a813135853a354aaad6e303570f0036b016ea6bfb367831d1b5c6e6962da7751

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e8189e23cde6cc95f41d9083302e52e.html
Size

3KB
MD5

4e8189e23cde6cc95f41d9083302e52e
SHA1

667cad1a787f9fc5ef30a63898be9c0273d4fcae
SHA256

a813135853a354aaad6e303570f0036b016ea6bfb367831d1b5c6e6962da7751
SHA512

62795e305a3565dc9d8055fdb19d5b22c46efcb77f6fa716b0d61dfd1487f0c9ebc8df90396ebde5e17681b658fbcff6a0fe37f825c3703c52e0eec92c172d89

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000aeb84a162a70adc3a0c113d7307db753ec0c696c7ae5c3535ed90012ce4b34b0000000000e8000000002000020000000914daf1073dd85f8c7755c913943c5e7aee9774cf8a319bf14868eafc0b0f61390000000b5d8a070495893b1911cdbe7696590424e43932e1cd75ea009b6bc50516962cac34139a6e6093d5250e16fadade44feebe30b04162f43719669b2d5486d37a490e19b679fed813dbe0696c8d1a4981d9f69e058f8bb5a7d4b20ed6f670133f918fc6ea51fbad58028d7c4e097cc5d370719bc7d26f9a833711b202ee20383a0bdbbe91f1ac1dc66657dfb7219fa20293400000006c078ca95e93ec9af937b4b05a167fbb9fccf6c8e05ab136cc30b0a2910fbd91465a64adbb82289ea3c0140ec2091c86c9ba41f983babc22ae31e2fa998bd580	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410971197"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d086e56c0543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{949C2E91-AEF8-11EE-B218-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000768010e8187ddb096baa32283ebe1086bbb2d7124ae55e812e1f4899eb5f0658000000000e8000000002000020000000c7c6638f80350a3fc1b12baa87ce2ad850e654578469d31c89d69e328b3e147620000000e20ec1f2eaa4b4c5bdad0076b02fe776c5c3d0e9d8ae75592cb051bc220216c8400000008b22062312b88b150dd5639c37968301a0dfb1fdfe747057fcc41e84ad242a689c24168ba688ca833d8ba60fc1b2cfc04472c48b11acacece84b558e939311f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
320	IEXPLORE.EXE
320	IEXPLORE.EXE
320	IEXPLORE.EXE
320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 320	3064	iexplore.exe	29
PID 3064 wrote to memory of 320	3064	iexplore.exe	29
PID 3064 wrote to memory of 320	3064	iexplore.exe	29
PID 3064 wrote to memory of 320	3064	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e8189e23cde6cc95f41d9083302e52e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd942bd9d1d3030c3ad8171c8f8f203d

SHA1
a631692005b892bb6b405da6473ac18d485b79a2

SHA256
00c3be2e252d033bd9eb29ee2b2cd24401fd4fbba2145385ea1e4eb7f3c933fb

SHA512
2f897c0d0761e5db32b41429fab5fa49e3e3160660b22aab97de184c1dd09ed2e9452fdc3046ad1b060324b2d0139accca7129f01b999d30b51312c7ceac5da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6175c8d08596d2a3b4bfa73017b443

SHA1
00a9d99311f68e625b30a8acf80dec69a9b60877

SHA256
36c181dcd228a0c682218a1ba24da3d971bfbabebbf2dae4d9b5db097fc25b5f

SHA512
aa92e6be6fb47f7e5bba1f9393effc2970029120a1f7f6bba91419685ddfd691bb99cbfdbcbe3aaf8647143ffd76abfebcc17a83267a2807ca38be4106ece04f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20c27d2b0da831e15d82ddcec3dc779

SHA1
31a8d1803e1b2a9b46f16be6daf0a7fbee63349c

SHA256
f8f494c18dd1375401a2c494df0f46d08c4bdce258c6559c91a9ee947e4dd515

SHA512
4909d027a44e5dec482dc254f29b96fb47c61a4c9ddd525d72698415e666a63ab56543e0091bd40d92fb900a95e1c8e02572e2ea34b2801ebc2b8c996b5f339a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f8bde715e7eb7b9216ec96340e2d23

SHA1
df1c058a965e718facf323fc7bd2bcb43d380a7e

SHA256
51b1a160acbc870c916b495cb4fb79bf72505dc414134d3fc54d8974082d5551

SHA512
034ee40b662f22d44e9976394d3bb5d9e40b36be3c14812d5796184ea22f3d8988c180d620811f6af300cbfaf041b74e926097d8255b1a783a88b7b27fcf3f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee844e8e0796ad048a892ac6e622e28e

SHA1
72dd8468f7de789eec67058805cd93322af616d3

SHA256
1f30bccf2e5ce0acf42cf20d7b28fa2bcb8693546b21f4fcdb965066543b5774

SHA512
8bd329df8e14c54ac06a7475ef4f905da9e99116296deb8b06495813c5a9ec0350eb3975e8062160b9b0205bddd9977b44427bd772b4c07094b9a5f033aa0a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f1d179a2a2425e25601f7c5ce9f86f

SHA1
5b1bb593e22022a4d0d463c11ef3663e56f01d7d

SHA256
b90af9bfa714a960c8dfb0c7a255d509fcbd0169b522a57d543ea86a2d84204e

SHA512
6af3090b2a2c3ae675b5a64ebc3a71b76c3f5da2c5f206a645cc24f26a72cb8891d53577b281e1c59e300ce63948e72cdbe0e05ecc3f9e0c7c1550240e911561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc708d6237ff7b15bdcd3b33f054fc96

SHA1
bbd1d04016966bd0ccc8386416f51e1f5aed5568

SHA256
fb43bfec7cf21c352bf941d4ff68423acb7ebb9ef4ee94780d1010e3312ff481

SHA512
8397d5e207e8d9f6c2f19af438cada74beff1035d962917b038dbe558e43acbf5c486e364183897a839f07fe4a04cfed308ff1cdd8f3908c3d26a82e7aeac58c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2be3e75825f4db60faed7372e91399f

SHA1
538bf38bc3ce64e909d87a2bfe2c2790ba3911c0

SHA256
b4162310d1aacbece5fcf33d8ea4f633f207cce07de9405b32de2edae908d7f4

SHA512
0c9b2e55cb678bd5a2e573937f72630879e58ecd0850114d237e50934a205de5eeaef1aa5caeecece330198c53ff337675d711f130a864777966b6bb719e97ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4e3a64bc1865ce15a3fdfe35fd69de

SHA1
a227ffa301a1f7770b7d28e2ed24418215a90592

SHA256
c069e3cefe477da3f2c388f22dda8a8e61276d32bde2fb3d786d41969f338158

SHA512
1f27321522e22be849322a8baeee55dbc4008688fdca1042fd9a6d72dfcc2eb3765f46c7d000d7679f92dd4127fb644320f86806e6ccf681f97de93825a1f480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e452dee032d5a61c0719db25ba7eab1a

SHA1
ff8b5d29711248c108577287d73a0ceafd7c3a28

SHA256
f5a9fab1b7490480309931abe6b95025d10b8e2cbf925c6b87f527097c6ff2dd

SHA512
0f07d72223ff5adf133967d3c61669110b196b5f3f064f39d7ef87b04f2c9b788b1e2b9787d27320121edb6da656f5e27dd0e3976e8ad83c15fbcb84475b7fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0032321b239bc42b28473d8a958beecb

SHA1
c531df4c5923864bce2d976a845cdf7c63c92020

SHA256
ae5b725aa77fbf5b7cd22b060e53f94245dfcd6dac8a09b26d84522a1f93fd45

SHA512
13e1b16ae6f4bc7aa137987c9ac323192aa0988f8633d30c87102e0abc63973a2195248b6a0132168f555a11bc42882d24778437edf0e01c3890d2d7bc87e37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A45.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3EDA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit