be367faa5ee3fbb33d9452bfa95ba5cba60a7aeacfcabe5bedc9a71c4530d28d

Analysis

max time kernel
122s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b676d5af79a5ab0cf44e49335f154ba.html
Size

895B
MD5

4b676d5af79a5ab0cf44e49335f154ba
SHA1

71be42eb562b52db129fa79cd189b5034ab3da7c
SHA256

be367faa5ee3fbb33d9452bfa95ba5cba60a7aeacfcabe5bedc9a71c4530d28d
SHA512

6239c8a725ac3ae9e0ecf39434468ac6d67c20ae8d8a95c86739106fa86697a271e2ea653832d67bce22e444e96b7205f4581b8f475563ca2f6d4f46be3d66c7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001468ef0ac648d43aef1566da73c5a12e2372caf8b2ecbe26f2d1510826e259af000000000e800000000200002000000031b72f236bc5d0ed31ac9736307b82c84ca9bcd9ddda96bfd81174038a1390ad9000000010c8a52737f4333f2c52da344b448c91bbfa15e30cf76a48376f43ff0245e2e863eb66b5c97ccafb23c2a0d08f7c127b36b942fe522a07fdef0535dd0519939277e24e5ad2a5b72bc47d255f785c12d3863762166b4078b5e547de633dc8f202c1f52ceb9ed76a72fc27929290a257f7954bce48fb9c8e96d39ca373b2e0e67057a98528e8ffffbb6456c079b812039b400000007a9c8aee99752f5ab60fbf725e1fa72ed1980e8f805a9be4c5f09cd3a238fd628fac435c9c6cc1918a683ade766ca1cca7a70c6265eeb0b95c22351531b2130f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04c261b2c42da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410877871"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d02ac91ba0e519ecdc60e1b8ec74e8eb86305790dc5ad7191dcd7333fdf11cae000000000e8000000002000020000000e5b7857c423d1f57b0feea3e137e6fb0b19f988dbe4405a311f9bd89af4854fe20000000823c312a27ed07ff7a5aabe8b965b3727ecb15e2848d8330f263fb17a588f19640000000a20a6768ce2badc4c18face057e6756e7f06463cb2533d8a3d779a629dc859ace2f0b17afe8af30c01b018ec09ab806a7d90720622e111a58b958297443ab528	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50D157A1-AE1F-11EE-A5C8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2728	2760	iexplore.exe	28
PID 2760 wrote to memory of 2728	2760	iexplore.exe	28
PID 2760 wrote to memory of 2728	2760	iexplore.exe	28
PID 2760 wrote to memory of 2728	2760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b676d5af79a5ab0cf44e49335f154ba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd5ce8fa205ab3dd5d0748a0624194a

SHA1
fab0c7026a03db26a50712ec634d0a957400f527

SHA256
fa9678bf1ab2660bc76ed77f63a9eb2f454b51462c1001a008a25a06861b4a02

SHA512
6cf092e3cf7566e4cb41b5ddd33d73e3dc034b9b5ba752b8cd58f5ec977049fd6641146a68b245e201ab4be33aee2c9d7692fe9d8213a7e494237b330d300cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ed1fdbdf32fc0182be54a2cfa8596e9

SHA1
3bf3d4a6eaa4ec604b14cfae44e069981e8ffefd

SHA256
a8bc817090793a8756091859642ce8a0668988f6e84f070259746ec4e96411a0

SHA512
80405fbb0c5340783846e43f5bf8c1f5b261d44c02b5f82f21fee4a3e1c37dc8ca18f5ad08f426bc197fe320e5800f71b154b08c90476dd935f8991ffab881fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad192c6f1e68265faebc69a555d3eae

SHA1
ca738745c0b6eb99e8a93c4468af6cd413de1dca

SHA256
29630b9d308be9260b4d20dda5544691880a558637866594ad9fb893973117c0

SHA512
27f7d54a62989eda6539bc292fed068b2284f6eee4ea108b79da12fc525f03a525b408010b777beeacf281edc14ca06a8a362c1ab60d6964df2cf4be06d4a6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85e33e462cd488aded91fad4494daa9

SHA1
98e0d6508ae9fae6f9ed214437416b8309b0d73e

SHA256
0abec4a4ca187170eb2c25346441cf5cdb98363c44872cab43ee65a85013ce5d

SHA512
8eab96b3e5dee772955fe11b23be6bd566be9d697ffaccf97fb427ad98196136312305e1e2c94cc172ac7013c4933c479e54478599f5a60bcf228f1af4be121b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818753067fa253c700953ea617c20fbd

SHA1
0ef2041e931e87667270f7ae08df6c5407f9e0f0

SHA256
dd32b1c3378e649e828cc2fc4e0c2d4c628e27e048b93c3f41b63a32d49fad0c

SHA512
9870179d1918355228267744a04baf5f143f843c1dec1c90952abf982bee63c0e94e3b1bfdc87ba4fb5281f72f37e79111acb9a36c508e6ac9fd38b6f66d0236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f799918a813322772f5e0d88da727084

SHA1
219f237e962ba8aa2ea086c08ef8fd80c5ee4a1a

SHA256
04a65497b67602241eb15e89acaf80adb1293dc024998070052765eb4c41b700

SHA512
f71b863e9b086ee5500aa7dc99159726ad89773053b854ca1abca87b2708ff06c42ca6800c438d5cf9e2d2f447b3d0950354d2661a0fb6bed53057dcddd3d002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a120d70f2a590854992e8bfa4d80ad

SHA1
9cc5307d6551e97c1704b0cb99298cbf6957bbf2

SHA256
b88b6401232b47cee8821b49dc2bcdc5c7a000e2798da91b691bebe0d52bf94a

SHA512
cccafc01732ed5c79f4f053ab33f7f80ba8fb2a493b9515287f8f3a6a114813bdb5f620087b03595c2f4a87f7afa4a762707034fd6bec77ab14f0f5ecfd30e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e463af84e62d137b077170bce87b27

SHA1
faf19e1924549d3f6581945980115ca49866ebde

SHA256
fb50486a56dcf3c7dcaebcfd1336c47b751b531f58871212b85aa39a9be2a642

SHA512
6420ad4af77854f13b73350b75c35bf4949252db2170fca08b2d42ac25ebec26055978804d253e4fedd7b26702d5fcd8d36489930a24a2d007c83d1c66c84c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f6f8e7a73f0ba1a2d667b1baaf9fd2

SHA1
35172c195578e1c62420b899c95ae857d741528f

SHA256
b813ad6c45b13dadcb8031a8ffb62363a40953ba84627a7761e2aca9974c88b4

SHA512
ca96fbcec7e51675e07bdabada8d8a5d7fa6ea78e53dc111b17b398a3635e4426013d697ee960a8ce1f70ee981541708203a148817a68cb3039891d78f4bd168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e7f5a328411635178014b36ede244c

SHA1
ab3b3e534765151bf6b42db1d3c545e7e2f24d86

SHA256
0d14dfc7d2a788a62b08c279fdef3b802fe01968e7927513383041bc2dfd6ce8

SHA512
c49b981bb6156adc2fc951b22e1ed511d844c2ec93dd69d3b782b937653b8dee1027c27186a0ee9c43c0e24aecb49321974ef936d3f104fc0ffd03ef324c198c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cb564f31791a210f208233ce473431

SHA1
8127b58df68f296edb1ec9d51a312ee0e9a79b57

SHA256
203797836a4a49cc76c9a79650ca32bf515e3ba64562d43651db4617580cd469

SHA512
07aee28eb3f253e0f5c930df118093224cdc79e008df492a895b569c2a182bcafe318b98d647049dcfab63d32160d48183434eb5c38b0fad9ae80f8e8f8c5873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a02527a4073ddc4889684ed7c1ff303

SHA1
d36aa7f751d4fb5e46e9dd6b33c9d9dc3edc0429

SHA256
19ed4b2fd74bfe8657f4b36599ff5d397efc05fc946d52ed28770df6b4f3a754

SHA512
e0cfddcd8bb98bfaaa0b265982511ccba26b85496d8368444f8986f2162e1f137f2434a042f2bb0c3de8ac8e5a5b11c082bab7e9761c31ec6a5226922785a951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33121723481c5d0b9fa7dab2ce874f9f

SHA1
846fb9fa5efd8d754cbc30177a61455d21114525

SHA256
f2b2099c68191ca68d6ed9b2dffcc5d161a45286c4f858ea49a9613593d4566b

SHA512
5c6c54efa790b442d9ecbecf0e336ec1610b7e2f6450ba16c0296a3bd69fff56667e0ba81c30e4197439c9bc68385ef1659d6f2f8d6fd99d8a667fd7cc479e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d855f6b18b682f4f0c090abea6a45a7d

SHA1
8463bce6870f131e73f5f4291dc4463afcdb8500

SHA256
14c5ebccbb6a260864394dcc0b0b35dcea8d47f89a11a3c61d53dca32b0ffae0

SHA512
32c297ec3c1f2b14528fad33baca2390d3b17a4d4c4c7cbeecb5e6e6d4733c9561c80485ca8aa9bfbf58be49a4e839b53d563486a827dc9562628c37c7907b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\d151rer\imagestore.dat

Filesize
1KB

MD5
15d667f534a9a8cbb5b9ff8be9cb01b3

SHA1
8616b719ac6e6d38d36a3d0bbc81eea7e5dd0a2a

SHA256
10162cfd3ecbfa5a37605ec81fdb10ba4b20dabc58005ecfd706d3cc98f09b43

SHA512
a29b928f4ffff95a0e7155dd0da87c5dd468d44621c6c96149e78469a304ec75239ae84b1f0e87d16371322e5e12e0e3d77a46f05f6cd8b6ed119c9629884947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBCC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit