577951758bdd61fb178d5919bc545c39fc7cd981f4b37871a42e1f1a14583746

Analysis

max time kernel
139s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ac8cffe6ed90bea43f58716083c9670.html
Size

29KB
MD5

4ac8cffe6ed90bea43f58716083c9670
SHA1

f59485cd0728a0e8a2d4b08eb38391ed9899ac91
SHA256

577951758bdd61fb178d5919bc545c39fc7cd981f4b37871a42e1f1a14583746
SHA512

04a9f80bd90fd5ad371c95ebef4bf911fe67d3c41f4422767c1e5d6b114e8d5dd76bcba7332abb2a9b29fc1dd074afbf074c0d2fa161ed887488865616cc65a9
SSDEEP

384:r9kWlNskpmHH9ulTXjdGxByIDlujjH8AfTSI9cDASxbOQFV8oJ6RBO1N/4RNkXtw:1Nskp/lxHvL0rxbOMVlJEw4Rv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908489b40242da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410860060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d95b2c6f0ce7755d155b9e340ae4102e91a7c5fa78bff164f57565d0737e172c000000000e8000000002000020000000d2f5ab8eca7c1634c13bafa1ea7b393226b0660e98bef46e09392f0565ede0429000000047496f1e8f26df1af2c13d15c486dca5b6983d8c1d02630811e5460b78fa19b245cecb5c5a8f667697e291cc1d9268d1e790086e9f48ec8df8d63e425b321543e9b0f238044b129f8661cfe09a6eeb165a5e054b6614d1f437df661c76aa35642b46c68947b25136971d186aeb4640c0626256f696a9132de7a4af1e3d7c2dc122b9fd8e6b19fbd4eda0a9252b1d032f40000000fd2226cf00cdea13683e2972ed00cf3ff335a0146ce516aed49d5cd46d05ba9c10b33e0355fc5a65353af7596cd74544e945126f507c7ccb2b8593f60d63979e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7183241-ADF5-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000bc460dc61cb3ef3a3b3f5bf12225e6bc5af6da401b2135325936e443b285458c000000000e800000000200002000000054d4bdea2e876c8a3e31eddee7cb08404c69fee2c9c31750bd090e0334781c1620000000d8ff631f51aeb3c5f7fe8652e48b800a21d62e838558267b359fe99b39325acc4000000076fcbabc135fe490ed15ddbbdfed6baed450a28a6d5b12550cfc0538881b0ca8f118d63192bfc229250bee77e3ef7fb4756c4a8eca7476d1c24032acc1d039f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	iexplore.exe
1200	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2472	1200	iexplore.exe	15
PID 1200 wrote to memory of 2472	1200	iexplore.exe	15
PID 1200 wrote to memory of 2472	1200	iexplore.exe	15
PID 1200 wrote to memory of 2472	1200	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ac8cffe6ed90bea43f58716083c9670.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71034a573e69b941ed0fecffdb65f8ab

SHA1
1d1d275f3d4dd87d52311f371f118ee54a340100

SHA256
e2fc8387a77f781154c920ef09161585f8e08ee1331e6a3c4e6efae7553d5a8e

SHA512
90fadd9c79fbcaa0127656d52a28d2185fb225103cd0e402306803b676006080e0f353ad815869f6c8e2e9796fd24e83984b6dbc2459bc2100a1f182d79c068d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf28cb9b9b93ff55040d81a9b9e81f8

SHA1
6d89f89b5f5e2bba24c65f3b0f35def5142d7f7f

SHA256
cbe145c6da1dafcdc9e50813068aea010722b6ca802d617c2eba8b785aee5f97

SHA512
e49d715bb7778a209472c980a07cac0e9d5273c2e7db2cf3bfce608a544ce2c4eee901cd6d299a2100bf2c482900069bfcfe6d924ecea24a688ddfcf56c82509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c5b1cd91d1f78a3fb4a5445e26a493

SHA1
528525fb6e46d8a4961abc2968e6c1e02cfa4bb2

SHA256
811e7112b93150521c1dfed2ad8b39134984bb1ca1ac1c5b01fb37aba6932d6e

SHA512
2a1efc7699ba394880b535f62cc06ceb24faa54f7fcd7fbd245aa8d19f896eac6b5f182fc56d0d48ff737edc27c1042fe1b8af3a5b73abb28aecd737945d9077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9edacedc57658bd523ff977cb6fc97ea

SHA1
9f9223cfc94d2ad1bf1c5b10a9f068d2ab00cfca

SHA256
84cd3cf1fef1a0f16acd52ea53fa2ebec2ba641be9ff59112bd6f4284557f813

SHA512
0237f15b707524ba33cbda5b0ed7e50bf13a2ad07d5cf012a738d6df3264b3b9c71730f6c3d0187466f1487bda7f7b4e5a280d2bbf517b7cd286ac21b6d35f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2ec352db1c8ead4c05e501a5beaa222

SHA1
0445f839ac63382481c2c0e14443db98aa3620a6

SHA256
47e0cd2e90c605e6021e08feae7917ed1b2d31aa66910df6053aec4db9748666

SHA512
50c442d54af3ac2e3aca144d88b83094b13f2b62de7f4f4053439bbd02c5071ecc1e90d67266470aca07b7120410282d6474221d74c67cffe70c67ae662f941d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0ae8202f95f1c418a435a9dec083548

SHA1
73e566ada73adafd8830f86865cdbaded20c6f3a

SHA256
45943fdd464fdb57c447a843c50553de2fc3b584cf377a0c2c0124d5c5131f25

SHA512
4144a98432190ae17cafdfdadbcdce679660f627ae0d8dc8375a4d4a62e5238235a5f2b112922da29f8a9e7ab2c012efe96c80844414448f985c8bba6f08aa2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db431cdcc11e6d77f5689d23ee79292

SHA1
e57800a4dd574a722f7d411f6019de195e4a7e1c

SHA256
c0a9357f2a50ef2ee3952fd951b687c7f95ec8e7e1f95cd5aa4c745b2051bdf6

SHA512
91fb8ef3728a0290cf18d0f4ae0dfd53d09ceb9910b0cc1f98acf491870dd21e67b12ea335e435271d814c6c6c59ed3ba77697feb1cc7af683f98f600c7ff358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc6e1b62fe568042e99d7a5662e4e49

SHA1
4d8486c75b166b21b85999063378cb81321b09f7

SHA256
2c73fec799e01ccfcfc658819bfdf36ba9828a854c7feb43a5fd368d1c8b5300

SHA512
a5f688f466837a76eaf6e5aa193e6fddeb16cef362898932e7b8a8f7fbf956991d585f4b78ddcb06b0cf02c1f399d93f21dfdff94ba5b1c6259cff046e1203ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf479820513d15673c91c2497f1976a5

SHA1
4b9a7302fddccc5807af09a670870c9dc08190c2

SHA256
59a8abb7fc645b834898d9b4ad463fe360a65e8baa24dc0086e2b0335868fc0d

SHA512
4ada4126ef8661f7077bde3954850991b339e021eca23dac02e37cf39497582cc0fe0975cc1df3a260d07792a52be7ab4a819bfe9bda2fe8f66f4fb503faf982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe9fc2d1e05d2bea61232678d0f82e7

SHA1
d29667e14543c3a9ea640e0b6e67176c5ce0fdf6

SHA256
b8926071a49fd5b8a2e7990d867654fa2cc90ef416cef1bfa69d89e264d48852

SHA512
6cc46c81031970c211e2fd9cd4b6169bb33107a009292284de9b07802cf0a78caf7f5ae34c84f063040f0defbb83454a76f3575bf6fe39c59148a7edd5830c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f9d567e8de78cddea299439b9b61bad

SHA1
a262b2b32b6a5aa53f4f797d49ffe30575f65408

SHA256
f83e7bfd1d764a8dea31f8d455cc0d866beac6420ceccdfadd89fa2bb76d09b3

SHA512
5261689de0122bf1ab76aac1e0638eb31f6c8671e9b7ed3f19927040aa1b29968afc0bc6e62e4f89a7dc26bf9e4940625b744c1661f7ce1ffcc08021931acce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039763955f81d8ca3f1fa0bf2fdf32bf

SHA1
a598a0376af41734ad948b189f90435c538c39a3

SHA256
474e604f120e02ff86b7deb7ef21210303730b16e451ead0f27f0b9900144207

SHA512
4ae3c5f54b3145ef05d61e4865752787d306316923d1fc2606e1ffb7befecff6b4b432cd312d85302861cfcd880412931273115eadf18b06db1a8a8d8f5a6161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9975bd7a8302308aeb2d63071b234d2e

SHA1
a6d620cf99a15e454bca7281a926f911ac3345b8

SHA256
828fca7663f923682ea6e8d1303452777dc3e8a45c1235b4b5def6941fa00335

SHA512
8a75a2d30c08c53d90f20fe530d320bef54ada59ef0c8f7595162a713bba4036ab3f862814fb4136befb0cf0af15a076783f11545e9fd176ef57af8f48f422c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f0141d02bc3c987b90608d194d2520

SHA1
376de0a867a07626b61ab4791bc7bdbbc0387bed

SHA256
4380de19b15e03c8eae50f1a92f99f4877d2f286733e9e9b3f4be7ca8b42246d

SHA512
4df895b51fd1d828d41131b5facacd882439e151326780d8b8fd7fa6d8365a4a81c91d79fa3b52d5433bafe805452038a51dfd82ccf684c54e30fe9ca643da8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\f[1].txt

Filesize
34KB

MD5
1e960aece125c5244f53e3241c12bf7c

SHA1
5338ff2bae5a4b53e533862a118ffc95aff38511

SHA256
272c3726d21538457b6d3d580760f5e5e1bbf9e6ec99a785339951e22bfed6f5

SHA512
97f91556feb1fdc702d2b860068b78eabdcde261a608036bd7adb39bb72262e17c4201d58cabe3ddcbc8f4adf02d55332c2d82efb9d7c0675c76041d70487c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BAD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C8B.tmp

Filesize
81KB

MD5
7e0f6271420b306f4cba07541d259606

SHA1
694f0edbf7c8b1233bc7e989aafc6d5c8f92a2e7

SHA256
4c5a6ea72e7023126d430ae6eb08232323ea03ccba8137302886df13ea9662bc

SHA512
587f77c694e07ff8ba525d2c962cb8b993a611af0bb9dd4d1793ccea2e81885d0559cf27193adc1ec1586e4db702b5d4e1e01650d4f173fba096a9bff035be97

Download Submit