ee41a6e834d724256594c2d2560ad6d695d9b5ea1a69d053c6b0c76fb82052dd

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4caf6b562cf69340edbf1c76554b6b67.html
Size

182KB
MD5

4caf6b562cf69340edbf1c76554b6b67
SHA1

c1a25a49fadff8bef64ad0f0229d8c94c83755f1
SHA256

ee41a6e834d724256594c2d2560ad6d695d9b5ea1a69d053c6b0c76fb82052dd
SHA512

2b0de79ee0b5000ed8899e367cbf2497d5ae9240166a8841805972abcfb85a92707de56ba83a36caddb25185171d9c5f8033ae4ddfcc5a0fae379d724eca1aec
SSDEEP

3072:SLESaTVJyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:StEVssMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6DC61D1-AE79-11EE-84F1-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ca911bd156cd0eba1fc591ac35565067f3680701a46dc5ceb1a196b9230faa08000000000e8000000002000020000000b9241702abaaafe5523da2582ccf6163bd64f882ae9f3751d77793f2f9ce8c8320000000b74cad9b29d4290f3c84386b00ea1ac91dbbafe3df6db8e7b409a3483f343f734000000024f3668832caf1a2a6054c9a512c02f1e98396042433e02f534f7ac0c67aa2f856d3e50a50b2bb0136e2e7687ea7f8666a04a3e4dbe15f63379693238d9c6068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c193cb8642da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d2c0f62bff2f46f646e2b4f68d37ec8b0f0d78e60d88d8a4c25d906acade738c000000000e80000000020000200000004c21c7177d094577f45468303b104631c29f99ee10d12cc5f66c807014b0d936900000008a932e99cd5cadf6ecd9118e887b563e9658ba1caeea827329488bb8c11809633affe006fab3a6e06aa60c1b7184f0e4554d7c316c03ad804515c5452b518c70198a93efcbf0b4a468ba85bff6f51e866a062c90507f579ed553657fe39180431a96e163f97155f850ebecf58b0256dec2560daffcf05590a9893b8735e4d782c69a9955e5d325146e5a195ba01787fc400000005b8355a38699f66cbc00fec339ee4952b2f7bbed4a708f14c7ccc9c0032b5d0af583b3b798ceee782e5a201180a7d8fa9a12a9d4dc90be0fd726c1969297628e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410916808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2400	3032	iexplore.exe	1
PID 3032 wrote to memory of 2400	3032	iexplore.exe	1
PID 3032 wrote to memory of 2400	3032	iexplore.exe	1
PID 3032 wrote to memory of 2400	3032	iexplore.exe	1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4caf6b562cf69340edbf1c76554b6b67.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8add9ddee3df1e0298f9d210dfdbcf9c

SHA1
6e61ab25e65dde10f927d80c812c6ae23301da63

SHA256
ebc93553336522886c0a2122bfe73b806a134052f646127a08c466d5667d6405

SHA512
1e24d1edf8240e3c794287e1a1f75d2983527bdcd01225c71140cda4c71003c8dcd30883adc34f1a24624022430e6766ae2ecda05258283f18ffb88600b73dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
679fe4cc79e258a0d29fbcb95bd924a5

SHA1
d1df6be6a0def83d87bc1e62ade2045a3cd5b86d

SHA256
4672add8cac0ca0d7a76bd393438be81c1dce50ff86336f734b8ea170c50d440

SHA512
daa2af307fb106a146f826d30fa16d80ead95ca54efb8f58817fb82547af1511c493d3ead364a261b1a7d15449f6d18baf781e4291f0b531f44f7fc1cc486c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acdd3496f5dad1ce1eb7482ada868d0b

SHA1
6cc27ad3c709f2135411db1657d22ec119709eac

SHA256
c449422c01460f77e4b5bc338614f514685725146e97bd9bbc38ecdb6d13f16d

SHA512
b05ede81f6bcfa804e30dbde324f72357b4e24d25236838a7e06ce1f4a3b15cbeaa1e82db68dbac3b4cf0e3d5dc225f239c84c4902a8fa814cc301e89991ed1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb7fd41f0924281f868135af3fa14a46

SHA1
8e8d640175fc162bf459564b0d80e8a152a2a292

SHA256
ddb6a97c2b0584eaf4fc3ebe3a805355e05ec044ea1ea412c20132cb35aef314

SHA512
f883a03c7bfe28bed27c2b4ffcc42f00f5482310e532f444a5e1c03b4d4e81619e213439359d230236e3be631b679415fed27ebb065f931ed1ceeccb07bf5e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3224acf8bfb89f876a8cf93fac66efa4

SHA1
f43237264cda55ab9b7e022013e5a6058c924955

SHA256
d46c5adb85087e5683222c93f1f5aaa8fd08dc14ca89fd05880766097b596d09

SHA512
12c9426daacb9a41aecd1ea2597aa271d17b934aaa24b07eb63ea8970eff0c0cba68aaab31917d8d781ef995e8436cf9c54970d45ec81d93de075b5c26877f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19989a24a8d84813b38c33e5b5b3769

SHA1
cbd1872d768be084e5bdcd6f43a3d4e1dd4dd6d4

SHA256
5348d8b28636f1fdd9313a894783c9e0c0f9b6b6eb8f727a39726b0c8985bf51

SHA512
38ccad10e017734b120ecdc9197b8232c97ceef085e0e0c92c0d5dde3593af88c2f8c0899a59ceaa25bcabdb26a5b97bcc06b88206c790851be81c9c3d812099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbaf6c93df9e4339316465588f55ceca

SHA1
35b65a728cf786f5f5e2331d68383b9b9ed17d8c

SHA256
3dfed924d34c469999510612f7ca990546adb50bd1ad40269e465dced52f42e5

SHA512
313bc73f040ae1b4b58126eb746f4f32332ea3d94f9c712fc436b3a9d5eeac09a8cd05859d841a491534af3944d824ab6d4d22185047184a34fafcf4e0d91d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85734b24e0f653fbcca92c7714088a5

SHA1
ea86528e4d3c94d5a18ce4a1882e85c8e838cb5b

SHA256
f6e227aa14ef6981f941dde040054269d0d4a59f5554b5a168a2dbf5b67da2df

SHA512
c8af19e1bf67e203e40bdfedefcc9aa8d56f0a7bee130558c0348112e56b42c2e0712850db8273e75b1fc5c7b357b1df1688b23971ffcf40e6e8ffe43d1278f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7bad5732d520767949261444e05ae83

SHA1
0dee24896ab24172421f1013ce505fbc257fc388

SHA256
5fc2253789b434ed045064e54c90508d581aa25bf29437c5b9a9ae5b4592a5bb

SHA512
da800bb23f6078b6b6980d90ae8da36b370c9dc910ef115de70dc04a0d13b3e8e91332d7684f0d13fc1a69ea18cd0913d2e76779adc40fe268f4be4846ded2df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78034d73bffacdd43bcc91f8b4ace58a

SHA1
cb21b6c5ded7e5809dec270822cdf8dc8c88c022

SHA256
201ba6387a491e37ac4959f67d9f4da647c024dd3e43e58a3de78e0ac250ec63

SHA512
bf3adae761fe962ae27635748a72b4833192207259e967bb771706ab185665a2b854f7270067b521f712fe651daf373a48f818d68919f7da1a6a208c70038205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c52d17fc0e2e0d3b89df74e93d64bd7

SHA1
fa697802fc595eda499e26734624c1f78e7c20ab

SHA256
dac8ca0656543ac65ae9e1fd9ada37421650f342a55160ae8f37907cac7be77a

SHA512
22d5455187c5b85494ec5e2244d244f72f25b2668f5a468bfe5f5d963ff0295d99f4f6c03fca46b77792bb75be46c5e5974e0127584ea3a31da5cb7b411e3fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3a7eb723526e2b87bde379019ad8778

SHA1
0575deb088e85dcb4967ab9866d27d5c2d76e3fe

SHA256
03455c9c49ef899bc5399b503fc83272338ec295c8d594b404f8566ad01a901c

SHA512
a0e1d48084e56dcee361a0588d9d273b8dbdfd65473d1e3c740489ca217518d355dfad6cfaca109f9696df81f096f32e81089f9cce784a31503e3af11731eda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B7B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B9E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit