e964fe08eca02c8246db738abe5d75579ed007a9ddbe53703a9d622d1eae549f

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4faacf4e3ba8d11da41a50d460c773ff.html
Size

6KB
MD5

4faacf4e3ba8d11da41a50d460c773ff
SHA1

02cf2e8b7d90f85e2dd84d1fd33dc1f809fc5f7e
SHA256

e964fe08eca02c8246db738abe5d75579ed007a9ddbe53703a9d622d1eae549f
SHA512

b990ea2a8f6c1f5f3dd0b0b943c5af9880405a9b82aebe949cea9eb9ea77960ea3fa23ac404a0c0e6b399e6c03b83427365eefadf2ab7b4c7237aeeba891100a
SSDEEP

96:uzVs+ux7XmLLY1k9o84d12ef7CSTUSj/6/NcEZ7ru7f:csz7XmAYS/D4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411025267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CFE2441-AF76-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005d3f1f8eef83e2d84e003178492324a253d55406e6f6653c68c05f051059bc90000000000e8000000002000020000000c373ce2cf87d35ff558acf763b70c33d3f1e6daede48191a4ebccb8e59ac7abe200000007b35f0892b7cd4d2189f993abcb7b8fa51eff630e557143c460677cae6bbfeb6400000000e330a7b278698e18750886da4912c1dba7d3ed4bb765b07a80d3bb5fba797284c0b928926b5406e881096e3c456d0a9b714628e05ab7207fede0c7483ffbc26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000048285723950a43a5624443ccb56ca6e3036ab1f422b480f86ccd71948d576f18000000000e80000000020000200000000597d1a562e1a34889daede01e1f0eb05f576c2b34c0689969b9866f3a1ee93a90000000b7bc844b678e18fcbd325f838bfb9b5b5b17872a4be4225e99d9d495770015648beb01d8da3e2a11eca9405182fefdf534429e68de5a9b4d3eb1b66938fe9a8b32ddbe7b40b633a1b588fb4f18adfa115413c96ac9bda13c45fddb504089030e0bd3fa970b8f663c59a1dd20fd7b7de02a969dedfaffe55c4600ccad29e890199043cbee97e1f1df17c8c88c04ec3cfd400000007fd595e057f27e862bcb0e6d757ca48be8624f62c4c070b8e152d76e2d261c6b5bf38a8f4fa122b4bb105e16f559c8b18c36d93f636905d9ecd2ae36346d2d33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04c756a8343da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2932	2008	iexplore.exe	15
PID 2008 wrote to memory of 2932	2008	iexplore.exe	15
PID 2008 wrote to memory of 2932	2008	iexplore.exe	15
PID 2008 wrote to memory of 2932	2008	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4faacf4e3ba8d11da41a50d460c773ff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5c32bf4e90f8fe592e2989fe785742

SHA1
86302366e90a4dfe68de42c7fe63ed99cfd0f38f

SHA256
cfa6ce3c7bec168f708d7c96ad6266c4040964dcdfd22ebf62c95c58dc50022d

SHA512
269f6aaef26c5082edb84de3bc9bf67dd1fafad70cfc2a681695c0c531636de3abacafeac220584fc64bdacaea10a7c544c939b911479ce4a63fa5d578682486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ae026f8eba00192bdb537fed42bf67

SHA1
45996c5267b0a95538018a2a736826a209bae685

SHA256
b5f9f7e73fc1555120c5b9c81ea7a3e7b8d1d6786c9028110b94dfd509b5b8ab

SHA512
125c617209e65c0e9d5ce15d402d4328e66b3c756c2c6428c4015773eecf225c7c01aae5215e0f8630a5c7783acdc021641b00271d342bb4bb575aea88cae85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48d243609e6a24b7b83cb0c8fe496992

SHA1
08611551bbae70f880b7648e7908a777b7466ef2

SHA256
d7637ab48449a71f6fa1328970feab9dd0e833f174bd0a0aa35a5224a80309cf

SHA512
e3c18578d22b096f8e9df17a958a9b8e8801ab025574ad5b0111554c401529f825054e85c412c5fb082e6f563b53ba46c01540110dc58fafbe5b35e62c6f1741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
386791dca209cf40b7039f02275d0a92

SHA1
d4431e180769f0e29c27de38235e192f364f69aa

SHA256
a4dd3ea59e9e95c3bef98e7f478a5d1838834da4e74fe81fe3d7a8ba2a8defc6

SHA512
fc0df822588a5b09a1b60b9a02f1cbaef6ac46c4764890b884a690e45b847a00bd88bf6c1185f358028aa04bfa8ae73fba137d2336d312bb64d6932580fdaa95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e702bb459c2053badb2ba63ac3e91b

SHA1
aafbe4424e58e166735cb4e05e01dfc2075cca0b

SHA256
00ae1492f022b506841b564a0f219c98127826a2e44d7e4ed3ce533537b127aa

SHA512
0059893096bd068e2cb4138e21f54028c48c1b22de10533095e3dc54eff7b946fa7952e599c9733feb5da3304ec6b606acfc51a47feb3410798b165a59d4762c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD07C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD520.tmp

Filesize
89KB

MD5
44e24635c0a8385313d00a27ad9c1070

SHA1
145289c1181f9b3ea40ce586f31285cfe3f29730

SHA256
fa8a81ac58074c885e1f2110efb96560de9861189c49fecdf605445fe9dd7101

SHA512
ef8c11470ffcd0bad3780f7243bdc08b5bb5a9fc09a51285710c3d31ef50f873ba37dfcfd945a0a281e54f37179feb91247044d85d274d100daec3081901b32b

Download Submit