d1b89cd90ca870bc17216250f4d8e274db075951fc3ec8852514570a04b4faaf

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500586f2d6231fb38902f6c20b9d5caf.html
Size

65KB
MD5

500586f2d6231fb38902f6c20b9d5caf
SHA1

7bc5682a20fa8ae593604e812d9f0bc4fb4e635b
SHA256

d1b89cd90ca870bc17216250f4d8e274db075951fc3ec8852514570a04b4faaf
SHA512

be5145f711a67653e3564c3b0efa719cc7ddbea0e5ed54090975e2acfb9dc4adc6fa1c4f636b1fcccea768199ab173b07f1d2cc0f81a0ca12382a2589b38a112
SSDEEP

1536:hOpmP2j0uXefS/XM+Qm8FvsV5fP1bRPd5yNb/5y+Iq5OYNpVGuF7lJ8tuCgb:hOpmP2j0uXefS/XM+QmBX1bRPdYY4GaT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{980BB911-AF8E-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411035627"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2024	2008	iexplore.exe	28
PID 2008 wrote to memory of 2024	2008	iexplore.exe	28
PID 2008 wrote to memory of 2024	2008	iexplore.exe	28
PID 2008 wrote to memory of 2024	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\500586f2d6231fb38902f6c20b9d5caf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a80de94e5f15d6c785472e3b4d859e83

SHA1
e8a1787dec8566ed4b0c9526c6e95934a5f75cad

SHA256
ab646d9c36641020f8efd01e583af004d017e8148acbb90b65f3cd42359f6797

SHA512
859a51488f9b4171a4019422b403e9011c63b96ea8963b5f7f3f23a9494ea0edb6290e19bf43af22414522ee908a0a7492b7f8060a4d11155fe765ca16ca814b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e8265bbe8850b5272ddc6917867f7eb

SHA1
4f4bea669c56e6ddd3e524f87ae82d8bfc1893c8

SHA256
432d626c64126587d120938c6930d51006239502e2c9b1727ba8bf6218ca46fd

SHA512
ceaaf5b4123a4488b3ef5a013397435195b62406cf7004c4f47d9dd2e017a783bc5ae16b1b8c1386d9b125fbf740b458fb52c2b1f6a70da71623c82e108ef39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdf5fc46eaef56fc0e18ece1fac71bf0

SHA1
c0aac1dd0dcd82f8477cb1578f822b3b27bcdebc

SHA256
3ed5d4dab2bb84c0f9a9b1a1b6c09e2e7a1824d16339d0dadc2baf8ceea3ec42

SHA512
bcb08b3259d4767e31559f1cdabcec270db702bc93bac3a421f2796566f2c6e86dfb25a97d35c4839848992d381df935f59c8fd54a22e8209c7bdf7c4445f166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41caa35df323060250eea45274e9aae5

SHA1
588b8a21857d49ea4744b5ef89551e55d7d78bbc

SHA256
a94db121801fecef9b5d70cab2cd527069dc5296ca3aec1f8e8235ed1f5582cd

SHA512
7151a0becf07f617511799df068ec22cea2734fc871112447354bba9b46a5a923d9d52619db59a513c42fd9a9f7b6ca102104fb6a0c536f296054511c6f9ef43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6a8a867e9ef9d20f833d9507911712

SHA1
cd6ed38ed4a3bb2f06ba74c03c82145c5bcb720b

SHA256
806db5ddbe00a455c75774d6e788a92b08e78d6d4c081e2b32b3bd60385ffda2

SHA512
34b5bbced09ec1876366aefa45b2daedf0f166f3849a327ed5979b098cb5481812b792868b0414eb8ff34cf4af37c06adbc223ce78bba513834047287442a374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c38899ee906b85e5505d34e5a00a82

SHA1
0d36bd679b446aaec1df332747739ed14e67be65

SHA256
f9c006ed0bc37122f56b8fc6599517ae08d72fd09cd1053f09fa300f26245915

SHA512
7dad0f03b8d5210bd1b234ec2c860e56f6e84a54e8ac7ac51a2744058415dbea7b4c858742d4239221e33033a91b72d744103c53e1a13d7ca8f9863123a1cd3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
105fc3578a3b410d6532aa7f7ccf1c0f

SHA1
805f826efe49d578d88e3b3ee0b888c9bc0f0136

SHA256
35784720ee56bd196c134892778f96cc20efe0d735df7b3546a75efa143fbcca

SHA512
f083496bbf7ce0a3ec8267d35b734db12706fa9ff0794660a8f325e89cfb67719eeed548fcb55fc567a04410dc2872c7dce2de05ba5f283a90422854aabba4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8292ca113d1e0bf20522dcf428ed3190

SHA1
f17a8db59efd726235d700f6a18b37842d54a518

SHA256
2fba9fe2b6950337b6b9769a71057f88f06bfdb2e9b80c335060b17895d034da

SHA512
9f100386172b4f50139f0db9976998d1a3d8e60e8f82ad93c0ef0d8f29807fc1e5c63bce97ebf2a64f5f0378d751dec9c5326ea7fa72684d956c808de1091092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ab7944785a9fd769e033262e9fb2d2

SHA1
38fc9375732377b4b8cd79726e451dd9e698bc9c

SHA256
4c9f0493cf810af07d254496e2e538775b6496edd0b33fdc0ee080dfbe43c139

SHA512
335c1225f88cba2d04de420fa23f2fbed61fe3cc18606a6bfb52a7d40cf4074aa9af4ae1404ec84206050780ee5bb0ffddeb25a5bdb42b92df4eea95d0b19e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd4d9809cd1dedebf9b0f0436467d6c1

SHA1
a32eee19ab390a17e3cd90eecc48218a92ae6371

SHA256
be15f7683e9f5937b545cf69d8eff78512771ef90ca18ff73f3a5e3f43eae85c

SHA512
0f5bdc5383bbad127bd772356f151313a315abf62b9fa5f636aa055a7db423de0ab78fdf87474c0598759775ee878e8e8d0046c472b174f6f92bcc44e2992a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343d1694fc4b82f97a10e0d1161bac7b

SHA1
329801f0982d8bea3a1a515b19f51f513696756b

SHA256
8b85296f17a15502cfeb7b12375a3e0825dfb4071ad5dfd6ba438ebba57072d8

SHA512
318a4f467ab248213aeb6817c4604ff5763bd823378dd9b3c14eeae8f7311db4936443f08312587fb959db1034d36aeafe6b3079ecf6476d9ac666becc485b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab694E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A2D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit