e81ebf9bb0bbfb3460ad2166badec0a9ac21f22ef4878e4bd3d5ea6d78655efb

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc3abc7de936bea8e6b8706f18bdb2e.html
Size

1KB
MD5

4bc3abc7de936bea8e6b8706f18bdb2e
SHA1

8dca40f899b7243744035fc51d35fe2be0df0829
SHA256

e81ebf9bb0bbfb3460ad2166badec0a9ac21f22ef4878e4bd3d5ea6d78655efb
SHA512

eb4a6205c27b22e0a33d666255a371e8d64ccd62d244a1fa5f366875f2c9d326e2182ef8e92ab3a73c402e5bbdeaaaaaacea8deb8cc261827309c73202c17e1d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000002e0ba8866dcd415e58fbb55d591b9722e3431bf87da90fccfb03408e185caec9000000000e80000000020000200000004115c6cde7ad00619ea2a1e0cb403b2c742f5cc916502f1111b35cc6bd105b4b900000009e56c1f3c033b1a2b45ff98853661ad366bd03fee6d5ac969f59a4649491efba32b917152af3a8467171eace0168f319c087ec65166ea77af81cfb72d218d6c3e066b59870a45e63bf4e44450b281edb72483df92b8c7b751650451c634328e8c2421260d4bdd3b79e0f6568659adf6a107c7ade098688d4cdadf3fbb21f95c33740f2c0187ce9dcbfa7793ec578441b40000000dd0636a6e1af57aee8a54d1938de63122cd2569c500cadd746b0cd657f7959254faa5eb0c615c5dbe5896ce80ff47c1277c72c7e8d36e38a1c698f66eb22d4a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503b2a2d4542da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410888611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b6ebefdce99cba44a336f5221f243e76e796b23f03563823eee97fd351b3f52e000000000e800000000200002000000048d7aaa389aee9ab70b3ae62c42622ac2598b306ea81a52c258e635635ae8a97200000002633bb478ad767e150d6033337ae9a8da4ae694c06e90fe365377b4deaf1ef25400000001523cc98ff6d958dd8b921bda41a0ce977850c5b220b431e9c2ed1d04c03457e1a5da5191719dbb5604e692da466af41d49d937e153fed2f2a0b7edd162913bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FAAA891-AE38-11EE-B160-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1448	iexplore.exe
1448	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3052	1448	iexplore.exe	28
PID 1448 wrote to memory of 3052	1448	iexplore.exe	28
PID 1448 wrote to memory of 3052	1448	iexplore.exe	28
PID 1448 wrote to memory of 3052	1448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bc3abc7de936bea8e6b8706f18bdb2e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa38275bb30be70d4ab70831a6a4c3d

SHA1
f4be54719b9473ee41bb6934d9ea4db36778add0

SHA256
51b00456680d55f375269c83e8d4116ea977ea3dbd5af91132efd507702f30ca

SHA512
55856a9ca01599db12f31f5c879efbeef7c73520aac3ae43ad777340c92800c6dd32b14b5796f98520f641d7b6c22a6dfa927207747bc36bf43656105356d836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06e1215fdb9d2e616f126b2dc6f81e6

SHA1
39ac11e8437a7344e6da5706f40369b80b178847

SHA256
dc77c7a9c3f411649d0d872e1835e9bb9c1d25dce59079d2e8e32868172a1f21

SHA512
2976291725fd6a50910c0544f0a8bebf69092aa9aad0038c93dffc90ab1148046fb62465ad3b94db4c8d592ae621aafcd265268d56d74dc4913117b24b496a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
305952f655bdd9f1a1b0ff454035e0a2

SHA1
8ab49f146f74ad27ee38ff4e47a1a91c19ca87b4

SHA256
d2ea6a5d7f5bbad1d7fb1f02453e3d5a5569698337609062bfce072d6052610f

SHA512
a27042206fa1ea11585be9a083ea1b70162a72b669d98a4972747181d063a9970827ccab86665dd64d95b9c42df3a47b86b2dff339201cc57bd27861621746a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b08b4b4ec0890f1cea9bce87b6c93d

SHA1
12a97fc2a4ea2c711b24d4e15ad30209c63f4a90

SHA256
06c8257f8eb5654330f201f70bb83830768df5c49ecf2962cc9bf5c360e1ec7c

SHA512
2067aed9fdf107b9c68bc160df6a58529e7d9c1e5173285bff633f8d3903503a54c4b0cb789e98226a94b5524ec0c51855bba70e2b28cbbaaa9c4de2ed85455a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c680efa9e4fdfeab4bfdf15dde19e09

SHA1
67dfd2941cd0a1f1a12dea1f5e14e5f0321445b8

SHA256
0fb6fa60fdc4878e3b25d80a358ce4bc4980ffdb1f1b9814f2e6406a78f89872

SHA512
0a7e2a88b0d00ffe502deb5c75f19c098660b06bfb5cca2341e524dd57b1b02c2c7b0c56d8378d89c16451a933724bf89e16a085fd00c9dba0694b3e64bb8e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1811132dcd258f8499dfe2265e92fd62

SHA1
de3391e0b92ab43392dafa5ab455e915cbd92f5c

SHA256
0b1df2bd9506739f175fdd269eec268bda4d45c60d825b72b74d6b097f248eec

SHA512
03dfdecc3ddb218c948a83f1c63748b0b8492e63e41cbef72dacc8aaa19f7869475ac2a53ac3880786e9c59be698e22841dcd71fd2691575c19e3b707ee93402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7492b674375f5fed9539286714617b1b

SHA1
72402b3643f520e927fd5d6723253761a273feb1

SHA256
f25b1d8c2c6ba4c07dcc0c55602c723dce4513f3ee010edcb7876d1f8497d745

SHA512
cf9628af4c148a7e76c9f5735b6b50aabea2e79fde7e8dbc1c9598665061d7067afdf799fca3d2220a409db8269047d76d5362479b2a11819b3e93671f67cf84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d959933c9f949d0edd71f1695d9941

SHA1
cac6b4c61fea754dd32f74bd82acb7268eebde3c

SHA256
ff0dc2bdaccff2c75ef688bb79c831f449a2e1cd091ce600b70f52beb16d2217

SHA512
5c15b9476c07dbdd449d83547437230cff90ee1c30b293552c383cb772cb6ff6328b293e9d539090ffef7d9ac8ac09c85b513cfcaf02245f6a45dfa35be1622b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d868d01d40a82fd74ecebf1ce565c5e9

SHA1
7842a1184e98f2ebc50c958df57d6e17bbd7e1b7

SHA256
10b627fd47f2bab70910db590b3811d7b6db7cab9ebd8e49a89dfff2c4db04a0

SHA512
4c4fab9089d69269c062ef1667d1b79eaade1c71830968fd5a94f2163fa99e766b7228188d8ef9e23fac976053d3649e2c29512fad48ac804df70e66cdc3727c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
933ac29c829280e763d4083673ed805e

SHA1
930348d8efac328522e930736796776e93bdfa61

SHA256
f4689761004e0b6400670d7f63a844af6b7a79674232ebcb93e196c57d200694

SHA512
8b8c9d0eb3fab1458655e4d134fb50cdf6e6a50a4262d5075ff8f24eb94d760d41ab2e814837bc9f48a59a4fc775d9355c4a84d774a063287c9efe9dc613c42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB58C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB62B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit