e8fb0f1ac3d405370169e405e01497da186d3725739888d2cfa1d946d8525d56

Analysis

max time kernel
141s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cbac81cc046069406ceaff2eff19504.html
Size

6KB
MD5

4cbac81cc046069406ceaff2eff19504
SHA1

f6f5e39ef50878475e9bf611084aa20cfe29bc57
SHA256

e8fb0f1ac3d405370169e405e01497da186d3725739888d2cfa1d946d8525d56
SHA512

327fd0368e82f58aacdb41388a5a5c15c39125b17740640d615430ab8b9589b5dce97c4dc4c972720918fdee14ee93f1e8b7b10c4724b25ff28e62834626987e
SSDEEP

96:uzVs+ux7LMfLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7LMfAYS/tb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000009e7ce7238c6f57045c454fa12b6ce41142228a3c4e9951be35fa6b1d04fcd9b000000000e80000000020000200000003723c4a59131653059cc09735351a0fe8b980f19a5d931c0e47943166a6f540a900000007705962611acfd87ac1a731b32adf37f216eaee68e17d70e2ed110c1dca52c4563bc1c26421c5240f6e77b23dbe3f5dae86f41ea4ee7f224fa22de0719d734d76d91ecd19e8e1686bb224d7093e498caedadbb2f2a52282afb2f1ea0565ac3b19691be33bc27b3768df92e0436f702e0460d48577e41dd796a9d1820d0e408e05dd3ab63cbd76ba026cbd507dbc378b540000000d6370ff1929dc3c06c87f7da70f63269eeff5f9d189089bd0f27be3c51078d5bb459831637a71317256dfd2bc20ea6ff9d7122c54a0eb45b6519538112548ca7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E846941-AE7D-11EE-8073-42DF7B237CB2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000091a77257e5355acd6cd0b218bc0beb1f05929602f0b206f7cff8d7da074337df000000000e8000000002000020000000faef0b1cc506da562883e568448c12f06f7b3b6b690457a3132b3b7faf7bfa2a20000000aaeeab0e7da38adc57d48af7eb7405455a90dfa1128af7f92038b4d65301f5ab4000000073c5eda4c8967b89836d30d65d83c22d091a42d79bf780e1f8248ad4f370271142b07696a988641efcc4dc289d6a621184a4ac16963f73496d34bd0993fb83a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08652568a42da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410918325"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2156	2256	iexplore.exe	28
PID 2256 wrote to memory of 2156	2256	iexplore.exe	28
PID 2256 wrote to memory of 2156	2256	iexplore.exe	28
PID 2256 wrote to memory of 2156	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cbac81cc046069406ceaff2eff19504.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dab697bd3c1a3ce51f2c6ca6802961d

SHA1
ff48f4c81e6f841c4bda6ad56fcc0f4cfcea0b84

SHA256
a7457167efa8c49b88d4995ce37bff220ff907d2aef8d579b8df678d36114cd0

SHA512
2c91dd48f09139a16c75b668ff898194ba5dc3f8e61a956b4cd1d1213e056f65d433be18e8ec1bb1d8267dd108dd09373587a2465386768e740ea394f7ce04ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5967975c1f1529ccdc973e52efeaed69

SHA1
f50a3e8bc6ba8fbd16f4257e9060e0b950da09dc

SHA256
4a15b591b8f0cb1dba2247c1d7ede75f1b9ed7bf1418847800ff8bf2b6347620

SHA512
d97a483dfa6dc4d80ebf4181eda5e5bf91439abbc84549b7fc745a7d51597f9bc0ae091d4c5aa720b0eb061432ba7b5f5b05d24bfc2159738fe80a693033d135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ada7eca439a179cbde87f5b95d9e861b

SHA1
8574e647737cebe7625afb1a3b7e613c10982e12

SHA256
bdeee4e78b6e76a36fdca400a1fd1bbf4da49dc296ab8b0cd6da2d986d202c4e

SHA512
ceb4204a35d0960a1bd6db7edac53b03b997068bed4034030873b8102bfdf58d84d0ad6775e62a06cf47c0ebb3f0cd1fa2c83444d489c2ad58c670a6752d23ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec840deb827a2a560d8c160f11675db6

SHA1
0212ef82befe1f0879da6ef780d68c616a771c9b

SHA256
6fbb05daa0ff308863b43ee70bb080c625347651132718059c485cbe8af4a5c2

SHA512
ffcf9f4b301906bbb936194f85fb604fdcff70f6b64cdd0632729c3448c10370fae423f51bc87698553f6e671f9935e79b8e42555784362c60a71ee8d00bc256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53ac8b5e724a1689f5f2fd0a5d2a099

SHA1
540cd190dae1219c4613d41f1278e96d2491b6a7

SHA256
220576daee66ea0c3c83c1073a122fc9065404a932875632c4d72eccc2a5f5de

SHA512
167cf6c513f1c413241a3229e3ec411486bc412d191df4edbe2b827968e33d1b2ca491e36ceef7ea214ffa85dbc4c638f980ff0f0f4f67b7dbc73789534096c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c22619890b014de7af7f367538fb6f48

SHA1
6555b2ec1f917c43354eb5615e4cfefb00483ace

SHA256
806f8ae19f187963e59b48e98bcff42f6d74732d5cb28dc8a34330f6cf627b0e

SHA512
5529574a78989ad8acf395c3b35073a996bedba8b8d3e8b2e4dc3f4487b49bcdfc1f1167221d38028a9b9afbad148e9abab57c15079493aa10c6f3b26224bfd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae06815e9d1f9426e68dc21a1b2d5dd0

SHA1
93f9d33821d17e4de2ae84b946891282e11dca32

SHA256
5a27e9548f116dbc34bb0530993060b35248f20c930f18fad1a06d1a05b07f46

SHA512
e1a6314008caba7a8908e5d80440b24c57b188a6e9959ddace7ea7ee337d26af7d3f779fddcbbd3c533b945219e4dcf099cedc7492bcedb516114bce4895992a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca60b99e21b916d84884ae3543c9295a

SHA1
af5718925756bcd7d9b2cc5d9b9f9b430bff46e1

SHA256
90300bb0ada8ca00675c9061af963950636c67b02ad750208281687dd095e0a5

SHA512
d8ea07e91f0aa396be7e986e0ae5932e8216cadc8b2df5353e1a4e1eb899b989d242aeecaa9632902dd503f013dc44fa5d97f53ba26c8f51b1154aaa6952a29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e2fd1f839d3dd775eb6611f821c0b30

SHA1
88017471b159874ff8d6fceb0264b91f13f268c7

SHA256
6ae650a2a50653a53786f38e9f0058bb73c324f05773bdcc46550bee2d06e289

SHA512
9d349a5fe581bcaacb44a75a3cc2934b1fb6b32d3d41065d4091bf1ce66d810e8569740fd8c1f70d0c1feda8757677ace51e8804ff2aa3ca5b986e6d10df8a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab828B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit