7c8331bb5f7ddd2c1851d15bdf59d9f209a2499d73f962029851c50274749c60

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b094df5d1557218c8c67c7c9e10252b.html
Size

71KB
MD5

4b094df5d1557218c8c67c7c9e10252b
SHA1

5019029bb998277cd28461e013f308550233018e
SHA256

7c8331bb5f7ddd2c1851d15bdf59d9f209a2499d73f962029851c50274749c60
SHA512

fa3acf0e1f51d24c66032cdefd0ec89980f7254e6dc538f8b83ad3bdb8e3749b3f25bf255945b37fe80d42b5e79dfd4f868d4f4825237575875181a6694c5164
SSDEEP

1536:/FDm0zX5fHIDCAV8dESlxTJyQ1sWKDAWZkVi0sIFz:RADCAV8dESlxTDKDPZvXIFz

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50325f4c1342da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e25da8afad40f50bc2cbb3dbf602618d9d024d7d38d21217350364bbd62a34a1000000000e8000000002000020000000719c231e3993073d91609640a4da75c102daa560ed983fd6a78692197d09beb620000000ca5bcdac56ab04fb54a6e800db39b1b67d071c3b84add205e555e28c66b8576d400000009840a962f2a42473c54dfe5d5b72701d5b81dfbf6ef01ce5194382114bda001a62a371d10f7ccd8cd4d35122a70fe182748152027c38ed55d57c4a2eb7a63f37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B463C91-AE06-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410867184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000abe9101c9690d2a65c4ebaf9eb88a9e3b27dd860f641473b46142d8fb10815e9000000000e800000000200002000000009dd96d1f4219faf0598c8984bac16e0202251d78105fcc998515477d56fa23190000000741916f55d2af86380e584abdd163626e376634b31a828be20084ca38d109e715c29c3ea228583ed90beacd2fc3974c81e4b492cd3b58ccbb98fc47c3c0a3d64a41340b38d56d7bcdf6e3cd5fc8bffb087e24aecc5b9f6740daf4f93adfdf7dbe62864d327185d5bcd4e51127b898126d153f60abfa159af4008e379e0ac61a2ea208988260b0ad291e3e28e60e1a9ac4000000007ef59fe6130875f6ff6326a1de8832761466c78b09ab7f6a74737d79e1c0f89d59fa105edd0b0f3332af72d121f0cad2c2e77c838e0c088dfb367e518962930	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2692	2456	iexplore.exe	28
PID 2456 wrote to memory of 2692	2456	iexplore.exe	28
PID 2456 wrote to memory of 2692	2456	iexplore.exe	28
PID 2456 wrote to memory of 2692	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b094df5d1557218c8c67c7c9e10252b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c51a7a36e1af98668d7b631c382c9d21

SHA1
32062ff9bb9821eb6bc3a6e0d280e2c0ee19f827

SHA256
a7a9ce434a7cf4d5f885ead51fab44ee8d324a013834bd88b26a86ec3bcd7e6f

SHA512
b2d4c34615b51eb9c7c35c77a39d67fbaf19c3527bf7a9c36bbb487d951a4c924f71f8be1324986b35affaf1ee9d5d1b6f55d806ab682146ee7849c8c3e6900b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d15b26e5cabfb1779e79491f6cf7ebc

SHA1
d16ff0265f13997efe4ef8a1e1dc2ae27c08ac94

SHA256
30f2506865012fb3fcc668fdc6c9ec2ae228138a4f21c54c723e11c844cb2c4e

SHA512
6257ce64b9ea7eb34f60dca7632d8cf5cc94ed5dc17d77f5f4a820f7236936c7edd0bdb1eef2b8a39bb2b1713f48cb616d39ae7157fca190eb4fb0a58d4af7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a81d3fbb64bee04b41403a4cf43e51

SHA1
7c5ebb560979a54004b744ce4252fee591a420d7

SHA256
430c8043dfce9ca9c70497c41badced9c354086ece31595060646d802a8c86af

SHA512
c18081cf5fd0e4e133ccdc4a97396af93af4f1c9904bc18103a267a86219ab9aa75f1ae7cdeefcc3dca104a0ee4f6bba758d5af20ddd7801d8feb8ce855a0f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f508a3f6e7a978b1068550af79bba4a3

SHA1
e56538fb57c7dd2a2452a8c21536d384bde92e49

SHA256
6295aca9108ab6426d94e9b58f8e413d5c7991a4753f259ccbf3c62977e463e8

SHA512
fcf50c86b160dcef2103e33e6618e2541fe9e2d6affa2135c5f1c246a3b426099730f61d04c17bd5d2d2dff2d83bf69523cd0b7021a83113ecf283a92789d05e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f6497fa891ecef446170981c280f2d7

SHA1
eb6140d7c2ae02423c91015b32de5cf9ef06d8bd

SHA256
1004fc7d3b46964a397c53489e04e16d25f2d1d36ea1f7a9a18614f1e6c80548

SHA512
4f8de11ec8ec70a41ea19c0dbfe80ffba529412c33586c93ae75d2085ae30b85ee79a9b82880193e879b58538cff3a4706d8d5582d9378e1dc17e4272e96ec7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
103862892d21e88302b44a53b8896cdd

SHA1
43d39df4267e246f0352d389d286c7563725e529

SHA256
ba72e1ebe2e827717646f42e0a1442b479f92e5dfe33eddae65de76495c77f0e

SHA512
af6dd940d91a678abb119ebe29a69924715487aa1c624622521ac28b0cb9a6881ff1f631adbb028e758059b84fc6bae129c7d1e2ff2bb67a44d43b974461ae56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebc25134d83516461da48122896470f

SHA1
92d533ece5cd84d1e4c20d2e6e092ac402309298

SHA256
e0ccc65beb562111bc6e2da7e5ee26692f81a2dd9b99bafca83f3c81f1a4a016

SHA512
6a1037f16affb56f761fcf4c7e100eae31de24de3515d64b1970499cf36c17ebda3844c8ccb693c43406ddc982ba4171856fe37dd6c1c06be9f97c1f66bc1d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a379be1c223e89603eac563ffb962401

SHA1
5046692891b927d46307667a57d127be78bcbd55

SHA256
17ff09ef75c77bc1326eb013b66b4c845191ede1ace44c9a22c49b91156fadb5

SHA512
5c91a7dd1a55e8a93b7c4a13b347cabce5c28a9e9b95ed2dd20c8dba049545486bfe62cb81a423323edc9367451594e44019980c0ff138bb767c810c6ab2358c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195a6374678012c84ebcd63b3c9a3cbe

SHA1
5d25b2fffbf969c1dadf1779f3459b9762f12d20

SHA256
a9620600503af83f82d6f65d7b1282bfb4132a4636f42c5bdcb453f1a4f22b37

SHA512
e43c84e50d7595e5e412e2c92dcb6f54c8c8c862b86533001be96b9d9b8fbb5b5971ffffdf28c93803016f3ee0016b7ab9b181a66a9d35e5844220a2d710343b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437ae45580f19e72ae0a34fb40107ffa

SHA1
a3c029212b0b96b6bf978a1b319583ae4fb81b05

SHA256
fa3feef28d9ae9f3335d664fedc25fa2396e337dd1a9e82975109eed43b6982a

SHA512
0e111ec5b79a09cf22ea8c0da76aa5fa52e9e3b061b6611735c7e4f359ac36541a54e38329c3b92eb1b1765b32c16f50091784727cd9b3a7022cddfb144dbe05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f70e0725f09e8e8a1ebcd025c626c8

SHA1
88bf077939016f1c23a44e129ff118985fe99884

SHA256
58cc923f4902ff28721593b271d50753e93e30723b9f8ed5c93ea88a73d13d8f

SHA512
9d67e8f17222230c9ef456595597eef74f5cd1e759f37f262a57e8e2496beab3cc9ebdf7718ffe1884952601c932a20c72d4e001b695245e07f79c86f5caacd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA91D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9DB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit