7b612dc8aa7eec4d4e8e85da27378025b61318966e3b300ea3752807fbee9f8f

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f67144760a4ac96010820084350c2b6.html
Size

1KB
MD5

4f67144760a4ac96010820084350c2b6
SHA1

251009c4ddf80f1d8ce50135547656c815a8c51b
SHA256

7b612dc8aa7eec4d4e8e85da27378025b61318966e3b300ea3752807fbee9f8f
SHA512

67566bc8c6bb66ab2585893d6b63cc89be76329e61dcd7766c1c3ee58119c839e271d5dc779833255b058985301c47edf62485b8897208b3e7349218770ac34c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8138DD51-AF64-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004fc7d2bf6213847a2be8d16f921d97b60f7b6d61204c5c10e6bfea64180d44c9000000000e8000000002000020000000a171979edf57b08adf954074004f8734124f68106bad47b5740fc5ec6fb2f01f200000007f3c6ff30085901a8c5dfe01817a1d101d079d1073b39f96b65328a7811998754000000004d2a4ed5a11cdb98cc50c2439d86cd394b3995df13d74af47081b99428bb907ac228848798148a66b0fada8d5733b96a244bbd9a279600d613c34b149a1627b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411017540"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bccd567143da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000003923d9cfc4e8e8ed72e9028bffd2d64713770d4a5818246ffd3fc21ec236a0df000000000e80000000020000200000003eaaf1e98de483f7d4c3c6ce4f5d56603d331cda21c9c3d1f44feaa67e02129b90000000b9c4df3194179a3d901624b763632c05a745c5663c6c26e778f2b157de2a87dfbaaf79f520995d6e058b24db54590ce603cd11603f110f03fdc99dd4cc0533959e88e40458de3672756c2fc8b58dafa1402fd8ca6bdcebf3591cd39863915d16e9467fc96f5811c80ff9383ec7e9441e6b4fc779f0ef56d7ff3f3000343785cfcdfd64cff1d0416392ef35918fc5742140000000a1f31b2d7da29c00b02d1d642463f29bbec954d790541a7000dc7f1e7793402b44c61fca158f684f56a42d4916765c58c1b1e01d52ca5e929a349e58431d0e21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2404	2128	iexplore.exe	28
PID 2128 wrote to memory of 2404	2128	iexplore.exe	28
PID 2128 wrote to memory of 2404	2128	iexplore.exe	28
PID 2128 wrote to memory of 2404	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f67144760a4ac96010820084350c2b6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b7d59b395060330dfbe50624c93765

SHA1
ba1dbcea325068819fa10767bd1193698016dd9a

SHA256
087fddc3c643562a691f0e6fe6fcb47d235fa9b3af86d2ce6315991f4199d120

SHA512
127ae5e47c04ee9da53d760a1f9fc95005424dbcc301e7412b06a0b6b24118d59fa69abfaf61a59941d69bfaeb4ea4a72f7ee6eccd3395bc0ca699c2adf18377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b3c3aeedf3c32e486b918b492e8a2d

SHA1
7183016de4c1f99e9a9fea8d8faf212e771c743d

SHA256
a0030633ef28ae336441354f6768ada8b0eff81d464e15624ec62997d1dbfc65

SHA512
e9db130fe05523465995f2f9fac462509d2bdd53183b32290d9bbb68118f926e17f2534d92287c320d30d628419a481b39c651d916352479a47af80241731b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17decde2183200a1f5f1f87b09f7986

SHA1
d11fe4b9c9747ee63862ef47623fd8d4975dd908

SHA256
1dc6f964a6edb88207402b83507408b81f1e2921a1bb18b9942ae0fc539dbd20

SHA512
c86b2953e92a7120c66874c5c358a18c3ff5c80e0092e5c082e3ebdd1d231aad10006324de24715a62facf1daf693dc5cf600b84c91d3e9dc694f53dcd87aaf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f97a702c726683e1199d284a803d70

SHA1
06cab68e5babe4de3a21d9fe7b42e76159b8d102

SHA256
c5d35cb45af0fed9a8ddc3e26b711a57104bc88cb982abba6cdc76ea2ad122cf

SHA512
028dfd0aa2fcb051206b783b045e2733de0934cd45d1fe0ad7c90194cbefa1dc9fffbf5a463b3f1032c673d9f78c758580c5189af5c2383416d3384b16c68f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1517cc3b2ada7c44db4d995385c4c09

SHA1
6cbe347eeb4fb7c41509f46d2253aad0bb3cbd8d

SHA256
25622b1f7f3b552150366ff4d107323883ba9792cf18c34a83b356c8d6e0ea18

SHA512
aa316023a7d7240aef595f637d1d39fffa823f2062752b883542ea9838ed90e291a71b2219e469938443d0c1b734521d965dde1d23a13202d5fb991bf91a5a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53250ce2ad88763c1caefb37dbac94d

SHA1
6bb5826cf248f67bd4768080c167c8c4ba0e9e57

SHA256
93e9a56adcf468d78179871ffba29a5b00c9df0517002725a19d2874ba5adc2c

SHA512
04a177b426cdac0a564385dcc89b12a1ae117ff0089b2c058ca2f947d9f114e67a06bab51c1d2569950188c0a92e3c48ea1d11435ef950033b8eecbd4d3aae92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d085fa052e80b91f32568e63fe33026

SHA1
6a6a527d7270a81f87920cc8f700f9fe76b7f48e

SHA256
58a522701094e6f5453759fb67dc981cda623a11a3b79c735289155e9f36bde7

SHA512
c2e3e6a21a36297fe31195b784af1486e71fcbe20e9cfc52dca726eecc9397e071673c581652161fb033f6cd45a279b8ce2e335e07fdb161f29d39422adfbc31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bbef4c836beee86ccb446a6d6b6b05

SHA1
000e77e8342a9b42c55b2375ecf175a6e579d58f

SHA256
1c59c9450ab50e3698dba196ff4dbb123c0027e338cfdd7ba241802f9f24e188

SHA512
48a1435cff95a6d4686e991431bc50f0d1d25270cbbf0cc4244f48305fc55ac23c4fa542667d6615f50f702067a02ca5ac705223e4ada9d74e3350b1c17448ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c02bd3800639856ea47b1dee2b0862c9

SHA1
6a8884466f046b8e0dfbd1ad3b8b73e7186d00c1

SHA256
d815a80821e4c011bacbad93298dd468b22fe97c41478522eeb0e16bb7f2b0a5

SHA512
23d9cb1e4cc2b6e1e63ba4cbf253d5259583bc660bd39131b73509a85bc9c2ecdbda9583154ac7449e7e0c5935e024fb8c3b7861204098192ce8556a2487584f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27eb0374a2be9fb92cdae093670c52d2

SHA1
f536d9cb986c2f4af51311351eb2cf1489d8449b

SHA256
52b8f8e111b9c205123175f9721a30ea1c51725c17fb1388f2b46bc8695d1ce0

SHA512
77885dfa7a8271a8a879383dd36b63f66c1e8435e3e5f47643ea7852ba234b2317e9abcecdae101fb636d2568f848058d70a347fd599089d362b426adde9dba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7034.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7056.tmp

Filesize
102KB

MD5
cb9f29c4e6e4e2cc62fb06db86d96dd8

SHA1
489fde11b87d9d6ac737259433ff216e72fcd17f

SHA256
fbacc0f574d5b3a0b5a52720b003cc5bbcb35874c351afb3f1183835963ff7a3

SHA512
124ae04292bcd215e334620dd4d24789976aeb8a712253df4a528c881cdcd169034a3c998ba0baf780cabd3e6dc1acd1bb2e88d8f91a387aa143f14949eac057

Download Submit