e3507fb3b6f53e083c9b191c174159098dd33ba67ce8904270a0b6e7e80b4186

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d6603cff66ee41e5d579c4b3ef8526a.html
Size

6KB
MD5

4d6603cff66ee41e5d579c4b3ef8526a
SHA1

3da45daef44153ea653dd02e234b573bcc90d50b
SHA256

e3507fb3b6f53e083c9b191c174159098dd33ba67ce8904270a0b6e7e80b4186
SHA512

501283bce8561da5fb55163150f7d7561861398a36c3ef9165e73c72ef5dc00ccadd9584b5083d3920387d082b6162295442ab9af2a42f0ca383294605c00905
SSDEEP

96:uzVs+ux7xkLLY1k9o84d12ef7CSTUyZcEZ7ru7f:csz7xkAYS/tb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000827a6981a80c40c7817bd19b6624e9834bee0a8271753bf93e844ba22b6c7705000000000e80000000020000200000009a95b62ec8d824295556aa01dc2c536f16b621ad85768a169ff622c44fb48875900000000cc691e0aedfad6a602e5a509c400829b8dd30e1bc268d0206e00d9333567c76d3aa31137a8d394cd783cde8735b7593cbbf876feb87de7e055cb8a36eb0c0f7265feac4e7c073d7d0c66a921ee541e3f1c195e1fb4f19e3934b5d2a2217397045206c9f19bd12e86005bea1ec38ad5020d441ba7c62790f5aa4f44dd8b43c7d0b7e6caaa2169c72fe05838ac4644aab40000000854e97cd091ccb16bb1224d14e2316291464eab5d2e752f9496d78666057e1af2f3a246c148c7a3e4ee32259a94dfe8e528bc3e1eb5154bd209c994f7e5d5fa7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ec2dbdb842da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5B0FBF1-AEAB-11EE-B311-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410938248"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000015b624503a9dfab1901eb6876afc3f1ebccff646d8aab122d3d397141192447000000000e8000000002000020000000145c0e6032f97c54d4ecbe8f94510434a3708323e1e89e1bfaed4c9b11da90be200000000c3eb717140261771ffdd4c824e08c823f94e5d5d26f39b3fd49f7d01b692b5e4000000041ed1ceceb36e1776d770db5c7ff9957998c31b5109dc0513b5e9b986a489c617b29ece008492eaf2a5c2199b2c968984a6b5228f1ecd5ffb71e63d27e7472ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2696	2672	iexplore.exe	28
PID 2672 wrote to memory of 2696	2672	iexplore.exe	28
PID 2672 wrote to memory of 2696	2672	iexplore.exe	28
PID 2672 wrote to memory of 2696	2672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d6603cff66ee41e5d579c4b3ef8526a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9663fbf5ca823536f2acfc1640cbaf59

SHA1
3da91c512a4ee968003e0844b54935e428e5bdc0

SHA256
cc7912ffdf2fb62cada5afab76c17a55049d58550f33fc990c99f07b3aef2da8

SHA512
5a6eb9d4b3d13df262e7bce04a92bb988c8f35d50da48ed987291d4aeb5eb294ae2d727324974e31140f7f1b041aac250c7abefb3c08d5e8a488ba7fe99271d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75dcafd3a84b83501ab94b6cc92c8918

SHA1
86a1802a19659e9c1f3dd8ce1ecd5e4a60073c5c

SHA256
d9b43378e5dbe2b4aad4a55b29ba1c875fd83d60c2f2b1d321453f49af774d0a

SHA512
afa7c5187bc1a32b91912f4fb1f9bd46b3307cc24e73b13b54958a3546245c84e367d8e4ae976c3f0b20ff6209183329f8fab847de5b0a28370d4ad5a3d15fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22a3651b2c19f8cb2526e7cde1183aef

SHA1
58a47cb980fbe17b55e4cfbff0b1f0c146f528e1

SHA256
4e005d18bc78c4f291d8b68514e0f8d2be17995b56a95e93abd021d970d24afb

SHA512
96159d011f6737085c7a3fc09f4fe6e9be17284990ddeec645c2c66ae3043967f8ef9b9a9f22d9b13a09128975c6cc6e32c45ee029719a7692cfcb13e7aabe1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9603ece908a2770c1e299121145b4ab

SHA1
bb8450b02bf4a7462b5785687eff209588fe22a9

SHA256
cb1c24527e13f8c614bf2bcd3ee830a8c1c189708846eb622176acbc5e12e8c7

SHA512
fe3dd0d181974f7bdfed0324ae26fb97246fbf00670192de29b4007d4ac6666e00d4331805672fc9c359786d3dfbfa6f7ffe97566d2cd80fb77224bcd5a7ea9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49242a5844e75d9454cc4f214f4db15b

SHA1
cea77b6fe1dfd5b610b139d87e646e672a694ef4

SHA256
387db1dc7e27c0cacadbf64ecf5dda4cf15fd15bb4b6bdcec3813e04ed908e23

SHA512
5325780889b4645674cb576a8bda764caaba6bfa34982f006d09423e26b02b77bca621edf2b01cbd9df4c613ad2cdcb18a5e3c8cb92375fa51bbf3de700e4f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75b17319a7a9491022f7efabb0aa41a3

SHA1
6ca645bf887d3ce235e572de6d48cdba90a7a585

SHA256
48d626a282450f56a4bf492b0cbfb9a0970523c986cff1de2ad09989fc97e66d

SHA512
b3693cccc9ac5fcd7c91ef6667fc446d39e6c9fad6e99aa7d99ca1048e09c14bf863ae56e17f93b0b5bd6da046b2f492253d85871b2bc6ecec53c716c9ec1c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
234287d0c04b13c954d7b9e7187b8dd5

SHA1
42c5f428b9b66f44d72c5a0b9f78d53bf10a8d71

SHA256
104581ce9f982d909b0b38dd9d63f4898789e64b7d9570aef4754f0bee89fc7d

SHA512
55f0372995ca9d7cb889947b95eb54914ef80e8c546baada0e114f516e862ebd50254a98d33c3a27a486583460a8a5122172a46be0c03ecb32c9cf7d6043b941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7887e56f9b94f91f774cdba16b6ed15

SHA1
bb865bc5ca848c183934b5ff39ba02747e8b8163

SHA256
3683c894c2d195fd89926b5c103ca7d25198087061b6d1121d59a8006adbf09b

SHA512
782474591b9ea4e4f68d3af7301790d93b131c3a12adc2bdd274b468f7584fac9953a57dea0df25b272df0fd98e8e0b688603ad4ecff9e70991c345c91590ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a000f9e10a4ea8029d78cf1c829357

SHA1
e4a5c3f9b4294f41a2dfd9e94eb58cccd948b441

SHA256
2c18b9e70bb039d6f00cbe061ec1b2c18382ebc0677cec726325ba6edb9fea3e

SHA512
72343010771161a5f7fef73d7a39e0abfd46ccfce1081e679c296fc017b27df934546e9f18967c033fc13cd136b7ff5023b6cc968a7478a77151ca5855671743

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab718B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72C6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit