9b76f6dca731c453ca9b0f7f9a256ed94ff177ded9875c268ea6ec527050ab46

Analysis

max time kernel
117s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a89db48307c641f422a3253ac7230fd.html
Size

77KB
MD5

4a89db48307c641f422a3253ac7230fd
SHA1

06addfea9e08ffca5fa55e91fe89ff700868c08b
SHA256

9b76f6dca731c453ca9b0f7f9a256ed94ff177ded9875c268ea6ec527050ab46
SHA512

b6aef961e5f0e35e6617a0baef1aa9d6bebe601226f6abc88aa24fab96ef3078599fdd2698be0fdc5f61fcfeb4ca3719231dcecce0c37b6f15e193efe348da5f
SSDEEP

1536:QlZP/gQNJITEl8zee25xleobee25aleUleSeOuJXZAbbaele3eDeAegeUeZUoeKa:QJ5uxcFw6J68

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f0588003a3c66506c53a64807ed4b15c70134ac53383145da441a6a376b272df000000000e8000000002000020000000ae4a85179ff35a2caf5e7c5c12b7e59268d77a9a1a6dc4ce5f38d7bc6d04803390000000d7ecf6fae704b55778b6e0098a0f58a1f09ab56434e3286cb93bf5de128c181ee04afdbe7c1336a061bb67389afd765463ceecee419f1f393c9a7653c41564c204155105de1dfca1d4064980f92b222ad06c1e076b22ba8e57bf61aefcb52eda367ce5e77c09dc10cae227128f6f5acf565897a88794dcf2bcdb579897bc9c4d548619f738d61ce57f92ca23c9e065be400000000a6f3a3348c3d6b93f01aa0834736371dc98de205a62e2f282343f7bdceebce58742411553a28e722e87d143cda76a011f03ae8f0378d30789e13f0e9a8a4a68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410853000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ca044af241da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6672ED61-ADE5-11EE-93FD-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d51bf7d63ee8582b86ef2d6c6b832d335d822b8154e66c3aa259dcecb2c602e0000000000e80000000020000200000008ffd36360d4c3ba33839cddd9b73a75aefc65c1969013add69d8b47c8349d20e20000000f49d4634d38424d980bad5b713bedd854c06485d7c47acf472c20b05b95ba9e440000000bdccf85a59f06053b442684eff51b6b113afb70e6f4be5277cd64775e01757c1098eda0ea7bd0862bd142095b01c471833aa5ec9c09ffb1556375b31710ef0f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3008	2976	iexplore.exe	28
PID 2976 wrote to memory of 3008	2976	iexplore.exe	28
PID 2976 wrote to memory of 3008	2976	iexplore.exe	28
PID 2976 wrote to memory of 3008	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a89db48307c641f422a3253ac7230fd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
006f5fcd679c7698ac859094f0a9cd8a

SHA1
38fac6cf863e9484b4d70d44b45d017759626838

SHA256
61020b3b43cb2cd03d42482623c865d2c62d289b89545339b1a6e1372ed4bf42

SHA512
d948d28c0b2fb7cf8dc25f28c4f3e6c5ca2007dd9d1d1107c78a0e2922b045e893ca54a68926b2df6790c00dfd2d5cd874b0d23a070fbd814bc51fe40f1b1035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb32c96d5152f21a2c5874727d616e5f

SHA1
c68453538f7b23ad3ab2c9da5fccc5bcb2d2bbc4

SHA256
fb3527b6e7b5c6cfff79efa6c5e66e22701052dd534cf203d576a4ae5f7c20ef

SHA512
d3e2834fded423c3f0f6311868aa2e0f59705ec4565f64ffea96f36056b1a9494e4e7dd125a4e931da3cfc13701431fb53871d9325c7e9335cf1dc6396fc039a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a8c9141735a1764f0b25d6c0283251

SHA1
6927e2d663ac4419d93af24cb6c9256419132cd9

SHA256
b36a8ab31d94de93a0cde208d8adc7d9f62cf4863ad91d0aace6cceb8b384704

SHA512
89b3da8c9695e77dff7d9a38cbb7aa85569174d1cb22a75637f8f488b7550c0dde9b03b3e8653a89d8b5ce8a1930bbe6afe785416f11c0431b9aa61611485844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cb529da2f377ad747f4080eb7b1ddc8

SHA1
b0b957d4373f3c1bdb6bdafccbf3a27e499023aa

SHA256
ee27fdb08b34da019443cd371423e4a608a7eee5672befa0685d1e9971458d72

SHA512
068dbbac375f3c3d5df7627a1b703f17f6fd2b7f63791cf1a73d46e36b28b33c82da96249f1b3c6db7382135c89dbff973070695e9ed4d8428ebd7d5d15c92e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dea7c5bec86cf3c560204a8e7e53a4de

SHA1
cce608a3cda0c4b883811ea6423424ee1a5dfb26

SHA256
5bc1a53c893d941e2aeb24cfa21d225525b44c5f8653a1ae8ecfd2f832cd9f36

SHA512
ca5c38b5148de54a81c6cf2c11387fa52fa6d44adc8fef9dc669c0b4ca3f8e3f27ddbb152936bfe083f3363ffb9f8d44a4963f7eb193ace55c1fc51ae4734c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7898125e14227f8c440cf55783cf0cea

SHA1
4869532ce10916029b36cbefcb3e9cef470627ac

SHA256
4b4bec2278474533583b7a4cad1d0303b8ecb26e6367c22bc53e3eeb3e44ac38

SHA512
c80334d582c145da1cd16c50fde0d824bce6f000743e75a1c75ae361b75a60d26f2daf8a1979222e51952f9290bd3582deeb4e8912e6c8223d3b089b99793c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d018f2dd26ddcbcf9e0bb3781c1fa6e

SHA1
51419e5769b5ab037a5b0e2a2cf46394c8afcecd

SHA256
93b7f1db0164d4d3023a41a4c81332b92ad8a1527b8e19af7a3195e9d0dc799b

SHA512
ff82c4df2c858b4cca3f5cf6167dd83345d5fdd7ab2258094fcff7d589e9efac9ae3ce736cc1dd41e98784c26af1242d23e5ef1acaeff3b0a36ead4643b1e6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70f6a65d5b1df3b123e4afdef153e025

SHA1
4b303e6dae6338b72e0a0aba5559c3370c357f5f

SHA256
1a69924045757aa9dd17e595664e062ad4f30d1eca2f3a79d077db76bea7a342

SHA512
1bcf1a1fec79b6e4e8dbd1afe360defe43bd172d17d6884991825b178fb07908fc142ca0915b93920292237de922e05820aa3e5003eda74b0b13acb9da4124f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64aa9b3c55c73d0ff0c9e7040ade622f

SHA1
a779177ca06698f27294ddfd7180a4f0bb59e0a0

SHA256
10b359cc98ee441b2c0aef7a0b8eec9ab07d558e6c6d5f15c4d876dbd6497746

SHA512
0aa2ea9d75d8b3c52f73a67e3494da09df2c4a248c96156bb785977bce1dbd9b02c0b79163a981f687f8007d494e64ae5d77a5a1c4cd9888211391d09ed8207e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8da6036f8499bff31e687c9b3d1ff7c

SHA1
483151aacb4849e5158cf7ab3f03247889d2d296

SHA256
ca5de5fefb44a5f1a322d347d077aae03c75ee64496081af9ddb9d922e948dca

SHA512
40a329456de25bf710beb6faff9e64adc452f096308e0ca58abce6f40698e9aade28e9bc6296e99f040ae6cc176912d1ad303bde0e2185b54f9acea2738e8bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3f6c41b1a86f7ba5d422b52cc60724

SHA1
b73f9edc227863b663ab071fee2bdfb8150abe60

SHA256
5ec7fd537c95cb203a7047dcdb170027ff12e06b8627e476d07dfb0f3c6d38ce

SHA512
56feb717f561fa69dcfcd9953b0d9ece338db03f7f2ce4a81e87fabbc03d28f7ab80f2bde30391c3ee47dffc1287c9a321b093954e1f12012de9b3022c31aef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa982f06d038f7c4f4541b3137707d70

SHA1
662216ea72a99d290b4b7b0487d43b9ddc7bafe9

SHA256
ef0dc0b5ea93a14618c71cd14e98f60f0df8b9a9ddc29c84dac457feba5e92e3

SHA512
208e204fa4bab4918d1314e6f001ad010621056f154e90d4678712038a5a5d30812ce88f2857e79f7dc6917af34d4e51725d88243aaf8e688e2d73cdbe5d95a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7031fca0ad884f0a2cfe57144472da94

SHA1
1c7ccbb6987bcf9d2549be2356684c22ec07e172

SHA256
afd41f63b0e8ebf7cc79128397ffdaa3b414387ec36123cf4e5bee3e51c03c1e

SHA512
277b8cf72d6a94899b1f8b48f23b339b8a49aa32cc5ea4fc285f9cf067a1694e849ba89e43172a0ed6d246b73c65860560d3a733216a249c4a51105289330079

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BF0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C03.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit