e4fb6de017048cfaeee0a17a1fff8fa093332b2f2a66c2179d48f5cf3a8777da

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb216b0562e039a3d72f4fcb028c8d5.html
Size

6KB
MD5

4bb216b0562e039a3d72f4fcb028c8d5
SHA1

90e0b8ad0623b915882179e156da0da38b0330eb
SHA256

e4fb6de017048cfaeee0a17a1fff8fa093332b2f2a66c2179d48f5cf3a8777da
SHA512

f661157561072a20da2615211b1369a9f399a6e3db0b7419e099c705e4fbd30b0475aaa4b08ed35560139282a52d6d7779d446bdd7cb50136b4625c49e7fac7f
SSDEEP

96:uzVs+ux7cFLLY1k9o84d12ef7CSTU5AcEZ7ru7f:csz7cFAYS/db76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DFAB411-AE33-11EE-A7D5-D2C28B9FE739} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e72b034042da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410886411"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005a1543c6cee0e09036d282f4a5a00eaf10692d18df83f235504e632c59acafb3000000000e80000000020000200000003bf170e34977fe6b51a9c95c78e9b3dfafc417193ba457278d18f36e771de1992000000031218308bde1956815277a88878dfd1b8cd6a550e6c1cddd845071b79a290249400000007b80ed1822463efb9ee7be908b994aad3a6299d540c06321ea73211c3c088f2629ce95c41023a521f412b7932b9dac55d9d42196f797b397876110e8121228ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000004a9604c69e2996c8545d15eff0a92cfd3ef27edd37e371945534a345ea3dbe0a000000000e800000000200002000000072df66816bc576998632069b0c68d04bcae3d6b506ff75926d98466d23a409b590000000edb8ec563dc7b7055d39e1d89529f7c3066f0f2c2a70ef9375126ca78746f1c303cba4e9375be5e5f50bb212c2b2cff6682c2f56431b226a017ccf8ecf2127da5ff1505cc177a92ec0e428f28949cd734127bc03c51cf5b412a75659cbb454dd56010a1e7c998e727b066af3f87e94e0158aae613efda75630f0de1a2d3dcd5a389a7371349ea5d476d037e51977744940000000c443667d63c96905701e199c359ab79baaf1c09ea2677bbbac3d78dd2dead40991dac1ccd53125985e4d67d9486557d7b3cd3628893cf7a450b35e0dbaff95df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 1084	2760	iexplore.exe	17
PID 2760 wrote to memory of 1084	2760	iexplore.exe	17
PID 2760 wrote to memory of 1084	2760	iexplore.exe	17
PID 2760 wrote to memory of 1084	2760	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bb216b0562e039a3d72f4fcb028c8d5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4f8642216298856001cffd1d429134dd

SHA1
8833dd59e5d1e44e153a7cbd1b1ba58d767e29cc

SHA256
17c2804bcbf43ad42f3c3480d92765531b0739fb3d21eb1a66d8e8a6298ee97d

SHA512
6869f14a79888c1e2234559cf04e020c34ecb044e5d78ab6d8d151ce3a29ce4b21dafeb6f3d99791a40d2ff0b8fdb0dbb5ee230b80ddf50273877028b977dbe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90770080012c7eb4bba785f8b0b9527

SHA1
133020dddc0b807ea9f63c3de6d145385be99a13

SHA256
e138f309269394781948d9a2a883e3b4086acf3642b773ab9117ea356b45ab7c

SHA512
742d2aaf3f1cde7541246546df6545895df3ee740472536d4b1700191383688eef6314f26ebed0b22e1c25d4e44a93da34a1dcc8393c47351347f20f54df49f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a5f178fa0c48f8b486673ef49e05f65

SHA1
2fb00a109619d544b1ce713ea34a29a810155c5a

SHA256
12602a06d548686c8d201133d9fd48fd59efaf7a0aac69e24a8afe5a905b347e

SHA512
a5ef39f4c2a8208c319f4c7d887d31166f369cc89f53b6c5e81d7c1da904000865e77341a0275bbd773c0b08767fac133c9e84e2888a9ec35b072053062db2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cacfb61af808dc26b77e744d0f684ec1

SHA1
df5a40151d375dc900a74236924642117b6b0ec8

SHA256
ea8a08a822da144fa99a0a78ddc6ab19c9220468e30f8da0153a56b096e7e11e

SHA512
0b1a2b37bf4675ada76f41e3333d8c2be2357eff8468a69d62cffe82fe2780c5fb8dae2eb976251b4ee2bdd8a54dddbe9c381e2bea35687df7e464c3977ccbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a4780013d78f4391e228b190fc76b34

SHA1
4d3ac3fd4b9fb512502ae563ff27a6f749c3bef3

SHA256
74c2c81b5ba404e3988dfe183a97e6224dfc1675bea8a14c3d61f8f05b6aa4a8

SHA512
dae6219d793535b041917abe79bfd00befadd72412a6cbbff0ee404bcb8b3a8f72d90fd47e0690a7e9869c40997153cad4eb3cd9025a3b0ebe72d88599dcb515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1172ffab856269186fe8cb42cb5e72e5

SHA1
8a5a9334bce1086a67cc8afeddf9b214aaf7aede

SHA256
52336b84b05d3116bfb83ca7afafd1faeb502372e76cb3f0c1a6980cfb924853

SHA512
f3ebf5bf9ee7b4efc8ca6907f72263efe95b899d38e89e36fede0d89113216f0e6d5d173b50d4e193b8efb2eebfa64cfae5ad7f949ec1b3625833bf715ec3c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a39147dc2c6ff7cf09ad0564917fa3

SHA1
ccc871242f28131481bc3620df59c4f7d7652d1b

SHA256
cf1ef5b5a519b5c5ab2d263d4243cf435a0c055482c9b97313b42933eebd0f0e

SHA512
3bfa7f3785a11b75316dec47a3f351b08025465a8ed7dcc584c289f448ad71a05b24b912f94144c4f61607009b458f5ebe037e7c35c3101793212c5d5a01ae3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991e3ebcc8fe6c8875323ab9f4c558ed

SHA1
f8390fefae937144a41779a839481db9b1ec7617

SHA256
e42f7a77bced55d252cbc739f76393208483e66b29d838ab7a696d2490669662

SHA512
8a3980acea541640437994647e3d3a870a970bd7211e9d1095ce426abca5af71a15f63501dd457283d8a1cf9062a5add399296146015d39e585b3a0c53cda485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a640942fd3b7020d628b59ea7c8596ee

SHA1
bf716744db27a4ad78b3508967fe8a1ca9051860

SHA256
52178b42fc9271a10dd5af44bac963931a1148eebe099f1a60e551d817a18604

SHA512
b2ba7d3f3c051c282a8ea517bd0553e32fee74dd22398e60fc47db19cb9c2e007f86a05cda89ac5c1ff888fe5c2fa1f4d643a30e2b6d1553e7de989ce86dfc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar396E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit