643aecc0b2f268e03671c97c14a679ee324c3ca6b3e513c8fafb41f3a6480f5a

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e584dd8d47b885478cf0ec194f7a8f6.html
Size

4KB
MD5

4e584dd8d47b885478cf0ec194f7a8f6
SHA1

3dd76d7bba73d058bd34ed224e6ed48cba08ac49
SHA256

643aecc0b2f268e03671c97c14a679ee324c3ca6b3e513c8fafb41f3a6480f5a
SHA512

830695b8b35cf39fe4757f0c3a19765c73f9d9acd3e8e3bf459e8ed44db6a788f962e9ea5b5213be874f230e0a673f0f20f2faba90cea44e2381a47bc1ad7f2e
SSDEEP

96:rf9seakGiwLsvfpFFOxUEKvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIatvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000000d68f449ec250069532b2a991b7b8dfb843e2b9e16d9b3760f4790cdd4dadf1e000000000e8000000002000020000000641df8244ec1e5d1d7d3a93299286c624b2ed6830304f1e7b269edce605e71c720000000ff11981d79d9620c6af4bc6c7100ea5e5adc5dedce69eb6af99b0bccaeaf0596400000006abdcb23fd2ead840a980b9f15a827a91d4ddb8e5746621d0d9c9f1465bda2af08e68cd871d52497dea6f5cd53404e48184b2a23cd7a0a2a83454c26cf418c18	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ab4a5efa42da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000009f22705de7fe574b200ebe5c9664388b749a46ff1c9f0e65e08609354e05d96000000000e80000000020000200000008bc017c24714fb9fb5c8be65c7082a118320944b0c60fa217ab0502726ee791f90000000a323c1e040264e4538ea174f6ac4963e0f299e521b763a413d8fb5fc9fc6947eff667426d0c7f67eb58a543f3e97f99b023468b65ceca043598b12c0b389227cc57b2464d6bbf3363322025f0654352b79dd46e23fc0499d7e0a179165d243bfaef437ba1e42f0379efed980481c4fa7c9b287117b061adc67c62c1e58365206ca2072ad713016790d15a636db7a620f40000000b5abe35f0af26ed9d8435f18925448b69e925facb3dc1127303e0887d97ed187f3f761744e5364c0ab38381058e610bc448af94bd57e524f5fc429705e55ff83	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410966448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8997DF91-AEED-11EE-976F-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2424	1652	iexplore.exe	18
PID 1652 wrote to memory of 2424	1652	iexplore.exe	18
PID 1652 wrote to memory of 2424	1652	iexplore.exe	18
PID 1652 wrote to memory of 2424	1652	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e584dd8d47b885478cf0ec194f7a8f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fad3a1a195535b747634292cca3790fb

SHA1
09bebb6cfa6ffc462a5ad3514a993b654a0cff77

SHA256
0dee9d11a98b4e6ee66ad687550dfaf97050d23f7c02a49416dc50f8d3908f1b

SHA512
5fad98e8be9789378f3cf9692e2034304efc9c805c934f52fb0907939c00312c3e45124ec85832b94fad69027cace9c9edc743d16920437acfe92492a3599f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
773bcc0ef6f277eb3cb747e6c8d09a40

SHA1
1d311ae5f2cc8621652d387dd5ffdc8e15669af9

SHA256
2910ee5542974c3b4400d830470a24d100c45cdbd53dfa43bf4615902b473081

SHA512
3b765a4f9355edae9ea3f57fc4d897aca5067a4fa82f2f7975ce0a85bf73e29060c984e7fc788b14bd9d0777ae725c45ce798acbc3e7090fa8978c2991ed9fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00ee320075ef76543bcc87eb8e1137e1

SHA1
0761e976f617eb3107587fc084ddf15dc744bc71

SHA256
13ce2ba54f980af3c41431d4d05264cc9cf394bcb62b0357b056ec91c56a3e8e

SHA512
3a9ef8cbf94d75d624622e9348add1009dcc39208fa96775d89c6a421b55a0ce800ce5fdf29cb65a44cfffdf2fe39557da3587c50af7859c6eb4dbf07c37455f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d122cd97a308e03b22d29027490eed

SHA1
38a0198d415ccc8474d774c5d8527559d9ee218a

SHA256
2fd2904ff42345ed2047409b208429778f8158a6b0ea950e779962ebd2244391

SHA512
9bd6501b5e170be6be2cd02e4dd130c79204ce2e1f546a08babd503ddab5338554ecaac7be55fb12e0789b91d948515eab588af6e3ef64488fcbc857d94a5abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de55362c6631c3dfd1073edaa9e729f3

SHA1
43aead711cff9566967f496fc0bb92d996c160a4

SHA256
877072e6837c73e93712e68d5dc8f78c3c4e54a23d06ed40010e20610fd7c116

SHA512
063d0a5668e222f3890561856c194cdd9124b188ad1078255295436b39a5f90939701803f8c216ee7e3c243654054db8eceeee6cce0cf2956c991a5b0367e86c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55fc15f66ea57716eda5f699bb34ea7f

SHA1
8221d1a48f429451087db3dfb6869dcdcab8506f

SHA256
1667d3fc4546dbec8a57e372536e637f729c7c2e5d36ab8fd11a916fe2bd28bc

SHA512
a3d06f80324593a6a24897c5b1dbe373de9b3793f053da1c05f7b42bdce727b33a58487275cced8fd80856fabc2bdc241221dae84023bcbb116505927080efec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ed193209855583576fe91110abf357

SHA1
54e540e614174ee756ce933199c933ee97f39fd5

SHA256
ff6710ccb22bb5f3e66ef3b8b5e3f3e47706aea3cb354bfc8ab6be8786f79e97

SHA512
c863492c42a254b4687382aff053fd237f9059e613e181d835e7a08084d0aa2b582a4e86783bac0e62c7bb85bf745aec7c95ee762a5c371baa713da212323b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3548a64a6ad22a08a1acd3f83d4dfb71

SHA1
31e3c2962f48bb8efc2d32f6fa28b3bbd4ad6edc

SHA256
b97f3f73e7a5a8a4bcb5ddca876b880e3fd3c57f11dfbe67faef51b8295538e5

SHA512
137347166f9fabaa9ae55b4ce462ec251582306cf657532abd2abe8aefe490e9d3e8c0d0e16457a64608e27d6b892d57d820363922f49fbc89fd4057c2b5960b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e9376344a2607c64e9dcce1e8da58a

SHA1
df78013799fec75a6ef291b54def53cf89fd9d11

SHA256
ed3ec6b6dec67181f51dabc9bcc6989643291f4a03548db56c62a4a8f0e75367

SHA512
7622204749c84c7c26656161e7d9836e15e52fcc1ab31b596f9db2b046b498a8b4a61bbe5b7f56dd2afeec1a28829a869194f9ef37217ee8067d845fa492d5c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc793c7704bb088e90a5ec99863daee8

SHA1
c9528bb532ed8b653b39524fe4608120c82dbb3b

SHA256
aa395861e7e9938677fd64ef06cbba8473bdf2c3822df6bd05a09d01f2140d08

SHA512
2bfad7d7f983bc3393df58c6a2c69c7ba8e898185635ed765ddc2e0219d777094adabd2d52db60694dab9a9d1eb7159516a0dc106d5f3abc3f7a00ef474625f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A70.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AA2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit