cd2f047629989921528532e28c39c18dccc2ef69ea831dea82186ba35e20bc44

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4dac54777dcee37fe74c7589889d340c.html
Size

1KB
MD5

4dac54777dcee37fe74c7589889d340c
SHA1

0646bf0320040174c15e8f5637576e305af60ef3
SHA256

cd2f047629989921528532e28c39c18dccc2ef69ea831dea82186ba35e20bc44
SHA512

8b25fe3d60eda066721c669529ae86c076ebe30eedc8131f04cdbb6dd927767163a9a68f7d0c3bb75c07a2fd8130064dd1c981e90f340e09e74b3a27c704f2f8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5001529dd742da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8F58B11-AECA-11EE-8DA8-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000002ffa47b88abbe3d80e38865b066d62af043ae65211f32be3b09a7ed860b1cc4c000000000e8000000002000020000000e2aa92ae90f1400020f042bace01abefb59bf460b4ac2267b8a7ac961f883fd590000000e1894dc3d9e16978419fa3ff1d6797ffafbb60e60cd31602ad9e8cfe8461613dd033373f3f61be8b7c8485a43016efd86901f7eac3ab21bee2be1f682777f8124c7e36505ccb1c695d7b6bc8b69c281e404703ed344b4e75a9875a6e3880b797e2e1480d45412ed356c767dd0036db00d84fbd29cac2616d49b0c58f11de2cec4466198c2763e154d6322c9cd035b12a40000000e102bea24b46f85cd9ab98f98b9d271516763d34e1b19373c128d2bdef77627722e8e4067186c3059340622b0e8f01ea48c13b06bf50f346d91f6d4bfa2adecd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000002b2ec0e40a961fd5c12483e9e4262967b5c377a10be33566c3c5f952945ea164000000000e80000000020000200000009c023231c980d9d379884f05d85692147a87fd46701a6b953a1d9a33dcfa1c16200000005a457c99f0e3c1045b1cc2d36c44de139dd268c01019c92a59ebb2865f3571614000000038a59989e52d272ea9acefee6cf876cc7bdc39cf0ce07d1ea1014425a5e073e0f11f103b15a76116f2c98ef8879437436f676b00a0b189255fdd4ec293c41e1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410951520"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2876	2512	iexplore.exe	16
PID 2512 wrote to memory of 2876	2512	iexplore.exe	16
PID 2512 wrote to memory of 2876	2512	iexplore.exe	16
PID 2512 wrote to memory of 2876	2512	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dac54777dcee37fe74c7589889d340c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1788a4e48dcd16662ec1a5670815ca08

SHA1
d1dfa4620ee4680e2a9894f40aa0cf3025c848ff

SHA256
aee34ceed7487a5dce094ce1edf1db00bb491b7f68123c255239ba296a9afc8f

SHA512
96015f30c901bdcba8f414f2eca1b3098ee57dee1d4150ddfc5f6e107f3a31af9419c44663e04803a03533cf16c1dcbdf2b0286ccf078e19f6a862e741d92a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50f9f9528748b55fb5f8f5447f077ea

SHA1
5c44c1557be0780ac4ae23bb93ac7b525c5b8f64

SHA256
d42f90436e4ab006b75a54619bd84c71821a9d30e3f012d7293cb03fa24ab755

SHA512
ce023343ab845263c1bbcfc2f7dd4ada37bb4faf1ac7ac71973036d57a52c45c178a95b817a8bd11bd6a2cb5b3e70155af5db1c62b8635de66f4a98ef1b8068b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4079fc99b44110aefbb4864ed89ae31

SHA1
aa4cfec6732c8714ae099f60f382d40b84f9cb98

SHA256
4928cc5c162b8c3759baac3fd37821a4f6472f2ec8feb50716b9699d4213aa39

SHA512
c4f625c0d22801e03333403684e3fe0adf7eb8f679827df2c6eb06232099caeedac285a502d6b2ce5b7e279ea032a37d496171ffb0b8b6432085e3807a053c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78302769a6677be6be8fcd987fd87cc0

SHA1
312f131181811393c974ca3616e16073bdc30034

SHA256
de20c08d2b833abfabe5896d39c4fa88a9628907329a5af036877f682dfa38ba

SHA512
e86fb2ed3cd890adcd206ccbacac0a54d8fdb6746e1e6f4a5f5964b14c26331782bb4451e040aa154764c381d1ec93e4cf1687427113004c33e3e434b3682a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
321453a05f8796099bd5e495944add6c

SHA1
7408751b1922919c12ed23e848e0bff3c202ac18

SHA256
8a5f27d66238fa69509911b077a5e5ee532fdbe7d44fded845e26e33b691cdd7

SHA512
8761f507e833319aaf232fde8f8453b35e79d39d96d67818c6f83e344a6f9eba092eaa0fdde6d8885eb41c833254a67c9e0d23c2b61069a5b9e48fd932ef7217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e59f24566ed7102d02932d0fd0aa1cd

SHA1
9982a210f79bee4c4df98a2628ef4ab743f6ec89

SHA256
c80a9dabc2f3ff1af1bce8f81ca9ec8487a12576cebe7ba52be6ad1dbd01b4c3

SHA512
5175f6b7d38972b08f428c5709b0fa8d4980b4d662b942b432669445280fd791acbb2b68ab3724924a0b4ddf3f1502f75861d368ce0a3eee1c0477bd7212950c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc3a31abf3e54c0ce895b0486ccb4ff

SHA1
783cd5b69f4ad00861364e04c387bef85b4d80fb

SHA256
3d4cef11e322d001d18efdae478b92df229ec51fbbe61d2177885a952de6edf4

SHA512
58447a519abede4754cc58834a38e99ddf1800f982608a6d68b67f5d0f9b750d87d000c889173e94dd9cd35db2bf6b9e06898588a5be3081ad5bedb6c0b48b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a35084c1da4dc1b0a389dc32ca9f2ea

SHA1
99431478f9cbf935ed5cf17788e4775d6c9fcee4

SHA256
b5bdd8c9c9f2a61e4765ca5b59ff087882a0a196d7c8b601fa85c586ad77c75f

SHA512
bd12fe6bbdd7cecc9e996bc31c274999297fcc8b2b834ac9a1a808809d7c357b1ed2e5d3584140a94ce5480d5d606c14e93c51d5665314d1d2ef4b15521319df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf299d3d8a5fca9882e1caa7ab33d24

SHA1
fe7f82691a8589976b481c599a7e21c49d50a55f

SHA256
36bd36a6c2e84765c8b8a81eb949191f15e9f068655e7eb2624841dbe83686b6

SHA512
03c5f48eb04072079b7691aff27cc34f187484516b52b8b5366e2fb6a6524a1e65a23f7c54c8d88090c605ef42b113cfeee2dfd71387ad1eaf7a62911502a299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81a82fa4676bc22d28aa739834b3de9

SHA1
a69df08382aa751c2821a90a0448d087fa046a42

SHA256
2f280b8db6022ea895bdbf2818dd0bbb81892edb6c9bc74b8627b411aee48fb5

SHA512
a750d08fa23ff14ff36a19696d3afa30a3d7062bec94140685e09351b8ca4c45496a4b4dd76beabd1969cdf90fa510b00e5ba83ac3f0e24b677619b5c6209ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d67574285e6e153bedd70555133cbd

SHA1
85de06939913817ac6fcf3d09e572a3e91b65667

SHA256
d600eb58d30fe38e689395d2545ce4e829b8348bac43b293aebd74d22dba2e79

SHA512
7820ce02e2ad9fb53219499d8cd7ada036c732e5ef5e7035538883b020b5bdddef1cb1dc58ddeeae8ab4370ad5cfec4b21e8ef607762d3bcf563487a492bb163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e1f9ed985dbc407209f1c78cd1e6c6

SHA1
4a9bad13465cc5a49966038541fba0d0c988ae2a

SHA256
f625ae608bb49e2134c99c654be9757ae33d00aa0067ee1bf6ebb13e336ad60a

SHA512
a22c0a5444b90e22e02000836d1b295449324702e812a933af40dfd6f475fa0280e482ff7b4251ab8e297888ea0279bc947bee68cd54afa26451954f858df0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2474.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28FA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit