7813c033454f1eb596a3aa9acaaae17d3b59caa460c64faffadebe04a675bfed

Analysis

max time kernel
117s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fee55ae977b3a23bbf186339955bfbf.html
Size

44KB
MD5

4fee55ae977b3a23bbf186339955bfbf
SHA1

942103615ed8d90771c9f085a2d6beb50c32430b
SHA256

7813c033454f1eb596a3aa9acaaae17d3b59caa460c64faffadebe04a675bfed
SHA512

347fda738121cac7e3035532c1c1769b762688a7e810906f2ce2c07e1d5484dd6f31638e4f9c50c6667bed7bcb3f3285b856c2b07d87cb1fc8af98dc23eb2f9e
SSDEEP

768:EgOriWNcaSoagGx948PkJX/WYNuW1X2Sju:r/z944MtuW1Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cda8ad9543da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411033151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD383CE1-AF88-11EE-A29D-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a87016f07df27769a772dadd228a030a15a36d557b9b67cf95c385f21eec1167000000000e800000000200002000000064ebc62b75afdb9c20fbc9dc6d3c81a04318f2b4290ed29fe366de7a0c40bde020000000ef925da4c989a6830763638df1d2f1a348751a84ca558dd715776980b1a0ef2140000000d6d3a26461bb7a6c4ea5b15e0ba4477a61ab81a1cfc23cf86d91331800ce7c258360da080ffa842a37d18d160381c0310f6f679df1db069c5d1bdbfe8e21764d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c3623eadbe4fdbbfdc9ef21ce141c1863291798e55878b5c99a68ad7f0b6fcc5000000000e8000000002000020000000cdd35de4869c3faceedb3c03939f360c14f2a5548ae67f0912337f88f9e96e189000000096f5d440a37d89c12433057407de43a1e81692c38386b847d5689c41f843ff7871a3c515c6da75c6fbe550c123e62cc2a25284c8b9923ead3a66a6d208fb592513b80cdaf966bc622d2e072c4f5340f24ee46a5c77b3622a5c6e8a2c668a036283662b82070f94290c5eadb054624ad5af24d6287bdd834242f914f0943496ba2ac916d6e958ece2689ea021ac06ab1040000000b2254a12b88e6936a29c5965c4853e0230c4e75af93b638ba85b65e289714bcea52bd3f36a261db79b62ac700a130adf8800e88786c6545f0ab6a70aefba21aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3032	1148	iexplore.exe	28
PID 1148 wrote to memory of 3032	1148	iexplore.exe	28
PID 1148 wrote to memory of 3032	1148	iexplore.exe	28
PID 1148 wrote to memory of 3032	1148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fee55ae977b3a23bbf186339955bfbf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44fe8bdff11e2b24c0f20f5f7a4f6443

SHA1
6cb80efefdf1c10873547fee327c72351ca55a63

SHA256
a9fde37ddc74474638b62ef37b989d55143bdf45860db0c75b582d634ebe86ea

SHA512
f61c7cffb07cead4ed08b6daa1881484a879ee9d6bcf56c57ac4d00ff54210cd02b2456e11292a912b5eb9f01fa1ba24c70ce3e2f85eeac63fa1960aa95eb85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b42deb3f28767b50e9e95647146fee07

SHA1
9cb120127a50b4ea02cead468c2f2f2eaad1901e

SHA256
2afe19fb149e011bffc774364313efad307f149b7f62691b361dba356a4798d2

SHA512
0757d5eff3dac6e224cc139f68c330fe70b5e7297af9515a61e2bcf269e140142eeef46d758c0755acbbd08a1fcba10211499a1ff1797c8e885476fa2da0c864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a245b2474a5d916892f066c7935a75d3

SHA1
2d59d7676a192ee24830a8754b438682e2a861ea

SHA256
d23e5a7dad1978ee1e836e2cdc52a1b3d467af4d90f79b2093dd193a479bd908

SHA512
48598cb5eacae5801f96197822d59a937b4e940b607c419f362737c662bd7f7c4408dcb75ebb103dceb0408bbb3abd676eef27293a19ba4d06efbaf6aaefaeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f080d6d4bf5f26a0f57b9ebfb1d9f08

SHA1
264a9e3672e670a3455e2171ac8b67cf3dea14fd

SHA256
8b4663ceced80212b847dffecced3714bb59b0addbd427d404a8865a908b0f72

SHA512
e7eaeaf94aee319acf34d16450a7ac36cb471bb9e5f361a0c42700bb8aece750fb39c8b7fa0e1ec095d22f20938c54691f1a84a4e8f133701875142ac2071620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9acfdadfed8fc965278813a1c198949

SHA1
febaf3062dabba0f4527795c2c49927874fa5471

SHA256
8dbd5ead04dcdefc2ae6d64af6f9704ab266ee5a70cc018e023f76486f0c9c4a

SHA512
ea64c331922b29aafaebf0bce5285549abad4cda577ec265975c1ce8f18189cd438408ca9c797775d2c2207cd1bc6fd94d8f325d38a9df94c03405a443180fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc9e9d303416540b215821b891f15d1a

SHA1
26f9b2939c200c9141bd490b41e2ffdb4b9015dd

SHA256
ac0bb45630c790dafda2b9970e4163916f2f0d8973c7ee112efa2347efecf72f

SHA512
133640f333b3afe476ee264e4df157e6067a9ef22dab3536de70c0d50e467a0822b5d36f325b758d3823ad88f171d42b580d136390348217a636987815eab761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8acebb3b30cd63fa0c1841f68a7bcb5c

SHA1
0a01baa239a52f3376e49cc6e13505101ec1e519

SHA256
ef024689001fa79a8f24781ddebe7f0d415279d1ea2cd74601def34b07ce3229

SHA512
f6ef4a6408ae73906652d6dece479cbfc9e51812fade75140784899c2a72819e6852598044a8b32fa01214465ec66d7141ebea0ef03f82b6a36e2dbd39693c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cfc18dbdc7e07a68097b6008b8441b

SHA1
036b0eb8c06063c38fd1fad5985d5505f5b74059

SHA256
d6da165ccc90975181c4851efe94708eb0212a42b394e18ee618bf3a9bcf6139

SHA512
d2846a33af72084a0847f9d8fb6635396ee17167099c83ef199c1c777373672005c265389a768954a45c4d9c6e19b327a2b415ba96da8b70390f9418e1574ced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c8c7e4786f36dcc91597514365efb73

SHA1
67b1b7619a30633d52bbf92e5f1a41ccc9fa4401

SHA256
21d021769e682a27868f9685e3154b80ed11218e45f947e44070e2dbda3b06b0

SHA512
7f18d29f81655a9d2047a06d6622a10d6572b251533b4c5fa651eeac61f91da970349ab0c37a39c205bd9f2b9e06cb655b86a197b713e78876dbaf3a505ea8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1802708141d1620bd97c48b8f11a738a

SHA1
39bb2fdc49be91fa7b6f3e0f1e33c3611964b4e8

SHA256
cb4d21a46bd9393b603caf1056a1df6dc1030f75e1b7bb635efe34a3c0ab4670

SHA512
bb916e574281289645a67fdb6cc0955613ad880201714bf89455dad0f6c714b56ad4b917fcedbf7796ba891286a70df62085915ea9d78e59d6578c44a30f6c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
847b40a56ef03a6baf18c389fa1bebe0

SHA1
9d544c7659589aa96b2709d71c6886653a61435b

SHA256
7bef3554cd62f5d8c6dc47415cb511e311b1897d005638fe46a6561d335f3b69

SHA512
5e5acebcd571f2437b578c1c850d897880d55e006475437132e65dc24118a1d8611996c71da8198ed2bcb1217d203835a4989973e0ee0c32e534f3910dd6859f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8674d15e2909ab1308831df279c189f

SHA1
967101b864192e268f5b056bdbc052c07bc71795

SHA256
60eeac8fba7664843d300f832c5a73a1074208adb8bb3c8fcadbc1d76043dff1

SHA512
dc603e8f52536669ddc00ec526c27082ff50a8e182df4b7981b924daf4bb6734e0167d9802247e05a611f429e2c93675173a7088d8d5fe86378be923e800b1a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2aa058589c5bc2216c8569eb48b6b7

SHA1
44ed552194e1891a29c0f34b703a882529c71227

SHA256
df2a0f89d02d7a7bfeb097c46cef7f75c0c714e95cb7558e6ef5a4bb67907456

SHA512
bb75e173ef884fcee717bcf18b4a6751df8de444146aaeb1152405c3d2c37b67474c1c0e38bc672e39de727c1413f1f4a7849cbd10602fbb8325bb4d81579a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f209187d626426d8eac2d4c2660e768

SHA1
becf5dcb0b7e9d5f09fa18ea85d88f1189332e24

SHA256
681de44fa031fcc2e27fe251e3782eb069e145e11079594c476585cf7d0496be

SHA512
e28c4376b1fa7130f1c31e41124d1b2736ed5a9896475766cd3b9eb0b27c27c094eed83d79cca27b435b4c380a88a4c559fe6b6bbbf2937d72738c2a1dcd9f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5bc3ace38512ba02f5289dba9e7b0f3

SHA1
d3c0f3898967aa4edec7f3a203084b8fef71934a

SHA256
5efa1eaad7ec2642c00b35545ae03ee2d11225f24f3b14e87ae860179d72b871

SHA512
ce84a7cb6beb7ccd283dbbf49733cbbdbb535f532b50d312038d98e96173b60294efcb71588ac730cb50eb63041c5e25936f935faa6d07fa95180fce26e908d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit