a803299750dbf13d0e5dda36fc4ff1300a5c6dc7af8f39f5751963185c63bde5

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500ad652c74e08083a05b6f58f9a07be.html
Size

40KB
MD5

500ad652c74e08083a05b6f58f9a07be
SHA1

723bdcb0278b92106b96da17dc9eeabcb543d5db
SHA256

a803299750dbf13d0e5dda36fc4ff1300a5c6dc7af8f39f5751963185c63bde5
SHA512

3420e600a88e0e20365842ef0497da5035af388b7bd08420302574c410e3f28db3621c0b973e303c9f91625684513d4d0ce835e83b09375f9aebb34d9347bfbf
SSDEEP

768:VIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZ0Cb:VIRIOITIwIgIiKZgNDfIwIGI5IVJ7Squ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001c3303bd4f948be059443f9f4abefb5122cf96717a2ebda347e97331fe7b0741000000000e8000000002000020000000ce38791b7858f0d957e7ae111f3de7c9bd09f860d88e74ece65dd187ab8233e72000000059a1b128cd78a0abd55249e25b390ca2ce6d5dc7e21f07aa40d6ec6e3f3439e5400000001799b4a981a4eb072b1b8105db4bf3c6ee7334647206612ecfd62ee791565a107205f18af1615a25c0dbfeba3c3282fa77c4171846744d355d346c67c53ab80d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D055E3D1-AF8F-11EE-A57F-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c1dba69c43da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d107a4f9fb3edb70668ff46a3ed7648e851f4a4004efe7b4cabfe5b7ec3717d9000000000e8000000002000020000000b13ce51efc5438fd47ecaf2fa68315404527d26d7457536fbacba45794e7888090000000f821d9a3bc3b09dbf000e936fa65b6bac187f96deed42e4856741b419a861201eb1b23b8f6948c485cbc900ae6b259ed7ead309db4c0f7a2a890705485ea3581bbafc4cf1c1167f8a0b3a085e87bda9cb5f0af0aa583bdea53b38e6863e8ee2ba4bb0aa8ae90f0aeea07a54c095edd9e721eeaa7be866a81948d7b8d2d813e8a9c5289de15b33fc7d2071e5eac9dee654000000065ba136bbd0ed2d3dc1f88d8b539f5a85fd3fbc8695ce1396c106848eb31a0d36a33bda50bb1981535cdc8b5341e84eddf333adb14a119b1b1dcf49ef4c7cb4f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411036140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2488	2180	iexplore.exe	28
PID 2180 wrote to memory of 2488	2180	iexplore.exe	28
PID 2180 wrote to memory of 2488	2180	iexplore.exe	28
PID 2180 wrote to memory of 2488	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\500ad652c74e08083a05b6f58f9a07be.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a8a90a44159a5e2c7e278d91e0b97b

SHA1
ea6f2ef63931a90f4c035f8c746b94072c57316b

SHA256
7979966df103fc30788fd10955254db44211ceb25a28d1e445ed04698542131c

SHA512
e799edcde84dad0a2a81b961536e308d2fdc2d182b8f6649a28283b447d016ee054dc69e5dc201e16ad3a01a9d54394d3f3f7d5885fbbe4584fbb5df33b04c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cfdf975c81fa249265c59c3f6231a4e

SHA1
3719fe72eb536a788a4255e65d74793c68dbf5d0

SHA256
35ae88070f3daf99129947b157932546bfb23fe332b9cfabd02aed9330342ecb

SHA512
b98d30c568b568779b16669cc53eda4a56bf2d9140af2af5361567dcf46f669aca6a5397cc63e0ca295f7f65d79577ce15237b0d6210e31e8705138bca8a59af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46db6f4d0d7add85cbbcecc9c75f9dec

SHA1
83c2695fa0995eb1efc33c18fa609737073a7ec3

SHA256
79b1c579c62931ad23d4183c0892013873b9f73525205217cc5c7342c8d78690

SHA512
a08f88d40753f99997a16b3b4a75e9b5d1b3e8e372dd338cd8bfc9540b0d1d21311ec8d6ef6f33aeced89ccb8bf5961e950d3d95e80c0fe3c8c76f3d8fe13673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed89e4c8baa8b2a4dc79e4d97023ed2

SHA1
54595e8677b801e079cff3b1dbdfa12aad5a29f8

SHA256
0bb51d4814fd8242093735ba103f6043ec58f10fc5d981d9dc233a7775177f43

SHA512
e582478999f233cf44cc413f245959abfc45aaae3702fb0bd14d27c423eee609eb398a9994432664d0de4b0b26e4af4ee91032905de8dde94a985822a029ee49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f95218e2f06c84253009bceaf26eff9

SHA1
5ad35faa706d72cdac1d4984b3a3e3fe470718e7

SHA256
7efd1846a77b5216129727edace232176ffe30310ec48cd398d5230e7734e397

SHA512
fa804ffb8a7c1a5c8666e230f7d08979e1f2db2ea8512440d624bda9d83ef8250494792b20ff28bff427dff94cdaa1773394f3fa1296f3bfac9e1d42de37aba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e2232eebb348734bcd7f8d31ab46641

SHA1
7bc58bcb1a451b0aef174abfe5945b2e3aaec768

SHA256
aba94bb4841e8411f0b54d85b39593fdaf212bdf547749a9031d528b9a23b99d

SHA512
40665d949bb8cc39c4fcf2b7336feafe33a691df36e20a9a43aaf44a9ee2f2bc5d65a429e8a846c9418a68114e61de63645bc3d5f518dc941937de61d012fed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
042bf1f6222a8cccf3905a784d56de9a

SHA1
6572b65af9a1512e0ca23dcb7a7d50767033d054

SHA256
d19787a0cc30e869770e80bf91fe9433945161d0de9dec6418b76c74695b13af

SHA512
3d203b5595c82d0bae850b64e6420f418ce577556162f0ccf09829ef435c89cfb671d60d0dbd83055946d9e4e5c0a54d44b3a960f747707385bee6104124b202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78218232778a8f351faa31ba38eeb069

SHA1
23ef823c2dae8fb79b40ef6428bcd4aa93ac57dc

SHA256
6c44267c4038c1049a74003b7e77bbb36eb733623aae0af7d7a1adbc7d9a00ad

SHA512
4e14196e4e447437c316294782899e8e29ed8b52c0e8bd1001b8f9cd00f15f512f4348d5ac758c7455b93bef01b565955c6be35b0257d6ccf35b002589025fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8bd20ffcfd96dcb84bd97a105a87228

SHA1
72712bec310f0d5493291dea41d16fa93b24aa69

SHA256
a37114b0480aa26524379f91a3b0c02a23a52125abd6dd56cef7764b7e2cbf4f

SHA512
222fb22c0d58e73561e084e446dfa2e7147fbffbf583b4edcdda48bdbfa661995b023cdeb63b7214721df5490fa49f9c6ed4b349566214be92b93f0b1c7ac000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79faff0fb3bdb283d314d4e602d10f2c

SHA1
1c36425a34e55b88169ed2527114630f3bdc1a15

SHA256
7cd11268b503280e35f92ef19e08da48059ef552a82fb17e459a6366ae0d1982

SHA512
40fe64c5200f6d870c3599b1a9c9f2e0ac3acd3b9f2f1a885e2b5ff465216aa1e7c1cb224d61e729d2a9e5282b3a2f8ed449d5dfccbf88445df8db3608446e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc1dd5712ddbfab1b47d7270b014051

SHA1
ca379103d15f9ecf3e9d8f1921f9bb01d46ff9f5

SHA256
3271de9fab7d71fdf4b78a9fa01102ca454a1e1d04a12506ee1d9384f50a45de

SHA512
32e1b461858667851acee0df19a2b6751a9c18e9bfd25bd9e02ac8f7bf4b4b5437048f0f8308fbfd74289b3cc3172701b270151682e4e5c5457ac692c0a1ad30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ca40221610b7a8939910baeaf21d99

SHA1
41dfd97e0c9a771fdb27be4ec5559bed66abb2fe

SHA256
fc8049a60c92333aa94f973a755e7a26af854efe2604a37b36254401345f0cb4

SHA512
51fd1668e0a2b496ad18e08432284be7197db1a07f07f95fe763730cfb0f802c908da1996b4e0fb7e7691e5ef3996048ac451bedb8dff86ce8baeff0a0fe602a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bd38c724e8b4059a26421d695895e83

SHA1
212b36f594c26c325f3cb952cc8e90ec456e15c5

SHA256
599ecb3ace7aca350e9faea11eebd31c929f62a8e1adbd9c8fa60f22097fd931

SHA512
93f57606338cf84e16c26fb66c5d47a72c4801408f2525a3923f1d7808ea81c31ffa6c0e6def488bfb467ff0ddcb7f3e8752d43d10c2759d8acc476c9168589f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adbae85a04f5b5cdfde9a96700f100b8

SHA1
dd62ef70d1fe5e3080b3b6147685b0c0b9f096bf

SHA256
e69bc03610beab290a433d719d974c0e77bbd66ae82ee4f5271232c24e1c183d

SHA512
cc7f692bc30d39fa4dad6eeba6e3bf88137c8c8c71ac2f45e740754198b1a5f191ce590181c68b51d9dbec63f0c2d247e72d940ebb618b4464c6f9858f2896eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a5af23ef29e00bc194c4a9b54cb962a

SHA1
1073828286b044c0c287f9e29b01e6c7548b45e8

SHA256
99de36d9034201514751410af06e8305fba21cf9b8e57e56f05de78730a0d1c5

SHA512
6a599ddc0213750a83618871ca2b1903a25ead1830639e7065aaf1e5e83ed410f8627ab7b7b783971b5cad1a3795c9a6e47fb307dc443860cc8cac26f4c64736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637b6ed654d00fd7e14336ac4219e0d7

SHA1
f447d4c886b61ec4008d6e7aab3be68ee30642fa

SHA256
fb297ee7b81ae51c07f7fd48c423f15a3a1d7a5a4a62134c70223296e49181c8

SHA512
139cac15db0e881acacfcda14a70a754db5d53322fd1d36befb1df7680e9130df113e6acca910ac676975d8b2190f55abf5508a2a72b943d7d9991ff8164c156

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab731E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7320.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit