ddac2f52e00c11f371507f778f6d7e289e4b2fd1c817f4973f43e97428f628e8

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b581052472ae0c8046ee15c83c457d0.html
Size

25KB
MD5

4b581052472ae0c8046ee15c83c457d0
SHA1

8d47b29554567fe802d4bce256bd0b5ec3c952d0
SHA256

ddac2f52e00c11f371507f778f6d7e289e4b2fd1c817f4973f43e97428f628e8
SHA512

2cf0059f602a916985167db8ee84a4279153913b9c7d552a4117be393a30b385d0edb5fc375bb9d7924cbaba3c8f7f64a4f2892fe93b3bd624cd1f2d45b98523
SSDEEP

384:2dg2H8oOMGwiLkKOUtxKTeBfKTpN3p1JaeZXhLgWQQ/U4yhoy7jfIWrYc51IlSAL:Qg2HlOYaltITe0H5DDXhNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d2a13c9bee6fb51e9de7172a81c312f27b84b3ab76daf4cf0f2fbf740997e817000000000e80000000020000200000006dded891904f2624d18f0d147289af4f7942e583bc598c5bdd3d5c0ca6f99fbf20000000afe80d051626a02d99376d2839de75ef193842182de66b2467165d7330c159b8400000002cc88462d28a5196560c8bf1b911e22d4e399e969d0d20b7f00e89ec3bd11e5859ea2b0b9fba6adca8f11d5a2157550c485a5c99397f8d2f705d6a939225dec7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410876185"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40611c382842da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000001b7c7d314e1ba2789c485f063ac6dafe1be76ba2c035602ac4953f7bc0d9dfb000000000e8000000002000020000000b43811326f2c04dc4baa2dcf45f7157d9c466140318b9189cee1c6ac3d358ded9000000071fb4cddb1114e5769e7bedeb7d6e844080e932016f9f6570a24198c9eec2fd8ead89484c608481d1395332c5df1ed2a89ba465f8541c16f9bfb3bae952947538844e7041edb57b261702374188977d8ca699eaea4460189fa183915a12c4d5ca5c37cb3f93c97885410df7df0d1ab3fc0b6ec3a233bed47b84d6efd9115c94a5b852a2b16f173f68befbbeab041c19f400000007014a4c927548ad7a890ae2ac4f9e882cd446d045db9b36c9d6072544567f9c3b91af98eb971feaa9db475cd58198065c226048a0726461f112a177446a4a36f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{633FCE21-AE1B-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2372	2672	iexplore.exe	28
PID 2672 wrote to memory of 2372	2672	iexplore.exe	28
PID 2672 wrote to memory of 2372	2672	iexplore.exe	28
PID 2672 wrote to memory of 2372	2672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b581052472ae0c8046ee15c83c457d0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f040ddb98658277b8ffaab1e754fdd7e

SHA1
6b8b11b6c24514ed019a49ed2b95aac7a21c467f

SHA256
ab5da774f3e9bc327bfa427856a458962709655df914ac7d9da65ce79e06a436

SHA512
f36ef878419cb38365656d9aa3cb7a14ec0a581b415354ae3532242a5c0ba8f498dc9be7e33c10f4595b09fd5240e1fb5811c9b97409e79715b10e2a9f20710c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b79b383b42432537c8c79a45b29140

SHA1
9369d32caf29ab20e4139b2e2339c064e0ab4918

SHA256
6fbf6ce5a67b8e29a91251941972e6bae7c2a307639213f556d6685570857693

SHA512
0947c427a192a1e0ed35212629ef026b95feb8bf61d813677d9ef0bd7f02e7292e0f501618eb12480d4c27c3c6a3e09d562c2a1bdffc8daf02ccffcd424abf16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e60a83218dcf92949bf64785e00a9852

SHA1
3363c8f6006aa3f7a997ac5593e7ad9a62bc5c99

SHA256
aaaec0af27c685313e95e76ad1a2bcbe0e355156f23641cf50bfc66e5b1d6bf7

SHA512
6d7b98b2417dc7f19f46b5f0e6f3cdebfa550db6a47016ae510fe02bfdfe54a27dbe69bd106571178c729abbdf0112fb0ba4c520350e2362192207e633de1caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c39c880fa9e2545ae2218abacf97710

SHA1
da6128eac13bf434190f9d64a4825a5e7c0ca40b

SHA256
4e1103f3c82fa90861edf654710eedb4d3403b594a7db684d98ae9ebc539bd94

SHA512
82d7c105d31ef94321d7726c08b1f0e22483adb3a95d723ba79f2b0fdc4d9584b18a97da9d641c618ba7d85eab06b85747188e17a3c16b3b040f1aa5f5aad638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f76e4c82def8566a1a76b91813aa7c52

SHA1
0cba59a8a52b63330373ce5c5c0c9ff95581db42

SHA256
00db29c47359bd2a784bf4e793bb1f737fb65a9f0f3d60dc3c4104eb593308ee

SHA512
053d8f99aa9516cd9bf84a7a68c808ea0f28d81ecc320196107248478f213d2eb47f6bf7db422241fe1cc7c99a7cfad0aa13b0febc5b5501199355e396f328fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
363d25501647674b357592f2e5cc4775

SHA1
73e95222a0c3d48795b109e2e5903b874569918d

SHA256
50b36131982abc3fbe8698090e9cbc26602c1004f3f6a19630e70befd90d43aa

SHA512
ccbbecd7c854d6a44737cd10b4ff6f5dba4a5826886722aa4995200962b7750ec4c730f928439a25b1d310f0819dbe3d9a5a65e8bd20e6fa1f99b6aa0731e23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091ada016e6f2f775f7b2432afbca3cc

SHA1
458ad54c75e7ee4f6b77483b43a51ad5da8c62a0

SHA256
6e3cc7212e028c2af0371d0a1b5d7baa3d5de87d390ee62e84a8c117a50047a4

SHA512
a5bc469670270c2c82d5e35d1cafe23ad4fcd9ce4aa71c468728a1a32d5e66cd100f29eec2b5e7152b0c1c9eb4de5abe8ddf6cd478dd6e3a46a67015c5d8b440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4970322df02f2248006b7a4999cdc335

SHA1
1dfd32b6b443a970ca17fae8ba81e29a242ccd33

SHA256
5d88edd226847457bf09ca02ec30858aae8ce8e7bf2b0f89c61e33b9099897d7

SHA512
7db1e08a5521c63a03dfc76270d5f4b83c437d581405e0350d58f5356ae75ebeea5c439b7842348dccab72ac1cdc7548e14b34fe66172881136bc6cb0a483aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d34763204d6a3b365a1ef05e3ce04f1

SHA1
eccef0f146260f65c84e2001e4ad404db57b373d

SHA256
3d57d516a68bdd5cf1cd6c3833cb83de4e6de3501366e872c07917f8ef563c6c

SHA512
f71cc61674e4f6f264b320084b38b1353ca1d51dd10c85fdd00aba6931b85cd3fb7576067c30ed70eea5461458e5937a071d6ab942c81432cbcf547cc81f4077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16aa7ffd9c4b5f8b9aa78cd7118685fc

SHA1
ef2eb93cc0c5fd81039a711f9664a9f431bb53f5

SHA256
f8d38cb999f005b78429f1209785ba522e36849b40d536bd0e65f5570d6336e6

SHA512
34e6fa77ce47ef37509decad24af84e6d70268ae7ea65a91e97dfbb3e8c2e95ccb005d1446ed606f706f0c56f701a2244565cb41ab89f52e63e0efb2841d215f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3972fcb2bad10ddedf4a71f5da76e52

SHA1
d793adcc2a2093da1f3a171b17fc0603f645eeb1

SHA256
83877c56dc98e41365e64a5dab7fe1b13abff25f54d44b32b53dc78c10e48874

SHA512
d2c476e71c99b8291b493566d99da96301092f24a51b280d673a954d6d4c5e630dad1e8040cc2e6a2e7773b962bce86a6668f13750ae8548c76f7423ff15542d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f672aed770cef0a336ca7223b27d65

SHA1
7a6dee3a161391929407a92367a53bcf56fba7b7

SHA256
addcc364600a40a8ece24beb1ac253672a877144edcebb71150c7e8d8a6c2b8a

SHA512
5a9ded5d4a4d4127af1d28a7842a277fcdca87a65fca17d11bd24b6e1f535627cf10d4a17a0acb9483901baf73de873c7f518bd2c6fad229bee1c1a5af617989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8690cd0d04d990a574d2e26b060a4061

SHA1
b586e32ca3a02e01650668fb749369dbc424e763

SHA256
d489f74d061db438dde8cd12e1c8fd644366de143ca520b4e5e7bc3ae4990dfd

SHA512
bbbd4b884109febb2f7a8ec4da9ff6e9d61eaa82d72d557dcbf56bea9a695689430992bde2ac6200b1f882f9a660b7bd547ddeb014231832c8e898df34a6cc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0076227aaa469863e6011e609282cb6

SHA1
3c8cad879f11e25394facb463de1ae15355fb80e

SHA256
b55545d396cb58902bd84a68df598f34696ea8ada367fe0cc769c91cd6e1fef0

SHA512
cbfef37689a5bb5aa0ac0ba8d29fa7ede5c5acf0138d8c5870fc3b3a2ee1489791b67add3f58e87fc94e82d490d103f4d852dc6629e96acc36fdd0b5a6facc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BFF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C8F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit