7585c0e6ca719136336e54e01d69e91448a2db87d5750357f6fac2c9b350f4d7

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b9076fcfdb5a4866a763582b22bc6a0.html
Size

37KB
MD5

4b9076fcfdb5a4866a763582b22bc6a0
SHA1

f3853c265563832b294aad8bb494cd77e1e6caef
SHA256

7585c0e6ca719136336e54e01d69e91448a2db87d5750357f6fac2c9b350f4d7
SHA512

a689eeb9214c94b7f1e18d61b5eca738d62c71b3b79aa7a96b0aca2fec3d6a1e86c74aa206c47811aa37a3d14f024a388b14ef797e41a7419a76a1f59db70c2b
SSDEEP

768:1b1Y9+acrAGrzhOBfifBOKrIiCKjn109N6YOviBYiFJPVwOIQnL9FXB84pl1Oh42:1u9crAGrzhOBfifBOKkiCKjnm9N6YOv3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3F21571-AE29-11EE-A038-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d56ead3642da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410882388"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000005defff42e21422b0b33c6a989a37581c8935df960467508936dd90729f31c9a5000000000e800000000200002000000094ecbd9529530ba2c2f84ffb9b5cafefe54364f2e3a8b2cbafb4aa8f8fbd435d9000000063d8ef53cc824872f660c8c8b9256e650532121d7eca06f8bdb4b9cf6c140930e409e5c8812e06a3918bb41fd3935d7f02e249571b0b4a8a2cd005f5562a52f1a5cabf111fdb84eb029fb9c64ddf7534288979f76893d0525802f266cd0f777b391dc5d3d273ca36f74eb8495058f491e806aac98aa5a989a55420c86b7675e07be8b77fce01d6af6c94fe70d454d5904000000049a5db8d7b3d9a8aa30dd9ef7ba623a6d63473d4b69286b2a691b6a68c4115d57366301be306e38b2cb08cfaa6fde35a9de0a899704cbe0f77998d847ebf2ec0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cfab9c830ec7bed03d0c2115b0c7f29be0714a298d4b46f6e9169ea1dd1494da000000000e80000000020000200000004ea874cbca14fd241e57ed23a6f80437fb679d38862a598c14aec8507cfe199d200000001e5ee5d5381879c1e0a6e0424e2cb5da6061a674bdb1a414d2c5caf9900d6746400000004148d1db365cf6f62a65df0fdceeb02dd535dc952890ec047cb74165d9073e3cfcdf02af89866025e654c270794a40d2daf289be99b84fbd526cd9e3319704ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2784	2420	iexplore.exe	28
PID 2420 wrote to memory of 2784	2420	iexplore.exe	28
PID 2420 wrote to memory of 2784	2420	iexplore.exe	28
PID 2420 wrote to memory of 2784	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b9076fcfdb5a4866a763582b22bc6a0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a6bd9ab9a5288cf8be499df20c156a6

SHA1
1befd3bd20685cc3fd53c4fe6b7928241fb48921

SHA256
46b7a1d65cd0ba2cea5142c504b5acb4d44f0834b0a4401cc402d738949e4429

SHA512
d75746364baa5f1625599a9092d755aef39fd33dbd0893e387984e4a6f25d2a4fd07a553da4138ffac8d5c7ca085edaccb25204c41ff952e9ef3ecdf3dbec25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
966f49194d41299d21806db821780cb5

SHA1
79bfae4ad5f17b047db458ff6ad3216db99c2ad6

SHA256
6c2bc5c42fec815872c61d7aaa7a16f58923237506f3b88c6a28b6690892e8e7

SHA512
2a774da23f92474cfe92b8b7bf057a22c4391359c5117081c643e8a3833264ef5c982d7dbfd2824546a87eb7e6ffb33a4874313e687e38925cc2e669ea0d1f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d1fb24a0c4220d4e553a44ba3c42d3

SHA1
46983cd0c5e199ded95ddf3a6ef37827d0b15dec

SHA256
b29ad8c1786a25e9789b3bf3ed28249c29fce2cbad803b9c4bf017e038370e74

SHA512
b7c5c6c58ee6c5d678693e87b4446062128628599a210ce4d2c805b0fe631fe1c04d94b547388f7af8dee77af43f559e3b30cdca7c44aac55841a8678fcfb96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c59d020b00b9ca1b20d38079eecab6

SHA1
bc7098b8056edcceff0134051e9fb55d9f0845f7

SHA256
2b328f3b69e88b9896b26c546715da5516cb84e93a9e2bf8dcc48d00c63e91b6

SHA512
d6a5c9071c86171e389deab6e1752d4f8ab9ed59fe82a24a45496f4dd33054508bde17cafc4bb62c0ccd25dab7ef96732e5e7a532d7942756c4d7071c55e237b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58ead055de18b26676d04896eb49bde

SHA1
08ab6261519bd858ec4d4ce9b1867f2a830cf744

SHA256
8bd54200a331b2a080c72f1aae8a315d35ee96c7a88b59e6c7589e9e4f1a2142

SHA512
195355e48873fa831b7bc451fd93dfd324b7a229c702079a54bf3e6bb24a00c27dd900d8dbafbf1647923237aa46588b09ed81080ce34be87d196b327b8e199c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB406.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB783.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit