886c0c1b41be81048caa5f4fd26b092c12ec69f8f7639fe4f78fbacf68882b42

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f015ce559bdf0e29bdf653bac0ff3d7.html
Size

29KB
MD5

4f015ce559bdf0e29bdf653bac0ff3d7
SHA1

2ed247fc0443c7855572fbefe1bf050f75b5c4a0
SHA256

886c0c1b41be81048caa5f4fd26b092c12ec69f8f7639fe4f78fbacf68882b42
SHA512

fc3ee27c281b880a45df9922e7e5b10b502249876e0b39b5eb022d201015959f5068407076eab4a996f0dc7ff025b5aa360da971d1ff38fd73609e109ca517aa
SSDEEP

768:j2aTpI8Pdr1mjXAt4RVHN/YW8p9O1oKs5EKjVudI9e:j2aTpI8Pdr1mjXAtGViW8z8KWI9e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B6BC911-AF24-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d564e029674266599e3ba509957f05e78ffe3238e7f820bb8aa56166ac7674ed000000000e8000000002000020000000ffaedd75739a390b631248a27f5fb122855a1caff9ca80edb56822b44a72a6bf2000000023fc5fa9d6787cbc77ca7a4b412b3ea9c41b6af3f4a0ade16b91caeb352b2d104000000033ece97bf7d6347d2b031edbc5adf846f0b11fdb49f01afe01ab5329fc93abad5f5a6f4126e87ca9aa56c17ad0c08c7e993110a87f4d7634d78db596bd9510ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bc8c3e3143da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410989993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000012bdfa7717907975a3086be708f16844fe31651fc791c2af88108c2305cd895b000000000e8000000002000020000000227127e7cf6ac784a760d036d0a2a76e7a8de75af10fdbf647b2c53ad12ef441900000002fb2aa8da05d42e51abc5bea502833e051c4351a603421fefc3fa60ce2c9331ab196461157196a7818804c5911dbcf862242d38026d71cc3c53b486c8ec6b274773df3ce98e63cd6ff6ccc7143846805bf38463412d01c9383ca045ec41fc588ec0026a00b8bd87822605bd27cbf699333872b3acada04085cf9de6ec0572a693ad9f67875a85024f974caf4127d5c02400000003391eab8129e8c96604439fffb040f0b58e0bd69856a9ff2f4b4bf97b72460c0ab74c22c5242005f7bccfffe850cd4f550c27170f8e246ee10ea0b58c51e9f35	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2748	2448	iexplore.exe	28
PID 2448 wrote to memory of 2748	2448	iexplore.exe	28
PID 2448 wrote to memory of 2748	2448	iexplore.exe	28
PID 2448 wrote to memory of 2748	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f015ce559bdf0e29bdf653bac0ff3d7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4146a3e8751e4afd6de8f06981f58324

SHA1
0533b4776530cb33b0cb35206d8c18a24f3d72bd

SHA256
691288e151fb772d6e2785c3ed97617e61ea5c2d74dd2e65b06883b0322b0c8b

SHA512
f13fa1d1b487337d6d959fe0be3960e9866bd70e9cc074c5b1355798ac92c6d68ad38b37854d8271f4d55c8792a044089ab3694aa88e3de705693a08a5a5aae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046fab3863cfd5d30c45b5f5ecdf73b0

SHA1
130b796abcfa03c4ecbb072d4c26369f9e23bcd4

SHA256
6548b0db68f0e3ff0f143e117916c17fa8b3e9679973947f0f93b59e9677fdbd

SHA512
b4785fedd985a055713b54d057da1a2d0120b88bb834ba6b76d107308c43bf6b168b4fce051635ba87992da344de31524a7e1311f19b6882d8f9b344b5a78a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f1df5c2da9c92747f0c2bc7e65b650

SHA1
1828b6a0aa1f7e68c0963d778e3e502b6351ac7d

SHA256
3f203e68947a728da4f472ed32626d3ec9cf372f019f2a551f6e00a28a8c5a7d

SHA512
41a9829d7330e7e6b9c48513c3a0c6b153ef4d58f7d00721744581a618d1e6b0c9fe498fbab9a525fce80b728410527a12c2dcb61e30e155baa39b5f4c41f0f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
566bda87ed7b7f0ce49614352b53fc1d

SHA1
16f20fc2a1ed01f5f6d9706bf9e68cb65e81c7aa

SHA256
a8d841f9abef4bc3963722516a3f7e3c39237cb13db4402cbe9c695844c7c387

SHA512
95cc03c267524f7093e5db40b55b02fe109d91209ff35b41c31da0add861c826c5d54bd643de6b7b9fa9c6b66e7674ac0394f1b02b2b1dc5363bedbca6093d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c0b2442c777774102e42ccc6f85f0b1

SHA1
f1a09d0929048f6b2ca07aedf72b30dcb2e4da1d

SHA256
93d9e1f9205a92d669dc80e4493d6042b573166044df879cf55b4c230261389a

SHA512
6cb116ecc667a14cf431b3a70e3d22ce12aaa5ab2916c9af110308a1fcd8489ee708c8d046b4adb2c51b66b0e25ac9c2d30b9d63794d4ee43533f8eaad03d063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da2dd87b45007d83736b82b2ab0aacfd

SHA1
d3112dd85637cce494f9a4cb4a5694d2e64d37a6

SHA256
dd90530864dbe3bc8f18fe24d7184ec75a3e1697fb50a20b955dae122d0dc701

SHA512
6f16169eb3332dc0045b9ea99b160b767c9e72e9e0ce58e2eaa9ca8edceff359b01f0251e1287f6f0777a35fac1d3f83a7429d0b4b3418909b10ba30d56eb883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a35692fea28ee405df48b1c97811089

SHA1
5898ceb4f556147408d4e82f7633a23d64c39106

SHA256
dafd656feec1b602ca25db625a2cf3a649d634dbc6ff04e31cd820eee3efaa73

SHA512
db7f322dd7da40fc78b887226207222ee15e4e91d2f33b9951deaaa2c4b33d0e7b2920c004b02230b42697d9089281810100b1c9b493ab9cac34e6c6bdae7a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b755e3e83e04460dcb97762d6b56b399

SHA1
1d0b135ae5918697811bc071329a1dc5627f613b

SHA256
cb30d71cf056bb254cf716340535d8066879683530edb13fc96cc5ae39f6cb66

SHA512
e36c31aeb5f7de17a7890256399eafc1ba87ec15138b348a75ef01bd29f745534a88c83eff711b6131ed56e76b58350cd3af0642fbcfbc1c266303b7ff1436db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b697f89d3ec8ede3abbcdd6779ea7b9e

SHA1
0636285758571da609c7a9eee9d7b6073deb03fb

SHA256
254991986e56ffbd1f74448a38e016988f9622fd9054683f430199b23e79d97e

SHA512
b4130e31504fe3efd47b92714ba888f7fd00708e961c7684f555a6d01e8c24a00ddb2d2a2444aceb2f486da3649a2bd1027370cb7b815a5cbf785af0d3677e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c827be1b92845a7174bc56b7856b5648

SHA1
d40ff8c919d7dc6505edb869b7412a45e9ea221b

SHA256
ee1a865645a43cacd8e76e891fa8445928f2059074e5e3ace0cb85825b9efa15

SHA512
71d451d35e45f809d49e553370726f9af8f397020d0298b6cbf565d06141499230409835eb698d8b8033e7240f83dff9ea8c567da69bf0d2f9f0ebf17eab4da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c68a659eaae736523fc4e9a7ce37ec

SHA1
f326fbb28bf2f9fb7dfc1cd47a16b02dadf2cefd

SHA256
a87a48bc3d9a230f59d96b86f09c0fd5e64293c716c01013352fb47422bbdecf

SHA512
69527fea10022bf6cb45fe798e2e4bbe0f0a9da39ae38f3e8596956c1f3fdf5acbe947d84dc7d4f54c1b767a797f7968b645653841854e3c5184c36a6672113d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab171094f053f425b78d10b50c018933

SHA1
3831ab30676689db6d89e4c1a95328260fa685c0

SHA256
16d30432247c2960a56e50ebe43f56acd1641b309a3eaf48b1ad2483ac7efdb5

SHA512
a444948b0ef10dfdd0b068fe84f39683efec28059cd05da9a3805c0741d1d393fe20f8823d623d2d9cc5f1e654309a067d0286d64c7a6589dee410db12d499c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit