65f155c3c9861617675f4bf9c1084a9835e19119b257d80428acc0fda7c2f5ea

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d4ec1173c2e8abf7e690ae6f3ee7aa4.html
Size

2KB
MD5

4d4ec1173c2e8abf7e690ae6f3ee7aa4
SHA1

9c437b757e046f1a65eba32132680bc92193761a
SHA256

65f155c3c9861617675f4bf9c1084a9835e19119b257d80428acc0fda7c2f5ea
SHA512

4806a961bc880739f138012c5687bba47d5d0b6fffdb7752acf52a0a8732ed77b1be5eac7d40f6b0bb86cb53b4c19dc9eb2b40362d45d59e9482d672346fe931

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000186a62f6ba4d8b87e610b7762f696cfd544b72ce66f5571f4dcd3bfdfbe7413b000000000e8000000002000020000000581bf6d94117479ec6797965f9ded40dbafeb8adc1a3bf1f77f8d5d8affe20689000000015a48733638aeaf63fa8cc2058322cb35a2684bff5244906a01badabcd73ffbb32cc1b966366d4e2e6daf085a456172eb68a7f6b88ea77ebf1754fc1fc7497168972375cf1302f9da105a444432d810b9c9ebfc1a92ddb3de556cfddeae9ee7f4c375a9630e087a085519546414b98acbe7dd0560a5847b0cc7c78248091b4fa95b25ade1cf3ef5d79d1cd9eb65caccb40000000035620b69682ebddb2b2bae6ae6ced7d89a9b672811a0cd87070ffb4dd1d856d17741feba0f67a5a3e5ad4ba05009f3b541294c0758a33dd81f2b7eb764bdd71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E16CD81-AEA5-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f0f098228cf606ecd011628dbeb5d87bc4e96897ea8b773e109432a4c3c21d3d000000000e8000000002000020000000502e1cb9b5a49e3d60d8c25b85e7d1fc88658c1f032f7f5d9779bbf857d0dcb4200000009a149e6d1c87262bbcc6b6790077e8e628399512612ab1a38e049bb63e03da7940000000eb4cc1f323b6fc5231ff83d9bd8a3f5ba272382908c9bab9df9af5192190eec701085bc7a711d1da2341f1ece3dbfcc33ed976b5a60a5ef14a182d4d0992aea8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0faa062b242da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410935528"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2240	2476	iexplore.exe	28
PID 2476 wrote to memory of 2240	2476	iexplore.exe	28
PID 2476 wrote to memory of 2240	2476	iexplore.exe	28
PID 2476 wrote to memory of 2240	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d4ec1173c2e8abf7e690ae6f3ee7aa4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e68fd9bbbbee5ef7b2537c05cf70c2c

SHA1
041e235ee73c8c58c5ea03f098b25fab20377d7d

SHA256
4148af568b57ade4dbf3b4d4e3e5e8d59fb4104e8c82170819d4cb6f836db9c2

SHA512
3bca3710fba549c13e3ab2880ec59afbfc49b893d5fd81bca19b06164d5020b6a99065f88b9cb9b8f34dbee5c668d1d8127cae176d1e370c858d77dd9965b5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
184b7d09c70976d449fd32c1a020cd35

SHA1
456ae5a8227b0fb638454fddbf2f077527f4422d

SHA256
6067ea3d7d2412a345e1a75d3fd84a13a23a8872cc2a61137ff367a2fe9269be

SHA512
e4ce0857ef41cdbe1e6b3f8605ec5a169af1966f341880fd942e93fa16e788acf90d82a20481704f9c20913ee40faba5f3ac12c190a4e44cc301dcda7c9f545d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f72732fc07daff3d1b636d7855a68d26

SHA1
fa243cf018a5d8f372d252f216092d52cd96dd87

SHA256
44fb2cef36e26988ed0b1fb9632bc9212a07ce975634dd83304097c18d7f64d7

SHA512
6b902ccd12cf2c92bc54e8e0aa947b2cbfac9a47590b903a7daee1146036701d92203161257ea34c7269450db08482ce41b6a945731ef1ad2876baa8379bea2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6dad4fcc0a8d684b0d04a2d6d257948

SHA1
f29b4880381aad0e073cdd3fbbecc98646549b23

SHA256
b50b154d6e6a68c702e7f246558baa02f1d25dbec04b634e9138edef4acdd9ae

SHA512
525051fe2765f010fd238551f357187eb67f619928f4f165b2f516b1ba230382fbfc70ec3a7356aa3d8a1361b403693db3650dd37ad39c038d9174aa5e4eab54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db5c70f479b9399a5505c37b8838bb9

SHA1
637e3b782e16a02b4b73291afb7cd44d33ce1609

SHA256
c1359673ed62d8f4c132bd47bf96f96925288fc5c46980972e563b4283e747f4

SHA512
d3a9690da5547717afc67a431ea31fb6f9aa7d67ceef960358059c04639829108de0aa788d107137c453ee0b1e1d73be464b413d003dbb0d648eb7f3d131877c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efc1bf5154f84a5bbcfabf28c29925c

SHA1
3e2ea3473c7e2f2afa3b52832da6964347530c57

SHA256
29c652b440c2083bd180359fe6114527cf19cccef4f76d93345f6f7980f87c6d

SHA512
887945851c5aa8b917ab0d452c6658651fa9bc9bcf5d3908cac4132c39d724fcde0e033587ed76b3d3310a27391daf6e34cd2332f16fdbdeece492c6d1aedcfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5c37f95f470b2e0d7453d01b96d1f5

SHA1
8d681d03da01b4010d5d22c1c51553d86a60f5a1

SHA256
32df2af892252cb2ac8d073bf19372a172a597ff29b8f0fa4e6a801dddf6371c

SHA512
4f04071533ac6b053f9bb2f031b316b0c3c4ddef835e366dd53e5cdd3a479b024707b0cca53b4254627724d69fad2edf0b57b529d3226f48f133b6c61072b801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4778a929203c893c6aea567730fe9b10

SHA1
4295033925d7934031d73efe48ebacc10a00eb21

SHA256
0821cbfee52aa92287c4e820c1dbd35b3b015dbd9c4495872e97320a74cb922f

SHA512
592ba1ba9c1d0b7879ed8d658d9ad5ef0e20a44bcda1820c51ccfd3bcd42db3df0221f31b2c91b92b8b4dcf32df7c261f9c8481b2d541116b420aff2a42f3022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8e3fcbc7362e0e9ee6fc47af0f3395

SHA1
7dfb8256fed5c5bda51bd0f8f695befe45efef50

SHA256
e3670969976b22c9dfd14def99d8e42feca3c9bafc553d9c8cd95e2d2f9ad1e0

SHA512
5dafc7b12fb89fa89fdc35ba923077324d775b0120ef03ef75f07e8303e5245480c6d1f0834d1a6870287dfffcf6147cf72b4a93b0435f25dace5577885d9546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
281c3fb314ceaa0306b0844021c1a753

SHA1
8cb57d461be04f450ef5ed4968e1c3799bf7d97e

SHA256
5d98288b4b44a374436a3d3a7a0fa4ae209c78dfa35c12a87dbfd3e9feeb706f

SHA512
2efc1067855d8acb3a7cb6ba72278cb59e130f22ed8be7cda1c40e3c37d5953f40b4be4482c114889e269b0bb4d992f44019c77f821db87016b2f36c47bfd885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33449dedcd3a47c33e17efa4848b40c

SHA1
c27e0c20a356f7e93319ffb7a33dae531027d387

SHA256
fac46ff317948f929a2493bbd0287cf53c95784422a8a2566856e9c394c0ec82

SHA512
07b8381a96ce5710558fdfecdbb7793883af9af4fd5bc1b4287f95bf88c7a4482734258dbcfb2fb118d2a522402f0b24faab346b4c604a5b8cd782019195d978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584c0cb15019ed721b5395759fce810c

SHA1
fb3700d58f670d1994ea32ecf885ddad8abb301c

SHA256
f867feb153f0f75e4d695367416749816e51eeccfcf5b57ba41c8551d42efd4d

SHA512
2d2c3b4791e8e3cacdbfd26eec6ca16a53cead45fd2d8a5ed63d84e22937dcdcf42bf6c2c20f0fcf12709676f10a62b7e00e5ba9ffbc29b563b6d63fc7cc768c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6339.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64E1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit