24ded46205313b7ac753e14e0d0e1772df6e81aefc5ecf45200def18813fd5f1

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6e58472874e80e44eab0472bca27a4.html
Size

44KB
MD5

4f6e58472874e80e44eab0472bca27a4
SHA1

6f2a443f50fd2db7a26864f37018c7cdfc85d138
SHA256

24ded46205313b7ac753e14e0d0e1772df6e81aefc5ecf45200def18813fd5f1
SHA512

e8e986c6348fcddc54b7e0d4be2181cd538accd89c0d81072dd4802d682299b5499b08d5255cd0191b997a689045b8373376bbb7e677bd947263ac29170fddca
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2o7YelgS3ME0fhfk:mZJtVYelgSN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e2ac9f33610b5438c07224abd6d609281745722c26aa5e0b7d24302e1123a3a6000000000e8000000002000020000000c72ffc1d5d5fd9859193e64139489f74ba33cc5d2576515edd8cdaea8f6b3db22000000073d323550504f6753850e96063b6b31b7adf2a6b7834a0abfa7a9ea76c391e4d40000000cfa3d3e6f6cda8f31b55acced36a490ea37f10976ac8009ae1b96f1baedc96fab88cbbfe7d744323427ed4c0948b18e68b88d6c8ff94ead6e21094d45be6d157	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ded646888b8af66b81cea09123ade293d24329810cdc05363943d1169ca00a0a000000000e8000000002000020000000815a62a6d3c3f1944d5ae34e9058207c34192e5e98c72f360154afbf8e2229f4900000002258290beb240fcb9725a78bdca48b0b48b19cecb4ea5b751f4ee7f27dffacb61e676b05073b5a8bb28d2b4c20adc3ef67f955c49ec0693fcd77ac6b6ae38bc3481b64c956b4e5ecaa7c499475fd0124a8a886725e7eb8f21449c35be369a747b6d0e241785f8a97531b159d8c3ba7f4fb5a0aacbc80ed0671ce3c44a5e06f28a552db94ef03a7ca9b977a4f65b2b2c040000000dc2ba1f7391bf39d9ecae498fc7fb94bbb3ac6b94e26c074e94fb695623afb5b7d705480bfc76fcb0f712678f6e4bc7ccc423e71e625279139bed380aef0163b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7F1FAF1-AF66-11EE-B58D-6A1079A24C90} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411018503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e757bf7343da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2380	2092	iexplore.exe	28
PID 2092 wrote to memory of 2380	2092	iexplore.exe	28
PID 2092 wrote to memory of 2380	2092	iexplore.exe	28
PID 2092 wrote to memory of 2380	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f6e58472874e80e44eab0472bca27a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ba6efa9ffd46e4a5084b10ff65bdefa

SHA1
c1f1b19ad23380f3af38fc8b78d5ae1926983c43

SHA256
4893fc9974c33d6bb9f3865354050fb98c8803159dd5a457170c415870c6f270

SHA512
7cc9c9aeaf50861144cab84a7b11082a835fccb107a5f9194f886b2c66c1952b952ab945f37082c7e2eeca2fbf10bb626a00c3fc133ee757406ffa221fad6b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edc595e7c962cfcdce3757ddf0f9994b

SHA1
b480eb396ff0b99e3fe937dfc23b3834a3e3af60

SHA256
284da205c5f320e376f88823b1a70c8dd9e777cbe5fc9f98062071e12c7e8f35

SHA512
7ecb244a6599aa2b0bd7816e2e2ebbf9a8a2e30d654e4349d69c8b924c17a496fdf463ccb241019665cc682f91cd28a3bbd51572dc0830f71c241978030c425f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56beec87a3831ff69a087ce908c6d408

SHA1
e10c0e318e5991b0fb3157b16b169451678e3ad0

SHA256
b66ee31a2eb4105b9c036ddb0faa38a1fe39e3ab7bbc09ba6bb317e1600bc5fb

SHA512
ead589c219932b324e3c5d1ed44d5a8480e5b85d57e22f62bbcc8c0691ab989110008f90d945c67344903e7e78549b576de7c2cfb37417a9a3afd58237b8ef72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd82c9548eaabc8bcc6ba29b09105cc

SHA1
9f39abb63973383384184fa7282049b09e8af68d

SHA256
7f84242a079f6386ca8fa7cb5acac20dcee974f71d77ac011d94afc93cda6757

SHA512
596c50b2557690994ea451a5abe9cc7b9799054ccb40e5ab60b1f9f1678c62de810c936123d6aeb8da5ebd1e010127daa3cb2083a5fdcc321b4f86f7384b3a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fa3ec063092b4e2107d27fc1bbe6269

SHA1
d4bc9dbf5c2da98a9debeaf893df6ca9dc096b1c

SHA256
b222e25acf74b88dc757406c89923101860de2c2d1494ea2015764304d35dc9b

SHA512
b8be9b5300873bf6bcd93fa17f4866f33864adb4841dbeb1cff7e410c89592147a0ec9f5a48eb615428a5367fe4bfff1faf6c85106436f9bb8083ce56781849a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2c35ed1fff903c89e7831921a7ad2c

SHA1
9b6ecd6ed05daafb5cb2353526b4541419f83bd6

SHA256
db9f48ba0a38f90d4a3128ee599330f80e018649865be16c759286f5c0965779

SHA512
161769fc5739880cdad92751e6ddaa0b39a5bbf05ac7ea819033ebffc5b0efdf4ab91dbf972a18f98d90a7214cd03cbd2ba2025cc833b3d6f7a08f41bac13d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
297bdb4d42a11447f7759827758f6bcc

SHA1
20067e63a3e64ff6bca4750f2c71b2ffa5daab93

SHA256
a230e28493e0eccdf270caf4f9e30521ac8fa875adf7a36874fc0a2a19ad9c4d

SHA512
e1eb849d0fac3775263cbc153178ae060fe597819793c7ba0c13270495c2a58e0e2e75b17ce90ca52480e94f544a42dd3ec5f7aa5d7f238597a48fafc1c618b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
241b7d13bbd387d6f374208b09f1b9af

SHA1
c9e636ff61abbd439b2b1292ed285e93b9275842

SHA256
ed3906043a639b4b496deaba4d1f25ca2f0caabe0c475d2e62b1bf9aa8b3a22d

SHA512
88a7a2aede42eb26952767869484e48f3ca9c2d43afce5ef4e43ffe75111cbb7d25ae0febb626e6328bba5e3a7a06b66f7d31c2b757c35920506dd2adb6b2bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2e0159ae9ab1e242740c197873733f

SHA1
fe90073f3f698a87c72f25f39b39f03634490834

SHA256
2b1bb8ae5724a10bf51d05f521acfc863927452fda606b5b88a3c4ee00aa72fe

SHA512
385c0ec3024f48a2b0e2a0f45d901a61381ce702a26a41a5ae8a5de100308fbcd2cbf6ad1b83353afb5d42430aaf075093535625cd5e6d82efb9dd80df2a5c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab587E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58A0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit