a62ef49ffb574103d51849a189fe00f718a372873dc14ef9c67869dbddaa79e4

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d818b0034c1e9daf653123630aa3461.html
Size

80KB
MD5

4d818b0034c1e9daf653123630aa3461
SHA1

ca09a32cb808e627cdd5dbd29376d66f0cd9bdd8
SHA256

a62ef49ffb574103d51849a189fe00f718a372873dc14ef9c67869dbddaa79e4
SHA512

eb63e8569f9d8b36c41964cdfba6c9a47af6110ca4db6606109f14b5bccd00164e9d2371af526965bbd42bff87b388de8b77b0f77a4e0c96e1e9110b7743b620
SSDEEP

1536:d/WvSFQv7W75waG2nCZCE8k4Y0+HwnSou9cNQeNbyEkMNEJQjNBZNBHNr/N6CNjt:d/WvSFQv7W75waG2nCZCE8kBwnSou9N2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAA658B1-AEB2-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410941265"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2732	2856	iexplore.exe	28
PID 2856 wrote to memory of 2732	2856	iexplore.exe	28
PID 2856 wrote to memory of 2732	2856	iexplore.exe	28
PID 2856 wrote to memory of 2732	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d818b0034c1e9daf653123630aa3461.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71a58c59536addaf55b2728d3298b488

SHA1
def5620e9b7c3910e60863868adadd24b8d83d6e

SHA256
c25981823b759d69752756fb09c754d7f090e926169920a843ef869f171f187c

SHA512
625e1001bf0bcc43eb311519c4c859ff0102c15e1aaa876593462cd13484e8b28a634678593148419a5f5ffae5ae275c39fa6689acdf63839e56cd5fc885cce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3bd345367a8c97cac9d50cf3ee4ac3

SHA1
d218e954da15f58a50ccb97e8d2939962685dfce

SHA256
9e142d3a3bb163ee63868be2674c2774daf92b92acfd9068559a05bac761f012

SHA512
94ee3b89c4bbdf9220e0da0772fc16547071ae0a7dba19ac49d48816b0f6f411a62190b870a2d381372ced12ed80a20707c154b60e443fc7edc631c1c37addff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f59685fc8d117569118dd9d968b2daa

SHA1
bcbe22207ced9644abcc70083bf6cd36bae38895

SHA256
25c3ce6ef622d7c579a09a9cb5baec38697c7899572f072c2bf1b4ca04a80099

SHA512
fefa6f72406b8e72d859a10b66b2e82784588ddd80b5ba9398fe0add289529998777a477b1efb002e56743a2a3d6138795bfe4def440d5e8a24e41290b7e7149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5255a41697b11191df3771e3bc25e9

SHA1
dc79a23f245a2b26a9c6fb2c5b0bb43afb88e605

SHA256
5aede62f59e12eafc9bbae301e502201e3d1ae6cf49ca0bfcd2af7d54f67b8c4

SHA512
550bcff16ba2d1ac7a01f729890a986fbd9095d4f4bf725b500790175083e950ac396d23d04d822419d077f9d25a1b49f7f2cabfb18e3387b8ef6c8f1d1e9720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1724c2eb9642efc6b17e1cf076bb93

SHA1
2497f78d3238c3d10700e2738163c4fefd4ad513

SHA256
97360d076835bcc013a5e0b71892d7152d20c509be8eb1bd36f99bd8622f51aa

SHA512
dfbf2af63f2f33bd9b680c5dc1661e54013470556bd52077e02330f1a06dd3d4a150f5ccea6474fdc80c63ae82c978fb2c9d29ec1d9de95b34ee78fc8c88ea63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf98eeb81ce55d745abe75e45136ec5

SHA1
210b6a43abf50a68d06fc57d35c4d7e9b7954def

SHA256
52253947ab933772bbedeb4d42651f7c991aa72388efd1a8aa3d8dd32e6ede0f

SHA512
0a2b8a9abc2c211b1843e66b001e9be39d01757fdc2c9cd056bce176eb7e24e9a513264d9ec99e6c0232718d26a2265fd92843ced92aaf6c31b2c1f606456ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f881024202ea7682426beae03d220aa

SHA1
9df450e22560fa544f38f987114160b28ad2c557

SHA256
1888110e93faed1dd98e2473ab8a8d3ab2d0762413cde1d1b0c36caeeeee69b3

SHA512
9e7e9e65bf403f033b26444a8070abc0579f5cf1dc31a9ddb78b914ee10aeb379f273371c0da0005a32a7d8d55ffc8868f9d49cd0e081b85a759ab4b69086d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2697307b80acbd1a9efc45caab575c5b

SHA1
2434cdf2e50aebf5759bd8b3e1daddc12b4dc8b7

SHA256
dd535af8e7a92394c41647a4d1f86f50ecc6a2ad3f774f3b170ab2432d690a21

SHA512
7701dadd18515cc67eedf25dda1da1df9861db44764a58e5d0205e027747474be7b5e32cc6ad7532f8b7448815989d7158e68ce74f5800a48e8be3707039d6be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6FA5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7141.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit