174faa43ed74b00fcb370e3984fe2e12813ee25ad0ebaefc31193763dc0c062a

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c2ed9b2ae2121717f1070d0270b3334.html
Size

55KB
MD5

4c2ed9b2ae2121717f1070d0270b3334
SHA1

c5130531744664a31d839723496f7638918d0ffa
SHA256

174faa43ed74b00fcb370e3984fe2e12813ee25ad0ebaefc31193763dc0c062a
SHA512

ea65c0207879f1589b075f634c486e8b622fde5c818f0ef7c923e420f7cc5d01af4bb79f152ab14e231332063a895b40c70de6120a199348fa32f882d2364da6
SSDEEP

768:2rcrpHvvCIooImXvkWkJylbmkJObslF0OBRhaRmscA:2GHv7o7mXvyJylbmkEwlCOThaRr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000355f92b1afd1b321b564cc854f21840fd62f2829e67bcd358ae37184572d65bd000000000e8000000002000020000000d7e3a697237ba95e983f9c299c40b7dcc3037329c45b22474952bcc3c2590f9490000000a119811fe269575537e80c5ee04d24ea5e91d511c16ec172fc1037f4d768040e1645196a10c528e151f4ff74ed9283b9165e51fcae32e755554de182124332b1eb7113a5bdfacc710fb187a1b4dcb5c0d6b3ede5e356b232a6abcd80895dbfd7b4abc5786bdcb72c18b2f0a2283ae2c9d6be581e18361d306c90138332d880c9ca4447bd380b47059cbf23992b3ff24640000000ac6b079a540a11ae804cec0bb9cba2dbc7e2c859ce2ea6a960fcd7d8cd77fe1a63ec19b45d84731b743f2c707dce748374df32e2964c73ad0b43cb850eb96718	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F36FF531-AE55-11EE-84F1-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000056bf936325134d6fbdfb7be88210cabd1c05a2c803af981f6ae93554eccf5de2000000000e800000000200002000000020a7bf7ed48a0aa745433bb16fc60d66cf89e2517db1b60762f8184a507cba36200000000b0544a6df9760dd3947dc1fef3b503a9e65f9fd37a244c3ea14dae71627d1a240000000abbf2422461623415155774470a9a628b5373028caa0a591038261fb4f02919c8ef5db12ede60c6504e27e79a1441f6318852c8448e6a2544755d92bea18a62f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410901346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206350d36242da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28
PID 3048 wrote to memory of 2400	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c2ed9b2ae2121717f1070d0270b3334.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a38e86194533d77a05d623b607b91d7

SHA1
85a190b9fed241cf71230d02fcd30244192de5e4

SHA256
71a6707079f0458966ea8d43b5284993118ac2c73ea2f64f782afffb5f0474aa

SHA512
50b739a7e5b2f0838508b210e4fdb53e7b1c240ac62085885861ce9d265bc14e236ecfe1c901f25ed7dbdaa75aacca70fd3feb564a21daa7227b86a1a19bda95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36232efbcf67082fdfe92b1b466433fa

SHA1
3ec800b26bebb795b9a6d0e6854a5591683f048c

SHA256
65eb67c58f5e00fa35acf9786c0adbfad71541ad94af0e652ef8a1776a33db6f

SHA512
df1d29973b7a97127050a8a99bb0fabd7ed51c18625b475f94a5ae2ff7b9c92f05f9a609f11a1c7d59be0769992476e64c6c813e84de2d1c5bfdc8a75e65bc3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d4abf06f0859a2b24ee1542a2a13fa

SHA1
da0c5ebe9356a822d5d269a621718c6ede6fab41

SHA256
fd6a2b027521bda01eefe71efc28d07af7418785bf2981f137df32eee309519f

SHA512
436bb1d264901ca4cee730581a4e30a48d0dbfc277aff7bed6fe2aa171b0984379773fb71fbbc7ee218c7b8cbda53f232a13d21c6aa466daa1e64004e91b01e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a1e2f07aae536b8cf4381709802442

SHA1
ab1e3b277c17cbd3b715effb8a54785d6ed24b77

SHA256
10ab2e3a069c79680c733e95728b6ce3f7892b598ee8c5e3a6f209740e0aec45

SHA512
18fc1a7194c3b9441149d5d17ea59e28aa8d7a3d6ed7279e750bd1107c621de1281ed03ad6b4152d21139d4de12e85ce888f03fa6fa7d5697d182461d3b51acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85031a4f7ee656ab54a34dd22eea9b2

SHA1
111afe074f840ccac28abb7ab79cf7f6b43f23a8

SHA256
ee8442046a9096bbee739f330ba6e7f0351a4006043f8a090a5671bada9e0fad

SHA512
bafe9fb4f1b0ad9319b03d6415aab254604efeb91cca106e28891d97fb2c7564746e6de0e2c553fc5d18b883e29e4847baabbe129344b5d2bf7bb8cb14676fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf6a56c91b5eab282445b653063cde93

SHA1
61acbeb3f20a57d8ac73e293640c1a906b50cbe9

SHA256
59a69309869641d97462cf5a52cad8864e855e9a4d8884fa8360f06c91d3e231

SHA512
1e8f59fc1a6ea400d4f420f7ee064e174b88ac0706a94048bd7dee75df0a7074c39c883cb76435756e43213b9e541a39cb14972f264721721c31fb21ebc9bfb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28844661a8007224430275606a6786d0

SHA1
a81d695a4bf2eaedfea09102c609b74ab6dbe6a6

SHA256
8930fb292020c7a193a0ea9c2a612086e5769627af6d89265166e8cc65fedb05

SHA512
fc2831a64eaceee0113959095c53fe738c1dc6fc4d14a7fc0ac33ccb10fe7f13921420900e6a8cdbaf101cf8f415b180247dd0d8da10503ef04a5e5f44d9cf32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b72257250c11338de956ecc26736ae59

SHA1
1276ad7370fcd4f4cebf7afe9b40ebe66ff20912

SHA256
eb826554c352ec45434cc3f3021a50cf4f12db9f52d0b7a996e7c99b79301346

SHA512
d368d4b3852e6136b630b24487e0b0a80a4e7cf08afd0052e439de3188337a9a397afd49e03b74b90e4ab6f95d3b55dd2af5b21a5b0768370b65b97e4f7462c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982ea4f1a9cd9194f19e58a085a94803

SHA1
c326879bb31d73521cad199ab3b5d3d471c82f97

SHA256
4ce7373a53a3ef703b85f2387dcb21b9ab7eb44acf23201b9c245f3b2ea5bdb1

SHA512
7327a16656a19bb1e9b3f84673f484554ae16fa8d8a3c1cf0f559486896473bace758d949d34b377be8d463df64bc41cc5595ab767d7550d11c8315be0a9f11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a62e1ee85d013e6a4d88145a96a9b9

SHA1
6cdb5abacee8901c2a36cbd4b6dac735d4fa1f3a

SHA256
fd9a9791ad4d7917a02bb92d102589d17b39d535be533b9e278a08e8a39b85f8

SHA512
0218efc291af799a1d5cb86a2f4d42fae737ba2f394b0af41d7dc7abb6a97a0a97db6daa5fec7259de01ff13452521fa69d582802ad3260ef507ab39263e7dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAJVCBJI\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab450E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48F7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit