4f2d11ee867bc7c7546b932f4898c65cc303a413bf208171e755ada383440814

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d28fd2f672fb7a341d0fab5497ddf5f.html
Size

430B
MD5

4d28fd2f672fb7a341d0fab5497ddf5f
SHA1

44d02dd8fadd2239a9c3a27aef08aff0acd58950
SHA256

4f2d11ee867bc7c7546b932f4898c65cc303a413bf208171e755ada383440814
SHA512

633edf7cc257fbffb6c38f7a977c9a8c6127bb60d2f029f5f3a7ffe34b08a51fd371ae6593e29072c77e3852753f898e7c318e80fc6f9494c4a3920d1ffa7e4f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410931008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000649918d08488f024ed74938ba2333beb05046eecccd6fa276fa1871b7d495310000000000e8000000002000020000000b7485fe67b2bb00417eff160b73ef6b04631e695e35c1df9c8a714ba801a0cdf9000000003301881c41554975ac98877d52de2854cda89192e9ee636efb34a852f72e09728b45d69e2e821e81268dc6fe6a6a9282bd61ebe4fcb408a909203e44abe4855a8f1c20b285eaa9189c83d7bbcdb1b7df79a1b9f186e925c70a2ed7c8023a9de1e25d00f94e6b6832fecba86fbd43b16d74d66ba55440b0dbbb26c89b8b9aa3ea85b09dee53864f2127cd05950e5bf264000000066d0c4844e2d57380d4180ce2a9463d0743c32828210555c28c66199faf8ed43a1741e6183d136b91b7335745d4ffa574296c250ce6147834f63c08890719976	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706971cba742da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000005b079898d9f5fcad3289ca6ad41bb95b9b1c4b69e9f3e580769bdd0e0a30f54000000000e8000000002000020000000f78f147096752fe4d4ba9256b5320a95152354dd760b02b57e0685a06e28ab3f20000000c3106e87fdaa42a8a89e5e19235be5d3cd037aea294429b1aeaaeac12784d4b6400000000395d9fc7a92f1495b15bcf2f448588f81979106ce43f1eb4317519446f9308144fd2ee8ca37d86de3a17f7e04cddae3b0b252086fe345e0865d5856b46f450c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05C7E3B1-AE9B-11EE-B377-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2008	2616	iexplore.exe	28
PID 2616 wrote to memory of 2008	2616	iexplore.exe	28
PID 2616 wrote to memory of 2008	2616	iexplore.exe	28
PID 2616 wrote to memory of 2008	2616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d28fd2f672fb7a341d0fab5497ddf5f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749c994219d94ba736fa4ddefb12e1b0

SHA1
cff04462524ae80d43eb3453c8c890022fcaee3f

SHA256
f470b7d3d4a2b6cc5cd73d03879727ea6c6003b0cb9a3c94a8b93fec3f33a081

SHA512
e2c18ea5b4cac4cbdfc5c80d086996495e8166b3a1f06bbc8cbb80056b8d4d937e40ab75213de1e2dd0d27af76d2bf57483bcad42e35797d25fb0653a9e32233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e951d2556dfe2b4def965aa31aeda78

SHA1
1e3c94f8459e9822729cd35ea5e9625764343173

SHA256
651ad54c88e5725d6fad71fd3c4fde15ca7c91b9df4a2821834258c8f65c6727

SHA512
9c555082020f6bd17e9df5be33e08f04a1aad80fd258f1588084169ae100583cba3254b7b162b739fe31738addc69689c5b0108077a6c3e91a9a2355f3a201e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a922a53c8ff4576575109a9f4477c4a

SHA1
2bad8c7e0e2a62a416a158aed21d312f38a2c525

SHA256
03b04ba4659e6a4c48964767c55be425e4e973fdb40fc294d51d6096123d8132

SHA512
08be0e23da6468398dc26cc1ac935c5b5f28cba2d1840e0325a43effb34aa81a8d49dbca85b860f09b99f195c9b928ff8f281f9d01e2164df2e7d95a07ace746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12dc7c31787a4994631186cce8a0c06b

SHA1
25440a397fc995f3d55c5e2bdf19a4c842dad38a

SHA256
e2c4a31da51d7b1fb7f068a82606808b7080d4e5ed74991177f3da601bc0677b

SHA512
6c5755650b5f3609e6cb42024474a1e7ec5f61666960ed9a35b1d478b452dee4c292aba5d591df0bc6802355553df82eaf6eb4db9291237aa4853b11fcb84d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c6e8f83c3979591b623fc5da2725350

SHA1
de45974e9551d26c4492e9dcaf036c84dc54b3c0

SHA256
29925dccb79de8ae45811745c8e890ef0ac709b49fc6fc965c39d467b44c8bb4

SHA512
76a02ec4cfdb221fefa5638a3a85e3a35f390b40b03e5fadf77b6f9c72680310246d654732adcf61f8ab593ea27882e09dfc797695da1768ab5649b326fe5904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4453f6a91c3327d06d12ddc896b820d9

SHA1
11ce8bc9f4de0b7aaed0614b3e4059d6bb770baf

SHA256
8b82a1dae5a7feb2bfb978c4a113c721fce71a04e8d203a5b93e1316d4cbc320

SHA512
32a96747ea800aac2784987fc2a814a60100dc64a9ad880d5ee74ca49339a547bc698ac8d7bee1df065b4c8edeca77b79dd8bbf36d2c0ff3110eb6e357883988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
281b2043d6205943a5d515e1e774b005

SHA1
e38d8a4b32d75e81f5a55e91a46a8741127ae1da

SHA256
b48b5f22e41d62b4649219c9fffa1a1a7e116691feae2f28990311cfc74cbccc

SHA512
8ddde49e6becf14d406787bc1fa0e70055582423db3f801eeaabcbd3c659075a154a8e4ed94534ed70af751d422de0a49635807ef12b132b64b2c5edb440e095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea9f97a657f23ff44b5fb739827a22a

SHA1
60fe0fa7f4ab7cfab7f3ef7eaa791e00c2cecfff

SHA256
6a74574b8c68187697dd3fbe2a8249f39249ce32a002d840f35cd4d9864910da

SHA512
45cb8e8bcab81a700394000495337bd48c048b7b5e0570a3bb3cf0a668e0df64ab4abda4d9d51fac0d2fd17ee9e2c74097d0f156faa4530fd6d84b0bc0dde1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2057de32cc55e02393939ef156d3ab5

SHA1
e9a1318712559579688c4fdd572fb71dcde5b74e

SHA256
fb8fb7e5306a8bba79c62df306fa3a2f05bea4f81de77a700b377a9f599cda40

SHA512
6817c274939cd0321a18e6248fec19596677aaca2361be23fa6868e0979be13f04bf2d1c1611ee77238d7911167a0bc11b7def60bb032e1c465daaa12a1ab4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a24a79642c4808bdd3a2b631be4d334

SHA1
27bcf876ee94dedea7ed6e855d0f28ae03356668

SHA256
e462990fd6dfadbbf1d624b102300896129d8698fe3b94e0eca8e6ec2f8b5c54

SHA512
d2eab627295c8e9f322df05fab0e1daba08efa9046bd52f4b82346f05816262a8dacb8b51490573d72ff3b609a76d88a6fc10926c349ee237fb020f9c4ffab4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a102dd23af644b4b116f40579f2a718

SHA1
2b70b9eb029f70c86c19d11a3ad17a2d9f57ff4e

SHA256
69a3f3e440770092d0f13398f05508f210717371b8402400d68f3f9e0aa62797

SHA512
1c01b9811673aa640dab98b339a186afec8374fdedfaad52cf8637046cb67f246cdb26af7906e46d4d32be1977cec2055cb1ac391de93fca8832024ba4ebb9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f9yyw0t\imagestore.dat

Filesize
1KB

MD5
25f5b39e149f890d89ad31f2d9c0798d

SHA1
29b746c0904ac18bd94d24c2ca799be25923ce8f

SHA256
632cc74b8f964a26f6e0d6c43816512a13b91f29c5408b7f7219b6d841f3a82b

SHA512
8f712f1589cfcf373d1860355f21a1522e828602309af7908a1f42f47d5422c5efb5dbdb55f8f5a0e2e03f6f248659684a960077c327cbf75ecc4925b683d457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab560C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar569D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit