d10969658561a41ed103f9aa4956661978c36f809d3df1cc15dc26dc352e9b61

Analysis

max time kernel
140s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f03f281029167c1173058f2170482b8.html
Size

12KB
MD5

4f03f281029167c1173058f2170482b8
SHA1

1412234ffda65007fc567d7bf93f4a22f2b38fd1
SHA256

d10969658561a41ed103f9aa4956661978c36f809d3df1cc15dc26dc352e9b61
SHA512

4cf42b8664a41232d730d536b32079103c8f908b5e9bd6d2ba28dc38e4636425cd97969e8eb586da7a3df2949ce59704479b096b1e8bfbd2ed71173bec24c4ae
SSDEEP

384:1u70NvxoIq8JTQcARMqEvZxfWp8FU8OrFRrzJUzWCF:1hNpqRMqEh2XJUzHF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ec51023243da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ed4bbc1ea2ca54c13676f3c9066aa5264c6c8de54a3d231547a0e7997c20b5c9000000000e8000000002000020000000f3e8bc9f789812e766d43fbf2d3d588d09b88a98945f882485f4980f40991eb7900000000ac227b034e365adef485272c268f1c651b31099866e36d672bec368999972c09e5eb4979a4e48c74550f88cc28534538eb0bd7ed0157884b558053fd08155a04e2f6ee7d42451b4c24e17f5f265cd37d7521d073496091e291a2ebc0de35f744927c183ff82341a259c02d572f9663d2d2c2e888d2f605f4ee71f4dc37b0084888deb49b7fa25896f6036216c0a105540000000eaad78aabe9e5ee8610dcf3663505ce24c0588e1c8e3b0567dd349f0b0840fdb110e308b5d5ae3f3a3dcd9aacc174a7562570ab6717327b81525a5b3aeb2fe06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13692A31-AF25-11EE-A8F8-62DD1C0ECF51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000896e19c6d91c0933d824debc9bb97d5b3bb12a3fd87dd37792d9edca4c3f48e6000000000e800000000200002000000018e979c6f94411bb1844603b4ca1fdf6ab21dbab4af2c5a165bda514f87866e4200000000676d7b43d4884bfe769c8881c13d7f25405fd3e3bf107e46ff5592c24614db44000000078a027c85649008ff3f7ec8ce30b1748a45bf69df70cd926c96a63ad58658b95752bbed3b170518d5a60b0c100887ec0bfe4ac2254c1788d1996350ee6f074bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410990311"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2908	2228	iexplore.exe	28
PID 2228 wrote to memory of 2908	2228	iexplore.exe	28
PID 2228 wrote to memory of 2908	2228	iexplore.exe	28
PID 2228 wrote to memory of 2908	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f03f281029167c1173058f2170482b8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aa257947624769955e7d6961a3810f5

SHA1
4f4f5f75ffc62276ea0933dd7e0923950b449450

SHA256
c81aaf9515d8987c8301fc32e729da93c39f4b837195175baf05642f6b2054d7

SHA512
64fab0ea753b9f3eb48a727dbbbb8132c1b61bfeeb0d13aee1ab5d049335e546d4a14b544b35b5c6b9127ae1610d9749ba0637f9b0bdc95b87d32d2f6977658f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2eda9b29b5ef8768380b6e9332782f7

SHA1
5bdb1c235a3d75f27b21977b6172ffd3813fee7f

SHA256
facbdd4177856ea9d86ae85811126e11f201c408cb4fb92a9979aa5f997c64b2

SHA512
5cdb2192985815c7661ecbbe1486391a4a14e9fb127e7c57a7fad858d4b3ec7ec5348a7d10f11df06a89cfa6adbcc7121f09f207fad4f80b04a2a18f33b7e298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5706784d7fd31eecbe3f37dc704ddf8

SHA1
8ea1c7c7b2f9e71d5fc08bbd590a856d6827f885

SHA256
a13325ecb37c4c0807c6e115c0e306e97c53aba0c426bef9b1c42de129394d9e

SHA512
9b3a3c3297dd2512b406c27a05dc284613577cded25cc8ed3a7bb49d967e59f82168d1faeb031b118a83a09b8b6ff434a4b8b13bffe96ab3aba1f20b3cb94c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1df1eeeab42cf18553a45eb7f9173e64

SHA1
afd15c5863fb6a6681e3ce9f5632c0c2aa640d6f

SHA256
ace5515494047569af935e1797e659277d26d28e9dc45c1e1fef1e41b958a4bb

SHA512
f699cda71c6204a3b8e30bf8395be827238fd532be6f8da42f708e26832a0d6dbf611f4c1bc2addf0e19e3c0dc5770498e82db6de3341b656716ea059772fc60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299a24276ad121bf7b467d46c77a8122

SHA1
843612a40ba6b1b2d8474f953c3e0bf92d81b891

SHA256
ffe8887ccb5c97a932bf26b07afb0aa2ac1a011f777c5b9f1ac8787396a76e4b

SHA512
d13cbae97696921169d8aa15d1a7f8623e47c8dff7c0973548b6dbf6073778817d38c2dbad5c13369f5136ff3c0305effb4391fb35267c524a22e6a67d1df9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1851cd40c543a3277b4e08f2618aa196

SHA1
bac44043ab0272772dc2d2496f4bcce0e0585e56

SHA256
c57ef11e2a0ffaccb59552ec66d218b61d87004774d88301a4ce3c48f1fda927

SHA512
4f4cc8596f630c0a3d489c4085205846964a7ad520522fe6c87652bb25c2d9c4e94883abcd693df181145278b70e8f56d88051ba925d822a5630702a96e00cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba786137b93c2109c28adb470931064a

SHA1
290a942b4e5359fbab6f2c1ea17f94531359209c

SHA256
7c06e2671fa06d43b0ddbbf74157f180bcc253536afc269a4e4b55ca2a793ba6

SHA512
03f4b825e3292afa2eae94b1a5eb4496ea7d3da941592d27caad68ec343d9b660d186efd9f686ef494ff0722a0340411aba6842adb5e7ce4bdea8c83f1f3ae9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc85907c78aec0dc2b8a663a4f371d19

SHA1
9c6fbc4ca2ce2f402dedcd663dd5c6907574d60d

SHA256
501b437485d17cbb4b4b88082a3d53500c50e842f65960961c18ee2c23078f6e

SHA512
c072b86e0bfc0f6f9eaf4d75f14ac4b9f715655d5c10add5400931f67b4bd307a7af7d0d18fba0d152b64bb229713d02c9e059ba97fc5d3836e3296f89262fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b408ec2297e6216577b22d234e7e9c62

SHA1
c5813cf039ba35a50573573362418af96369bb47

SHA256
8560de5c40998111e5378fc78c5a67ed4d547dc9144a96da2ae8901c5cc08ee4

SHA512
8bac40468840c7c6e27c3b21d126c375b052a8ba7be665ff7d456e97dffd6f6f14cf5f4b686dde1097c215d1a177ae9f6153ec76690405dbb279e6e82fb11d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e7f2b4b7b860e28c555e4a3ad0f1472

SHA1
57a5f9d5e1b8b254e435f4921b2601e0a77f1615

SHA256
1ac22c23b6fb2c6666902e7b19d55a72ba086093d165813e83554fc66a6e9ea2

SHA512
95a6c236f31f32bb2b9d3775c4da68e824272a054b2c3bc8fb43161238c0c5ff198c4ea931784fe96f5df47587015e65cbfde8df785a34b016256a51e9030d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2546b443f4c3eeaabf2b3311fec3f07d

SHA1
24e02bd8c4f9be4f8b718b2fb4194a1508d893eb

SHA256
356cbbf13ff342b7671199121f3ae9f89a4a236924d67542aa48ea4cf57d1e8b

SHA512
73180c39e6b5fef93f15d4032060d6a626f80eaa08dbf3b6adf5576ce4d13ae4df5ce05b87a9ba4e18c4ca6f6be7d5147764cc342b519b45aa0ad36280cc4b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dde21992f7193fadaffa5abfe2b1667

SHA1
5f3de90f9f686d00770e81289d98b340e63c5781

SHA256
79aa2141875a67997bc726b4837961d5224ebf5d91fbee4ced916d2241ad932f

SHA512
18e5aabee2754e5ec6364b7eaa4539b4d6e905fcf66d2051534c517adb6562801200bf02c1c4310c17c48d50a7133a9b23a64eb6a795579f8310623252b50473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2648.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2762.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit