dcbff56bb4b996612af2344160addacf7cfa8c13c741c55177b520145ad2f18d

Analysis

max time kernel
147s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d2e241a77c96515e93ab0a388269e45.html
Size

8KB
MD5

4d2e241a77c96515e93ab0a388269e45
SHA1

6665ac2e0bcf7f987ae59e3adb5aa3e680f77c39
SHA256

dcbff56bb4b996612af2344160addacf7cfa8c13c741c55177b520145ad2f18d
SHA512

a596740c468ae5ecccd2251873d4a05852c250f2c592602ded61130599a4285dc4a2133b62c1bb3d7a31d2fc1d9363c0e21dad919f80da7d9bb580f14c36a280
SSDEEP

96:uzVs+ux7MPLLY1k9o84d12ef7CSTUczfcsvtF7R569Ehy2Uk0GnUclhADcEZ7rur:csz7MPAYS/69Qcb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410931569"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000095cba1deadfa7c715f325fac7f7ffe3a5e26af2a60dbc1bd6a110ffb4e7905f3000000000e80000000020000200000003c8dcb2b7b1b5f51ede65a6d98328ef29cdddb725a16371bd8460928c8bb2b2090000000cc92571641b06edde02441cd7afc37a4bb555e263689c2c34c8931c26118f6e38d37a8573525dde22fa622d45bd6dc84a397fb0449968944edbb2c12bbc6af184dffdfc702533ce6e235d62fde0710f5684bd9298666232ac93f6dd025fe6b2f9199fb4fb45eb1dd15f1c219964e297ba75b01d26db7a05ab1600622318ddcd5408fc352c2cb654895d7b6a0860b783140000000f9a229cecf8a06f1ad7574929b32c32b61a3903fa980fb93e0a3fbde808003809891d598a87a94e14d1e95d2f343db502f31af5f917af18c462683372adf92ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{505234C1-AE9C-11EE-B190-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60558a25a942da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003a09cf83a681835e393c5fcaa0917ce0ee3ba8ad2ddcae608537d5df269608d7000000000e800000000200002000000051d2c70a3484651e9ac7490932083a3ed7bc3a688f54d696efa671fd80648f412000000083cb316f37b452189a206fd3c538fb011991b571bb7a7fd9ace3f20a8e7d81c940000000b9ea494b1bcb3d7902f097fb5c3373b6ae3f78067a4944379c0db9893ddbbe84d1968db3158f5224df326a77676a55d738ce58235ef43db2318cc8784d192401	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
272	IEXPLORE.EXE
272	IEXPLORE.EXE
272	IEXPLORE.EXE
272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 272	2256	iexplore.exe	28
PID 2256 wrote to memory of 272	2256	iexplore.exe	28
PID 2256 wrote to memory of 272	2256	iexplore.exe	28
PID 2256 wrote to memory of 272	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d2e241a77c96515e93ab0a388269e45.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc366c8987e639394783fa725b55b5ea

SHA1
0f9a2018f528b4014eeaf0aac53eafa8fb107aae

SHA256
042f196c092c23a1a99cd1e962d248976e274090517e8447104f1b1d63e65fdf

SHA512
64dafdf1fe65c1296d837dfdd18d4bd48f98d16cb1bea216ab881f5770c13fd5a73ed0745e033a695dbe4f7f4864fc7879e1508fadbd1ef2e0c3d4f317da0595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
449b3e0e27b942614dec7b7b22ab5f62

SHA1
2fa403f1a216c8626ee34b6ce6a2837a1a4cc1ec

SHA256
bfbbbbd4a4de6f06ed2f008b7436aaa18aa349090745e5589768e43c929b37c1

SHA512
6a11d168671095a292f6859159d2fc9496784fcf14d8bdf3ef35f85883fe31ace09020bfacb7e05bc4b1628f28fecb26f38e5a19c25afcbee0f3edd630ede0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7684a41abf8928e285db546ae2b1bc98

SHA1
4b0a612492436738f77fc32d4e7111f07b41f00d

SHA256
a10fc8a2470c2ce9c0726707c1072fdfe9c640e5193e16ced33d0cae7d34b095

SHA512
021233114216db2bd607f3de87afc8516ceedcde3befa234001d9afd17f501df7bc91a1bef73260b53bd4b486a6ffedc0af396136253790be7664cf252c5443c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc2e12ec11edc21940a09523a96e7409

SHA1
0403df9013e74ae44902097057bede34d0a842ad

SHA256
e9bb670308f8393644d96804664c3d9f902591e6148d96aefae33f5dd6f82395

SHA512
d2f06681e53a8ae148b16093615b62b67edb1d75748792638d746d8d4d29b4ad243d678a7cc7b920eed971325f81d88e53a17dd66e846e10e0956a264a03d089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60d5116c9d9dc72204af8a19153c33bc

SHA1
49c7f1f740ecb0afc1588b5347a8d5bcfbd82887

SHA256
08f3b132528e24da9f3c56b9b4bd2215f418a67aae06cf5b0bfc3bc98311464f

SHA512
fde0581b1b930229e2f18a094b0ecb48652e2bb72ab5cd510fda871e469afb4b74135922425e37cb90673825d81e9c5342003a1c44d349abf48bf4b0ef91a9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97cb0798bd1039e037f49965077072df

SHA1
10296dd31a90c5ebdf0e8d74d34ad0d6d31eadb2

SHA256
b6e18b49e2eb9ba1ab783dff6f3dea6c6d05e05930c7ff3cdefabd7f6268c4ea

SHA512
e50415e935efc6f64b7c9144d5670b28392893366c8fe7194db3504a56481c54a48c382b38716986a9c9219270ca437bfa38ccd110b786d1b82b5bf56668920c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a511bbb70b9fb879dd558ee1c537a2e

SHA1
dffa63e69cf06a38301d3f30cd5af6549091aee6

SHA256
95fe81f46baddc5aee2ec6293a9bc75cb87c069832f2c7c8847d2a4ae91070c7

SHA512
23296d02853fbb44671d51919df39b0ae041abdc705ecc1782ee078e8230f95001f255cfcb439ef47a8770990e5d1bf75b94981742dd442f424e27adb647fa8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f11d4e4795b1fc923ad87030725e1ca2

SHA1
155f350f710eb84f9682ff2b162ff0f3087d85b6

SHA256
6e132e92a9a0c69bc3667dcb267484cd160690fa6caefd3cf05df35d0f001f0d

SHA512
6bfbc5b9302bebdd94b4fa9d9f643b49f58cc5f95e127889c503dc5c4290250458b9ba18ba28cbc2b2bdf188899616a197384e0ee522346d3c236b3a356ba2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26f9a2abd5fa3905236cdbc5ea8dc249

SHA1
648547a492759a34e6bfb6deefb0ef23ff428190

SHA256
344cfc1208af9b0836eb4a84c256c9524f89ad3bc44a44693ac49ca9b3b29a3e

SHA512
13021e075310bc49b167bf9b7b9c9a67a69867a076093fdb5ec2a92b22227698c32268031c6aeb9c44080597a85716327480b779bb7b118ba1b75b5ddfea6fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5fa3d57be093ba97ba4536060688dbb

SHA1
ed3a498de9746db217f8c06208aa9e555acf56cc

SHA256
f6c8361fe14927fff467edb740efef4dbd2208c8709646cf11f7daea65780c8a

SHA512
8b97f3615d68862631c7c44e4e052bca40e8781cae9959779ec9362e5b63708e8d073afc8e21947a3f7c8c8d4bf49114a9d0e650f631fbfa975ed845fb0338ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
002b70d482a6b412e571437518bd440c

SHA1
ed2899d28257760fc25da69e153bc278ab197139

SHA256
37e7e92d72311758211ed748cce66151a8de0f8e7c5aa14df3edf0db40782fb0

SHA512
14a19c7c4fef42e808b3cf2402d41db38823a4aab698a9bd9d5569384f03c3ad27567ba028281810d6e483bb1546d2db1c3f9390c40327db054a5ff87877314c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75e8a04cc182973d068b30c095c36f5f

SHA1
28dc5d2426ba83f6f1e9a89e9e11d9d8e142c0f2

SHA256
9aeba448268b53b7a2482d7dcd815268adb04344d9ceab2816f5d286a0e19888

SHA512
5883a11ccd7be1eee27d88b269607d9d055afc8a0fc09edc75f86e7df1fab1a5d5265495a94821813ee6ca3b4cbf7b0f02e45f89448f932e3d590906e160acad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1411900c2959405ef0f20016f2761c0

SHA1
a7024e44965654a60e161a534db211e9e20f794a

SHA256
d90c91b236be9b273762f730576d88970203c145a7bcad44d199ef962502c54f

SHA512
9572b9f6a8f5a606066533c70d118f4a80109547954d27f98ee60289c067f126ebb19ab3bc53311c77184b4522e479da91e873d81098cc68a0abf6f917cc9aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7777.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit