6ca246eb78bb5c9b1de9986b443b56b223d03a533af156b350b4ee9590d38026

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f9521b4fff35f8307076695a2bec094.html
Size

40KB
MD5

4f9521b4fff35f8307076695a2bec094
SHA1

de2c09187ecdca1e1eeeb35d18099bc0a770406e
SHA256

6ca246eb78bb5c9b1de9986b443b56b223d03a533af156b350b4ee9590d38026
SHA512

f6611f0cf5a6d1a9622fe6d168f560087790d2395b229c88815bdbd7ffd398935486783471e17892eda7209c68607cd0c290ea888bdf9120905a059dd33af988
SSDEEP

192:7w/iEilYgqdZwpBiMdPwB0aiqg/M5P0V8jFabL0DCnN8UY+lGlQEXVBb920jinW4:mVbUgZ5GEz6WZaHf+pHqBXwZfkMyaKRf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005246dfec1e8b7a1bbbfc9d0a2d9724530a5eb06cff980d807200f86cc567e59f000000000e8000000002000020000000005e22e508e37c9dbde21e52fda7ff02555334ad4e86d61e70f3aa294e774e7120000000e70575bf095203cd6b18e83b2a27c0db2c685bf553bf7a631b2180336516693640000000a5240cba17650fbae9ec22b369631ace414dd741e59caa3b83809fdf32bff1a47851cbb6798acb3ae11729d1da8e2c2e1dd7ae45cf24aeb40d12c22b7eb55aac	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cfecce7d43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411022865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fc00836ecc8dd6b8fae99594dcd3d3cf7e54a6c2ebf3c8a88c133e5e8af2700f000000000e8000000002000020000000e0eb4685948fcb59f0fd3ff94c346aa349af3b4f7894a656cc4a57fa2d2b3aaf900000007efaeaeee821df2baa0fb3da15f629e37f304be4ddfc111908f0f765d4d082d46f8e70b8f05c210ae42c47a8a111a6875e1d496d6f8daa1ef62fa28c972d4443dda0d5d566bc152a6ae4bc3636934b8d454c49a159dadb6a9377362b2d393496cba0e81a5e1259c34762d40a2cfb60a5e6aa366ca6ec7907e4bdce30113c29292179d08eedbf8d75ce652ae1fb58cb43400000004c0de9298b5bbee3178f8e60e39545c5b4249b30de9e1a99d401b5356df752e130e437b23d419671bc178e2bb41378337f92d1f1027ff958a911e2925db41546	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD6955D1-AF70-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2004	2096	iexplore.exe	28
PID 2096 wrote to memory of 2004	2096	iexplore.exe	28
PID 2096 wrote to memory of 2004	2096	iexplore.exe	28
PID 2096 wrote to memory of 2004	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f9521b4fff35f8307076695a2bec094.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5faa244521cbb3698113a56dbf85e8a6

SHA1
e3142a1723177346405eea99bf53a32042e5ad2f

SHA256
396d835bb423d1c59d1bbc8976b33cb243af0c9440ce7ca5731d2cd129befc69

SHA512
0466ec94f8a78dffd32355ea5520803162b7bf436541592a33af3cd30b0027b5bdc25acfebc635c9009d7d3dc06f3d60eef179a2d97d334173f76f1f70f96d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dd2c7a3143b8fdcba20c39dfd6e972e

SHA1
5761425c759f87141eb875cc7f70c41c8c2758b9

SHA256
b983aa9599350f82f95a3ae42e1c20e0b3986caf8169d9c83ca6a9816876b8c4

SHA512
74f499510c135881a2711624a899eb48b970e683c83d9a452f937255e5290968e6a2b10cfe59c36211a01625a37c72d0c0e8f447ec96f4d8af486b2f009d59a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce366e031f947a620a6116511851555

SHA1
9c81c59aaa60bdc7402d6fe78ee04b54096b4c56

SHA256
839d52985751b9b03dbd212f0b8f8fc721dd7db0797c02797845f0e0813ff9fa

SHA512
449d94e361e999eb97b932c6a32486767d22cba88fa8d2addbf0999a14fe8a35a9213c69202fdd2ae1a91037ba1f3c58eb2f7e220e756843322040d244798ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5ba134ce66cd71e8aa5529197ec2c83

SHA1
7d5871b65bd7b6b04a08f38b5d9df80149db8e45

SHA256
1ab839dbe785c89a5307832a1ba82ee1d18926fd138f017edb441d907b74c48f

SHA512
158aabf09f8f325928e3bdbb4182a9f18677f591c195b490e7223c42b4084d82ba77f255de8345a7103687dfe74a48364a4e0dbaa0cc6be70907782cc2befd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e04dee83cff394adcf2f1229ef1392b3

SHA1
e4afecaf2d2c73b97df2272971a5f58334e90656

SHA256
4d3fd379ce817979b9db7b4b2474237ffa9c56a54b4a26d7f763892c20d44653

SHA512
f222f71b122091790fb7661bd75f7c853a10e5777ce4a7e65702c64c639c5a2c3714b9bb192a90d2c7a50298ddf304861e2c49193745f5d1db42fe51a3e967ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1decdca09c9ed5eb205212cf1481391

SHA1
bef575b982f8f83e215dc304e2553a083cf2d98c

SHA256
91993393f843ccf7919d68dc9689beca69ef4f370ad015697c86ed4eb373fed2

SHA512
669a7f467e7124d07654ffaef9a27d081e71899cdf47901ed51ba1a5010be7c40054a7a92872db8b17429c190330e309d7d795543312e1fda21312a8cfa44967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e9fd17b202f7fb1d2b87240b2dc23e

SHA1
1826d5a01b85d347f3b88a9ff7d5fe6263ac9685

SHA256
8d8fc7558d6fa9d3f6b8673c6fa1fb7a2f73509f011824ffebb85224124bc34e

SHA512
61b4c363179e03e208d267b94410d31240325d888f9baeec68228b05bd7cd95ce88652a4d89e32472295df5dd9c78c915b0c46b8d7812cdc4b5051ec8e95eb3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
406bb5a2ad7481eff1071edfb912f450

SHA1
5a0c1a84c4d7f2723d6101e823bdb53ab542e524

SHA256
9394285ec046d553a42ac389b08eb3a396c67f11011eb9192ff63760fc1bc20d

SHA512
a1d2ea2b5cec3caea17425787418b70baa3d5b4a28eccfcd1e7753bc00febe0b29ef97e97254c6786765ca354c4b304042d0d7579ac85ce528080b455159e28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeff6b235f99abbb82e654c2a6890546

SHA1
03608af78671fc05d5164db46088d82522fc2c38

SHA256
9a403578cf8ca462ee5ba863a166fd5ca9dd4ec344eccd8b0c526a055896649f

SHA512
1515b9ca8ef61f1b061ceecf657f09e449c8542120dfba6908d17d0754fea945756a2ba6607694f62cbc91b07d901fac7960832782d0a05c6bbaddebb5e34fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f640f690e1efc75ef66b7e808195b6cd

SHA1
1b249dcf4cd1dde79c5618d54bd4acfdbc0ac2f1

SHA256
f91ac27b4f9f9e943a065d176840d8f1b3f24b55886f98d3fbe95194defaadbb

SHA512
f4c44ef3833a14e08390a2a8cd560aa99ddaea92f83bf3c2f36372b118d49fcf78cef2873184e3bc0a64a290a8dbb1db4f3348f021a9e6000eff3da02b027ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc5978114a20599a243f921c827c77e

SHA1
e08d453764874b2a38a1a42a0fe05b301d9e59d3

SHA256
8306989f7ddf0cc477bb088b76ff2e35c2aab7be507c228bc986128cfb7eb66f

SHA512
b866a7d9a66d585d7010e68b928001f849bdb9987b4f70f234d27b09a0ad6025aae7180c1e8b334cfe0db725891bf3ae0fee83b7b457d964b7ec409c3c0aea7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7468.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DFC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit