ce6403e5f777475a5f8020290fe115d4f5e64dc30132c542116ca5aea295e03f

Analysis

max time kernel
242s
max time network
282s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ec51074e5a3eceb64f8b095c65c97cb.html
Size

140KB
MD5

4ec51074e5a3eceb64f8b095c65c97cb
SHA1

72f4bd37b55831928b00a0308daf462c0fd73658
SHA256

ce6403e5f777475a5f8020290fe115d4f5e64dc30132c542116ca5aea295e03f
SHA512

0a74a456f5fe2a89640fd183cca5a0d9af1443d6b53d5d7dfeb8fc8a784429533bfa6fb3495a70b60b0c878ed4fe8e916c65480c80b7e606beb27285cb088e28
SSDEEP

3072:W1yVz1W0AUggdafyPYPGG9lE/sMEmBklf1/75B2ty:9YDXtJ75B2A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410978985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0375eae1743da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000047d4d17f56b2a8bf92925399145753844330be714660c1cdb2ce1ee9ef73a5fb000000000e8000000002000020000000d9851e753a1cd7b0c90cca8016c083a5ba13f89d35604aab4f176dd7c4a734f3900000001ec46c41b4304addeb762d6401bd7f68018cb130f61b39fe371259152fe882f4cc0ec7580895832428d2aa5d38db774c4e37616b5392810e917213d6f06b26660a9db44b2862c3f665bb356c6e6dddaed2265aed402f9b58914ee7188ca142a2c7b155b48d457134c9a84738c8cbd582d0f32da297b1c49717ac2c64242b5f1073a81f6f112f17d368913fe57840546d40000000ef327e055dc1bbf212f945d99d3e73fb98de53e0ff989cd5ccffb3d3896d62e31a9303d5ef2a526db52df87ba4b335bbd129e4de89104d76675d5d57f6432c95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3AF06B0-AF0A-11EE-B735-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000004da90aea36050af60d893faea91e154b0c4040f4512963881198c9348325e1f000000000e8000000002000020000000ef80b567db647b833d206356859c53a7a0cd8b9600fd75b3add1871c04670c7620000000a68c52d4ec7a2016adde6449c6c8379187cc59453699fe5898ea491e883bacc740000000de57ccbaabbae5a1242e16f014dd03f8cc93f97e7c344347c99a2d1ebff04c6163dae4281897a0f0d502e118a8bcc243e3dfd7b72eb6f80626b4bcf026d81a4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1712	2260	iexplore.exe	28
PID 2260 wrote to memory of 1712	2260	iexplore.exe	28
PID 2260 wrote to memory of 1712	2260	iexplore.exe	28
PID 2260 wrote to memory of 1712	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ec51074e5a3eceb64f8b095c65c97cb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d4b0075c39e3bd1839cd779184528a44

SHA1
c6f08c617cb1e71b30209ccc44d6ee8455cce41d

SHA256
d4c441f4325cc713b9d25b4744cac12bcdd4507bb43a9732e14776556143701f

SHA512
094b5af41555419d986ea6ec6ac92aa2467ee6bbbd0db362496c539d3842decf521be865821a2b3cd9419b488e3b05a347532b56917e7dc4d21697553c8f6182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d2f875e67a7925c7a6c4ed77e9cc3dd

SHA1
bdcfd0103bf56030bb60530f36bbe37e214f0cdd

SHA256
636c9ec630dda29c72c9fc19412d385edd4423235f70232e3502ac6b6547d4be

SHA512
18866604f6a907759d64647405239ed54b5d187fe30cee47cde78d19ac7070e7528163424e7dcc4b919f354eedcc3b413bf772a1d3183ee6c2379dace9faef7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581a378acf0fd83381db8eea6c03a580

SHA1
b66689b82bad16448f20df1d2f0099fa60936974

SHA256
3657ce47f74ec8d7d288801ef28320113bc007aea58af9ab5fdbc1fe76b99f69

SHA512
bbf7487194bd4166843dc2566042dbca53f506a1a3dfc10dca200893fdafb08d2a38a8d4babd6bf2faf3ed836124b8525bcb805a4b1054716ea399bf76fb1788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8f0e8e9384029b4e9ee146c7398cbd

SHA1
57abac526204fbf8c17deb0d7dcc452d89711b3b

SHA256
17759d9c346842ff3a2336a922cc6f67e5d0b763cd0a8699a5e79ce0d734a12c

SHA512
334473e48bb1f87c046e76bff4f0c2c5de4c75563628aa527bd9143c2ce9fa7b584cde572b43907a57af6befda347621d7e0a2b6f389d2037a030c571225d7d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e84db265a149ee4f38503a430b02a9e5

SHA1
9ef8f7bdfb6f45f5a3f6130d1ea309eba8826822

SHA256
42dc5b4401534e592b19c8668b52aec7f5054b90465fa7b678d63edc10ddd3ee

SHA512
14e1a023b187251a8eec099c4711883a18d7734d190db3b7f6d656f05fe07bc14f428c9c00b119e394ea70d7407c08f0676bee065f7597b34db712ba039b6836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2201af9f2d7486810cc3ee0da081ccea

SHA1
e069077b7984f51fe2ee9fd30b1f87471ca63dc0

SHA256
ee5bc3dd71831a6cac924f3fe483dfc76f0b374775254506b6c4da9b797ea761

SHA512
1b10cd0241b36c858eaeb30579c2c5abb41c54916973479f06effba03d0f9f9af671150755725410804b561280e923313fae7334d2e35951a6e84d44274a5b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791000dfea92909036299633541f4775

SHA1
8f720b775781deb3605a3ea3adc49c940e380163

SHA256
956787adf1a55b0b236f9b86ba75ad1b78879146fcd44907e0aab7815cd2844e

SHA512
36c39feb2949c1cc7907e7c2e4cca0685163f3146e9a34b0a56a853a0cb6fc0a6ea2c0b202b508d9ca58b029b9a5e285f43c5e4b54c1a86b0f9e03e51a126d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
063921bd5cf7ecb699a88755184def48

SHA1
e7b3cf8efea2cbd86e021a08bdf7772b32d5b307

SHA256
477e28adfa9a8ca3a801c5c2e1e2fb6cac9ac2238c61ea7128f066b9bc48c8a1

SHA512
dc5389f6ab003d4a2e8f7282a28b243a16eac38508250482bc32b62040c06872e26f009c4a509aa39668240796b1fae8906c3d95e926482f1634a483333a1ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e80e98c1e89d55bdc0c6806b32d190

SHA1
f3047ad2fb464e9eb1b1e25344e3d60187df4568

SHA256
71e10bc10afc841e0ad2452e201f4e72d362838eb77baec8a4d9c82f82d58a9a

SHA512
9e5291dd09c3129781f63d1a5728fb6da6daa4ee141aac622717521c47cfedce9bd394f7f5f92fa0c55be082a332c07a54f182dad09ce0c0bcf736552cecbb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94284d5ce2cc38cbec0c356b34d78dab

SHA1
71c2ed12f1ea22a7b8e54da6ddf001d457c791c5

SHA256
38110133b5960942a164a9ae0ea4f3c4c99ea1c439b2214cfa165063f191b18d

SHA512
c8c58e124d5de9767b55badc82571064da96040c75119915b4e642c4aa14d890a57a07a973d24415e605992c4a5094704266714a32c8ffbd32fa4ea14800a0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a6c45168249dba8036529aeabe3610

SHA1
3d37edd6294bad929393fdacab790f4f7f400ecd

SHA256
ec06f715d946531935dde2dd931413a53f8f0ede9f6d72dd78ed0437640d7183

SHA512
89049ce02056099058676a8900dc57aa4cb2f53c399f330e0b6779fac20e6c177b7c9d50b13c3a133dc1ec5de2debf1b201ed244fed0462f83b5bafda995b25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b5550374e39015b99a763ea37600c9d

SHA1
3cf562ab40a9b8b46a07042eba23b6cdcbe1a699

SHA256
65e6944c43b780d49df1c7292059dc6828d5c58be47d9253e7e327f96a8ad212

SHA512
09d98344329370c092407133f0853a7100c3736131be3d1b67bc8806fad607e51d3ff1df061d24b6f8afc1214a2c50b0b7e8df170bd0caab78c70f331c46f33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTTGCPI6\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80C6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84DE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit