f89eac40871e9975192073732f91b1ba0e6023f65f0ba31c166bcd1be3017580

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e6d4062d259a7b779360ccfd8a41945.html
Size

893B
MD5

4e6d4062d259a7b779360ccfd8a41945
SHA1

0dff5e79bc2315f6844b89bcb4921e84d9b9847c
SHA256

f89eac40871e9975192073732f91b1ba0e6023f65f0ba31c166bcd1be3017580
SHA512

a0eaad4ce48f170f16606cc2e79b08351b87c9a5c2498f56f9f25fac9a6a271eb1aabe5ba3e38b4b340688c7f4f6be055a763a722b01cfe650ad8994876b3d96

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{067B83E1-AEF3-11EE-BA54-D2016227024C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bada255355959cf466a648031c544b657e265da925b7d56c3611ff2011648086000000000e80000000020000200000009d257b7f71eab8df8e5be39bdef1d5d7fbd6751fad22a5202d81fb950f4a8ae890000000b06e7c752b0f9b5f001cd3ce103ddda5130c79a91bb291915835ee7c3ab1d0831e3605008605ec196055f5173c63c670ee4de7dda833384364f21b0164e7de8c1e85008f1b12e2473af959779581ee6ee1b4f1ca6e62312448a636c4ad1bca841f9cbe52ca31ac1ab89917eb04bf25f26b7bbd6412834970b67cb27d0e4c7850eb20c7595673bab9c6d21aa1b0063a1540000000905dc11667aed4d00f00b64fd91fb7f1422e7cb04d8cf4019e774225e1a2ee0980d7a92c6c94d77476e3a1aa8e9a1a4cbaf956a3a38027458b99dca7e66802be	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000089bb61111ca0753afb313cd097f86f45e257a1f47b67c418face4d8d3fd9342a000000000e8000000002000020000000be6b4b57724e3bf54da67fcde773fa548700e4e24e7260a7e07af05fc7d26e072000000058539acc54be48d45fa7996628a5666c8b5cf7ab30e6bd906313f27b8d0ff84a40000000597edfa966ab475438d306f0a47d3a1feb6aa1c7d43685f98b8928b0ecbe67f339f8f89d0414776d474256b484731b2c5cb1fa4dcf18efcee2afece9e6ee0803	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05f03d6ff42da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410968801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2236	1640	iexplore.exe	28
PID 1640 wrote to memory of 2236	1640	iexplore.exe	28
PID 1640 wrote to memory of 2236	1640	iexplore.exe	28
PID 1640 wrote to memory of 2236	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e6d4062d259a7b779360ccfd8a41945.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf32c0c20dc09e286d46974ccc2db3c8

SHA1
d0a8b11293137d569194d87652f32112926bc2ed

SHA256
10c2801c4c0f5037c727c21cde9653119b5257aed4e3216e1c7a72ff4b854d62

SHA512
b7965d453431d1edd859da7e0994c7e1104714567ac8104a926db774579e1f2b142d2df963d6acbcaa4b0c246a42f1c966ed68db6c3fc348ac4d70a10cc04dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
605bee707da7aacf4c79d4e005d2bc97

SHA1
1906b30fa327dc28bb87176c3bb4e29de44ad65e

SHA256
d1fbd663cc0b9b1e003d91d5ca466181ef4ebc7f466cf6d7b3711272f58b59f9

SHA512
a1e89e3ea677f08339e00a9cc7d520f9ebd4ad162dbfaff1584b658f8f9b65cca47f2bf55d0231f364d5a2b83e2d06921946504bf902db5b4b3fc19e033cff14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2439ed2f599c7d18a02818189d47e71c

SHA1
2aac78c8817240a0e7e62b47248ed4dd82f56531

SHA256
a5fd7ce6f523c3483a32519655e010c505bfa94c8115c0f27be0de94806ad525

SHA512
92f97e599345023c6c3fe61c74cfd8900ec368c1b7898a37e8c4abec652eb65fdc65e6fbc207c72433d91b9d252c86d037075c6fd79d8b4d807f24fc166a0e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68993f5feb7bd3deb9d021f6b21340ed

SHA1
85fec7ecabbdf3bb7f3f97b59fc1ca3340f93d13

SHA256
67af6232ee976a082b9a5cb2d599d0abbbd29a46ebd0f59e6e0cda2b429e2a3a

SHA512
e996d580de1534a6713bf7a94095229c33587528e273f4f31785c00d8a68a018bbe449882338a21a89a7d4fbc9e9b194794db298ea6fd0faccc985fc3d9d6ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbb977ccc59313664833a3c7a54cab12

SHA1
bf1f8fa8369c5c20b062554520efb3d6c21df2da

SHA256
794417cfb14f7f8e8b2bfc388d2743bbe6d415f0330f9e80063b90405e32b45c

SHA512
6640c9791bacdf3e36be4663b182ef6649231fb1e7781363ca1c0959742501c8b54eab09e0345213fad2d05e8fa99d6949fc62a2f81eb2ff85ed90d76200d3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28f907d3dbdaa6ce9ccffd73325d7529

SHA1
5a8e2da8ce4c90fddbbd887b3ffd5b443bc36f6e

SHA256
a3b3be1aceb6e59d68759fd0eef59fde18a483a3f9fab5bd1b0c83d7d33fbfa2

SHA512
f42a32c71605e621e3ea45db1feeeeec59736404e2f6fe25886d2548e9e1fa7381e6e0433c279eac8f2b537e3a52b75e8372222e4afe415492108c55151fc1d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b442a1190046c969f36678e15a6968ed

SHA1
2539ded984d394cac2d757a558f42047a0e6f28a

SHA256
3dc242a04d7a89ba0b5e048907d9881cca0a6639fd4459e3105e400010084b5d

SHA512
468662f18e602bc8556a77b3260cde2751b4dcf62e8288089884ef0d2a03867411dcc7be01a4fda13ac7ecc18dd57e4056ce9ed1a740d6f06b7ee3c2e9165c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d30c9fb0008c9c96b8d7934980b21d

SHA1
ed6a9eff478781b5dd8185084fd0b09814ff0c60

SHA256
b6b5b0e0305aac7ddfe320638ca387d86410578e5b7234bdd721bc8779751da9

SHA512
19406e871bcb96b4761c87ec39a3e08a021785bb0fb596de04f664a69d2fd2090a0ec57a0d57db51bb20c6583bd02d41fc578170d22248b1f0e0323e798bdbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf3cbae89ef9abdc43845c1af1bccd5

SHA1
43c03158ca23b4ba72ce676901470f9c13fb51fa

SHA256
02c1c3a13fc9789ed5f6fa78514030b5005b80ae168f85878137fdab9032a43b

SHA512
2159bc0cfb21096d2c3197a9c518b2c970c5b423a70c23e2dd63cf7bcc0fab5d5b2532e088dce5ee604830b81cefa5180f3fa8be907cd227cde50b1e2e1f397e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7209b1485a86c01728216988f587ea33

SHA1
aaf78d6590b8615300f8f58a95570643d9ca573d

SHA256
e60515de9533c13cc75dee875a3c36b5b567f132d0940c0568878c54f9f07796

SHA512
785632eca14b3d4cb28557660da85ace37b588cea664d94fb11c41c802f5f9345b56f7da45df64c50acbf99e94947dd9569840273452baf67ddff4f89b6ce5d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdeda4a70a2c46116d9adf7bf4f043ad

SHA1
c7a4220daf00d0e08dcfd18846a0ffaa08b4003d

SHA256
cf1aae38420d99a9b3f2361dbd50b5480804fdce0f1f5fbae9aac783697d1175

SHA512
f473bc4c3693d59a3c8b8bcd28dcb6ee0eee64dff26846b213eed1a1c84be66dffdcbbaf50c44b1e17e8c0d4df7ce24334b91186027c378ccfeb719af39bfdfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d7f8bbc91dc37f1a6c12f4f32f63ea

SHA1
8a6f974ef56b1100344bb30ce06eee45c69776b2

SHA256
0e6d76b8af9db7644910763cc553ea084369aeb09e8eabd39b999aa3d1ca5c6b

SHA512
ea140e941f4d65639fb086b74fc3393c4c0c61002d68f54bef9784297523a9b36bc766e563fa09c986a3ebd145dd52445584e8dd068b4138c20379aba135aa90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

Filesize
1KB

MD5
a53f48c1ebdc9c3c62c4a058bd7aa016

SHA1
a4daf0f078e410cc2fcca63e8f46268db6f16a34

SHA256
0c5002d926c847420b6c706442e6d30599b992bf34708dc5bbb00f80dbd12b24

SHA512
eaa2e1e5243bb2f8d5cf61a9c23c3d9975eefb462953639940cb82daa76b1264e11a6caae9db99728034deb4975d725f269e18e68f65e1ae98b1de100a056094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab97BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar984E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit