9ac8b8678293fa0dd7c449c4772511fc062508228579460542eebf470e7bf1fa

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fbe1b2d54dbcc6311e1bb6aceb1d7f9.html
Size

2KB
MD5

4fbe1b2d54dbcc6311e1bb6aceb1d7f9
SHA1

fc5c86879d22e689e5c7abe9b7d74124347e7a69
SHA256

9ac8b8678293fa0dd7c449c4772511fc062508228579460542eebf470e7bf1fa
SHA512

28e20caa8edaecb3038d6819f5032a330df32af1e6c05145ef3bf1f8a7efca5e07122bdd9edef98d5c42340a43563613595cb5208c8e5ef7e747d05a2bf56a80

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703b21458843da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{702CBB51-AF7B-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e29806267b80eae31304e59c16f43bb2f8876f572509aeb5108da09765abe7fe000000000e80000000020000200000005da62e5f879c485e92645e3af81b2be1107a450b0bafd1b47f41a0d505de8eb8200000005d9ff624b135a4c2144f4f43f16b5b098c4197806378b10dca5bde0893a8f0f64000000038ba0f7e4141097ce8980ae9d8bf91c1c16b291a59ae59fe64ce0d4e821d9b07337ecb14cf1b9e5f990aeee6097b09290e0c832d956427f889c1e654dfe75379	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411027396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fb9095bd1a70e3041c17d3c0c909e6c853e1590f9823818e0cf79629fd00f3de000000000e8000000002000020000000acfdecbaf08b8947fccd15137f7d698c98a5973f8e2edc05a0fdcdaad4c34aea900000007fd915b480c9ffd4f89007a47e513b472c67da4a292d3f849d26d0ba90d6a3ab1590463f5e5330cd34030386733adb536129d544d2144b7387bd5b4c8fdef539853bcca037d5a3f1bc211bc25b82be6bff4eb5b527de600fab25e749d54f90b3975b598d5da1f4f8960f7a5e5b20446e1ab51bfd46dfc613162b106b26231fd84b672a2185ae161ed26b9ac167f2724140000000265536c8fd6f4f7d56cc8f1a4002097a7ba8af66cbef2acb9141e74acdaaf54f90244b2c727a5c8e4649d86018d1e97720822bbd8a2cbcbac608124a068e3efd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2720	2884	iexplore.exe	28
PID 2884 wrote to memory of 2720	2884	iexplore.exe	28
PID 2884 wrote to memory of 2720	2884	iexplore.exe	28
PID 2884 wrote to memory of 2720	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fbe1b2d54dbcc6311e1bb6aceb1d7f9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ee2f0da9f37ea9032754db193b85c3a

SHA1
f95c363454f82256251e800f6df02c2efe1beeef

SHA256
992d78b3ed58d981059b142d1e7264cce731987ba13a782e061813c4e895fb36

SHA512
7e5eb02f09b5b41460d4eb18c9ac15962156e4013a7668f7a2d5320244778d302deed5f00af3fb7176fe3f61349c426df057b1cb6913960ad069ef5d6eaee827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0299ae5f59b8c456ea8054aad88fa44

SHA1
1d2d46ece196f61d798f2a9d129a3b447a30ffb7

SHA256
80ee6cbbb6d4f9a979e4524b91e90c963658f986a645ea230bebdfd06b366869

SHA512
c3c5c878edc8de4efbf4697f9705d39c462ee3994bcbb1dbc44e52cd9736d6d9ca9a4ca13f655c9569d5bd3779ff24ea3d396802e9c480ab0686a1b2a590a697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc8bc6306ea7b2aa96b114a02243e1f

SHA1
8b71d14b7a8a736894fed5fec51b368d019b0df9

SHA256
22c6afb4ecc2d77952583079e3dd968520e9fe9149d9694df8759fd49fb872b0

SHA512
87cc499104eda3145c30f47751591a22c6d829cdf9c7b5cbf1a23554110d5c74ea519110f659f956c903652846f9cb155ff0b565d5540ec5263986d2b09b93f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee7e33184917da91d0235bfd05032149

SHA1
3d30d5700604a21bd9c6a2b468d01a02c160570d

SHA256
543d6615ef2ee41092d896f871050dbdea074cc912544313b13c5dbe8077e6ac

SHA512
9be7a6dc0d22d85887faae8875f901c5a985791767caaeeded14d8fd61e69d76c9e4f515c77c0e99cf58fb25dc09cf8a07f704fe7f358eff2aaff6a16d554ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a73a0ffaf862f9547830697334e408

SHA1
bf236ecfb881bdb59ce53d51f4d28e2a64834817

SHA256
cb27ab302f8008070273f7f097837e0df3d8e33c01133db23a956dc50fffe430

SHA512
d63c8f034e1df6889b7576ce4ca26d37659e4fbfefb1aab3fbcbee6dab0aff2df442baf2ebe0001c25795ce0201e036db510869374ba4e45a6aa0d6370cea97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbacb6897df4a4dc62ee5bfbc83e469d

SHA1
1bc436716dccd1df70c984e2a8c8125bca3687a5

SHA256
ddfcf19951ae0e17a961a7044fb9df3809d06a33204b3e1c029fd1963f2733a2

SHA512
7c56c1de098638676b4506782f4fe3fd7e9d9856581585947a4cdfeab58b378607762c7492d40203fc6f9c87975303303b15d7ec63d02e3c84eb32d5d8db6d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4154b71ab104f6bbc118ef3c24b273bb

SHA1
fd901c40305a9cb43f40dce016f17b911b2f39a9

SHA256
73816ee2d500efce6a44ccd8b838a8789ce0a2611f608b1842f0b1b7b46b5885

SHA512
5a3ebf7ab14f3737a01e19bcb3f3162b528b7c40c21f6f1f7cf73f33c1fbecbf194d1485c527922aa60fd05769319982ef09e6c63716e8ee7cd60da03b9525ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3e75e9492ca41b8c43631a51380ca8

SHA1
035e49a06d4a7d8aa8c30ed5ababf1a2e302b8c4

SHA256
b0720402d51614310de162f0554b0b1684c30d8284d8c8fe29178ff256bcb163

SHA512
0935062ab16965853d161da76ec30169b4ffd7b02544f6d5ae7be2e86c3f8c30e53d5245beec5cb594dc205d04bd98d9a98b682727c62758d6e55f9b898e29b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b4465d8ae06a277cf4116d43fea4d3

SHA1
05fd4adc519169be340ba2cf42f6ec45c5b5c0b2

SHA256
aaf86c2b251c7d8c51e813fd6e560f2ca043c03f6f523d977248cdaf991652d6

SHA512
dd08099e5b2c4779968c27ad8d6b87f8c0007dde122dac3fcf73f6551e66b8e22dd1456044ac5ebedea198efa36bf1493b4d6914cfa478acdc2dd80707c7534d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de05d1d407362db2dd19a4bbf5ae0fd4

SHA1
742a148f65700678bdf3d2f15d1114a004826d94

SHA256
23dac76cb7f91112714040dd5e948076ea9d77bdd4413bba961ad5b315fdcadf

SHA512
d0b9ba675ca5c82804b6742f557bd1c5df084a6f8724fbe55341050d4e250441bb85da365401e7d901b2157ec47c1748b2f9de98473d0a2743d3fb20df289e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb751465c683e67a4ca797054f18f2fc

SHA1
e1f0b5d6fa552e47752ac771ec1fdc8ccb37b5f1

SHA256
a42c7f82ae5e85dc0eef615f1f5d7bd6379f1b5684b89c59c495811dad59c9be

SHA512
f174c0ac293661041215caed144e778c423696819d5e875cb67d69e18c2a4bea3eab1486a96e013ea398d2644fd036bc0a4ddf9a4c8c102389c910b4b86e8774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6c5e2708ef2ae38572bd6b9c9f5465

SHA1
f06cc41d9f51e69e6aaa68673b6c674a8453e621

SHA256
3d85cf068f290911d619dbd8c17bd0bc0e0e07a2fe965a02754fbb28fee645d9

SHA512
4e26ee576a656c31911bf7b6b555d3abc744a3a84b98283739505809c4b853ccfe74d3b20e6481aaf121d1d7bbccbd80a02d85a7791e2813bcd121ae27ffddfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a9ff47bcd1488cee28bbd9f14ed5d2e

SHA1
0b5897424f905d1f7634677d0f811b21e138f7a1

SHA256
9e2da30bcc8c2f699f6c247dcf60b524874c1320801d2f8790d298e95a10444f

SHA512
22c64a3c8f255441f0cf99e680a88e82263413ddbc6ca95abc0a30754ee8c901eafc18f70c1188ff6d90484185e103d7047b561f6f3c876e4702770f365c6a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044a0995306370c85330391f49eecd24

SHA1
aa3ad8880b867a462b3c76066b1ebc9f88b2f8d1

SHA256
05e45839efd37eedec34de1e9f73ffc9ed7c204d2f0a041bd664b4eaa1e5a272

SHA512
0b3f3b1011ec1899699c2ee49646ce896c86f78ed53eb9515d6be6a5d8a4ac2d62789ec92e96897fda5aef3e67a7a91ffa9cc7b5dc85c6e9877248cadbc98c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit