46905b17c3a4370bd6

SHA1
5253791d27cea95cd6ac45c11cd84cd16e0c06cd

SHA256
74d4c931245d3957efce46d22fbd0064299565126f1a4e8b0fb7c8df988753cb

SHA512
f640cebd5c8b63b1b83cca3be0de318539ec65a2673095b6328f07449f24522798ee925d3aa8cfe7420583e9e2a3406a6b654329630dd5238e08fba5a5c380d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc925ca2147721f36af22620ef16cb5e

SHA1
b713215a277a1c27452c525e522940906a4e62fc

SHA256
2b99ea9933b5d168a71b58c67ceeed53a2c1e6fb3d15c39333fcea3afb15f56e

SHA512
7c93717a7bdba293629162a2f06a88f936bde584a5109dbee1ba632be12a9dd7042e1d120ef0be29d2ad2e89504903403e7e506ea0087913142876bf5e630467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59f625c655795747090268a26b685825

SHA1
368d8c7c5d99c42f5b901ca386c240c7b1bb5ef2

SHA256
d4006d8c6af3a48eb181e5d94b87a8e21dcb24e2419ea33e3e106b98da841c53

SHA512
4b273c9f9791d8567a4402902222272013eae2626d0deeddc09afd32914cbef28edc3607b4ac56b7047b8f5f503ebf7dc1e7bc0d6ce13bafe073e42f5f42ce2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f525d972fb72069346ba4b9d5bf95c0

SHA1
457d6169b6436e030a62633b416d513e58f8d159

SHA256
3cdf89f6b35e598bc4199817b738f76ecd085c4d33d9dfaad3a7fc7e5e76e4d2

SHA512
6251d9a91ed0c7bee6aba268ae2a8ae5c0225be50956b876b885f652ad0de2dd05f20fb85a2bece1888418ca6c765550bac9494800c1453716ffb7f6b17886d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44638fc10a26de75b471692c52d7a35e

SHA1
ec37ef6fe28164ff904340ac56b4adcd5bc59a09

SHA256
024c45ff494f3a24bfc548ba3974b943f8fe6669d09009d917ad021aaa538a21

SHA512
4eb61947b7d376352b5febf6e576e700405139f026852ed42fe1feb052b661b4bde6393368869455423c905515420560de6260e6d64468cadfea05938d632d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
166c974faad69d003ccb6e056377c1c6

SHA1
c7c3c75d9cca9817fed7133a4d84e58e1d4aa91a

SHA256
3d6be3bf266dd02b6f26ea26e59980215954b3f6ce828133ef31742764760d37

SHA512
f23cefed6021ebaef286e09ff99c885b5d8bda94b63a4246e38472d6c30903a0de3fd319f8e7c0359dd1e0c7fa4edf841b14005552bcc9e9d4838b5459583fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f37e64dac9bdae6a38f5b2597296ce8

SHA1
092f4047d9a0d04cf9527a7419d5edbf69923e44

SHA256
a3fde244f7d13caef8887603aa5af9686c019bb78f32eb54eb54c09175246296

SHA512
04af8ff838b501f4ea769194ac5e232fb4b38643d53febc07cfcdbea0a97573bda732a41e6682a0554d1d45df4ee4ff91aa9d52ca5182a1bc2b68f22263d878a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a1721551fb4879fdf7a61bff8ef29bf

SHA1
639fca9a3f1eb02bffc76af6102a13a34e3885ee

SHA256
bd66a8ed000f0b9140078fe901868dcbabb6578f94a2f88c4c9cb856ffa07d4e

SHA512
a1b3c9ada10d3061591e88393ea33b57e0443b51b1f7df78656905389c716218eb793a49d733af9724214f480326885021d20e9f0b7b25fabfe5b0e986343480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464f90d608317f467bec994de675886e

SHA1
144f6c0435daaee5a9dab7193deb990a0d6ddaf3

SHA256
23f5403c5b211ffdadcb1fcd8912e54b9f25e91d80b2db202232249f31e10bbc

SHA512
a22cfa3b5cb886d9efc5d1a3bcf2db0ce8e69f89635cb1a909d9ab4a981437e0d688d0795fbec069b97f956d55e7a278e34439bcc0a9094ad1b0740f19aa5c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5eb506d720f93323112009151364c6

SHA1
a13b096b5ba712f13360b93748887afbbebfea55

SHA256
d2e1c4f084a2b7d09c6bf34f3eff2bfe153701897abef010aaa68f11ecc1d43b

SHA512
85c0ee2a5d18c23eb9b7e05427e74404f52b4c22febc77aef834e42f113ed31d7c8d90afaa711b455ba19c284061baed5c9931567d5e6b6da179e934d09dbd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98460ad021bf979193f0ee29fb3a11ca

SHA1
462e0d2c1448a43ec300d06d2149c88845edb61e

SHA256
b398efc597917d469814093ed546234cf6ae01fa07a89932d2ba2a856b44f16e

SHA512
074135cf64e1f5c98a70ffe39eb26be1d3a376e7cc68278e5da1cb129fc30370ee9856873aaa62573a344d5b63ccad7922fef55229b3897c9d7c48b1f71bdcf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
084b5e0dd8332bcf7c4a8f117260c668

SHA1
b7935bdb122db4dc1d020acea46afbde0ae9b45c

SHA256
b97d8bd0ffbea2c25a517eac59f050a1eef70e87937924bf6e50fc0e77e0a5df

SHA512
3627e4fbf56323523f68329fa2d5251d069a2d2fe6ce46e5717e2f74d4974f083ba12514645052c2e8c6a3475396edcffb0a9e7edb4e3635585e3dfd8dbf34a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b0de4a5910d603a65697eeb110f3d5

SHA1
7c5dd66b15661ccc274a240b2cacea6a1382d1fc

SHA256
e88ebdf7613e1627e8fb8b90c1f29d1b8d7eaf92a7df7c8ef54e074c4d0cfa71

SHA512
2dc10eeac7d0d8bfa5387ade9c6aefd98daf228eef0bae153fe0049d60ff7b619c2857d06447a9397de65510bb590eccaa3d3e335f8832aa901eafbad4f19b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d830afd07f888e3046e5e1de1eb2f053

SHA1
a7b8c2156946bc73cd304959187e346641524a61

SHA256
78654151389cb7c7f311a5e143e1051824fe167ffae17e4e4e7f3ebfb8e4406c

SHA512
b8878ed6bf4f12efab2415d73aa5cdf5cba87c80d258863f6eebfd54faca4e3198edebc4b7ceacc23dfcaf8f562e9e23bcc39b9c0b0e7b66cabd3fbaba30ec9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42c9da2db472185ac46ecc15f15d792e

SHA1
eceb3f40868706794739764e8264507df957ad82

SHA256
58a65b9e1e0252db3a08e5b73e7862e8a3065a54be8d6dca63da9a4f1f4bc794

SHA512
71e27a6636239713c32c3181546a1e5f6d9f5aef8f1ed1810d250ca7ca96dfd4a70783c4e3e66c12c522870018c1d5c6e9d62c8b6e460177a00fb28b5367a582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dae0e7c52c06a4627dd80bf107ad5af

SHA1
7a75d69e0c7adfdd36bb55e92ae23e2dddedb43c

SHA256
b42126dae19cfada309790ba778ded22dad7b734b9090a3b2674c05a6a5404f6

SHA512
5c8fceb4410351623e925f0374530d09d5a95f6b62fa37bedd2c36820db35e5be41dff6ff8cb5b8b7d54d4ca28740735b21de50c9337ab9939ce9a46d5c38b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9676.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9737.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit