e4bb8c54cb6def08bb8e19375317d80e710daf86fc469a181633400f7819136f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5ecf8c68b36a0c173795c88693b3c0.html
Size

53KB
MD5

4b5ecf8c68b36a0c173795c88693b3c0
SHA1

850599592418f065cd75dd59d89f233cdf23249f
SHA256

e4bb8c54cb6def08bb8e19375317d80e710daf86fc469a181633400f7819136f
SHA512

e4ff28f09309f4b91207eb78f706d6a1517a3034d8a5caf896d23d9672362c24d61f24abd0fe758e881eb9f75da61eb6e66ae9767f6997fd41a066f444810594
SSDEEP

1536:CkgUiIakTqGivi+PyU/runlYE63Nj+q5Vy0R0w2AzTICbb+oR/t9M/dNwIUTDmDY:CkgUiIakTqGivi+PyU/runlYE63Nj+qD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3766F921-AE1D-11EE-83C2-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a3a63a2a42da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000415f1bf06da23992765b484ddad6b2c244f60b18a4e181e6c03ebeb1fb1100d6000000000e8000000002000020000000ce7303cd2aa8a0126cf2bd6a4abf72783a147eff884194c0d992a0de9592d2cc20000000bb6307babced7fe78967a0fd1b1f9907a21088c4da68173c8a8e72030aa7079240000000e536a315157e0d7b8d7eeb7c3f4dd971aa986fe44b150640b77498ff2f3ff603bbe4805365a28ff763b57290d92d8647189a9b5ac636d7301ddcd528e99106f3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009fee096e918e3ba402c46a3b51b7f4656e5c34b365a504e2b686f3e8037666cc000000000e800000000200002000000051462a4d1ef829fbdba03b49fd2540a419a8f8c7a06515288801b884f09979cd90000000a7ee8ded39f7cd3622f9aa14f6b7dcb473f38c2944d90cbdae36827d12e86b56d253e3d7c8397234d98af4dd3cbe5a866f71068d4b2caefa20bf8013b170d0e78bee69226b37c1b4b4c69ef99b46ab0131208e41b8d5eaf2132b7186ad9ba54751541671d816b47ca278446990b2d6316504cf428929221afaa73c99254fd77c7847778bddbc3446c47f29724918dc7c400000002986245d9c2ed0accf32aaaf32cc1e28f06d5ad1de33f2a06fa700b029b506adb4a577c6fc496deb860cb8ca288fbb2dc4535926abdb355a6c5c8114e017be4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410876969"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2836	2080	iexplore.exe	21
PID 2080 wrote to memory of 2836	2080	iexplore.exe	21
PID 2080 wrote to memory of 2836	2080	iexplore.exe	21
PID 2080 wrote to memory of 2836	2080	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b5ecf8c68b36a0c173795c88693b3c0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cdf27a3c1b7ba97d1a42296c8b0300

SHA1
b741a904acfe1e020dcf53886e43187b4509be52

SHA256
710a5fe73f1555249af21f763909abb5548c0cb05f47e1d617635b8ea82c43f5

SHA512
6112d86acace854bc13ad867f9d13db0744563c82d45233978828fdf327c8e68fde27fc131664ce9f20441f55c1eabcbd1a95e47e8afd6f24be429261610bde0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681dc7709e9003aa37e70a69ce99886e

SHA1
6364b081c673e8db7f3aef0107d9d2f29697c9f2

SHA256
07751a402bc08d4b94442d8870b74c3b90c220247277b698da25d369075a1e2b

SHA512
0e40a6bd4488294dd4f041c9438dff4cdeeb0c20d92c949ddca74de9dd30a1f9d8b909deb11805cd420638f17e7277a604bb8cf942bd1dfc4c24c324e1ef08fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e08fea209b501dae6b71e9a604e0253

SHA1
e2657ca56c3d33eb51aad0a6894c2a6446d9e5cc

SHA256
605b8e2f6ba2c6951dd0aa28816877cc53d886034566faf84c9c29ee5f6aea63

SHA512
caca3399621d5a5baaedc512a26accbd14f940a42477084ea881b5474e776031de438e4928c100fb24b8d0614fcc06437a797fb722385d1db5152856c89f3b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04f74535dc5dd86e280e4abae75aa01

SHA1
49e058a021a9a80fe15f01f2d13f794a0b188d2a

SHA256
63884138304b6db87308b5677d7d3f446d0cd80af557dcaa940ea41048daf645

SHA512
ba310d840d53c2294f83949c4ecf5f7d6db34421a641d0773b28a2e35de3d15dd8120ea8d5b8d27ffda6d474347a12e5db1e6e7146ed5534cbaf44590ae91641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c5be0078bdf1451e7b28b7a1470f44

SHA1
852b6f4b97973a4877018fdc758068b262da8dd7

SHA256
6b4e6953d3a2a1c8d561322cecd37b87bff040df04974a8626707f64163e8754

SHA512
d29beb85d3c7e03a1996414a074db31137c0f56e2aaf1d9c53150513dbdfc611cbc465ee685a16dac8b1f1a2df556bc48ef24b06af089f3c8e99213c5830e3b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb54e6080de76d1ad367772758252d97

SHA1
d3e25cff93d0807f51788ecdff44b789c1d33683

SHA256
9efc9f16b32ee8d74b6a070c63a62105268f1e9a14e15c47a9b30ad9bcb94d8f

SHA512
9f941f00e61da2d3a1a658dc94fa3d1d170e1bb56b62b6bdf84f7326d4863ef9c3d08a86c1cdd83fd07f615f0fc63df499f3a00a4d40e20a31b4b43631b541c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c70c204f24025497c8a09924e30e28d6

SHA1
918294c9ec8a6c27aea8e5ced7e4f065229de485

SHA256
6b22c8d3aa17096abfc8807d8f0a3d1bf42398bd7319093e60d9d5c41049386c

SHA512
7a53eed66b8a4b740c16e290b318f345aad93bffc17fb18b45d955d1069fbd69340749f2c6178c7d69386e9c8147e97be231b6419fbceab138731d2921ecba1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ac591981b8480a5c440033e1c240830

SHA1
bbbde8951bd0c4057fe31451d99a1faee1cfde1e

SHA256
0963066c5c5f08237d6840d0c81bfa596824d58b9c2a1cd047170c4bda12910e

SHA512
919bd18f1ae8b5915b954857b2588bdd7a69ae2f928d3790fe1bc47e96c18cd7e731551b746c29553b198147c3c24fef445e21d15ef4224e0a64df9845b24f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4451.tmp

Filesize
17KB

MD5
ec900f02235a3dcabc4f91f82ff380a7

SHA1
f74490ed0d5030c03cec2ed6060dfa6490feb8d5

SHA256
26b043c670e384e19407b4534ee2b2872c107c685ed85f58d2d7b2f6a0869c52

SHA512
ab86d64d27d839dc788b296af3bd4aec30469dab3f4040afaeb6c21a1fe54258cbc6698842a3ad72afda0fdce04cf0ee40addf47aa628bf2ab239b36f566b95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar461A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit