6cdefcc2f60e1895881b7c8961b480745a00c952b849673b7842e360ed314c35

Analysis

max time kernel
138s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment_Adv.html
Size

5KB
MD5

5ee4186103857a120c2f2a3e83cb81be
SHA1

99850ecad8cdf3a946ab382c9741036de2303bb6
SHA256

6cdefcc2f60e1895881b7c8961b480745a00c952b849673b7842e360ed314c35
SHA512

dd8522166c919323fba735d0a5e2ed8552e795a0ffe66440d2622213b4616509fa6bdd6d8ae9ce59b4883ac449ca00a771c4dc430168edb058c4e13696f43854
SSDEEP

96:2NQ4FLLEpFlqjBADVCrEbR9/pBamHYjEYsBayB06ujd1Z0LRybL5qE:8LLEpFlqjBADVyEPCCYjx7yzeoE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411046495"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d019a7d8a36ea77b69e297e3feb3bfe08639db6aa1af0e07b1cd9649ba2b1fef000000000e8000000002000020000000da90b6646e378490c28a2938e56ddd90f5222e2e37e0209d10ebea17e24c647b90000000df24b4e49287dee6ac15d945db2341599cc4a87dc2fa3527a10951c89ca4abd34f9f130f201a48a791f9cc63719d929b22abefc9e4c4abcdb578f58673b71af6a9a7b909a68c53be1e9a436bc7cc48358899ce62c51655fa2d8cf0fd020a889e327b93c202c3cba484dfb2a7055f081768ead7347f6a9f6568cf7d41f52a6fecb5947851574b5e25c7223d8a128715aa400000002fecb2c36316a6fe79c45b8d6cd99b79e25c3c2f37f99dac5d18876682f4d9b35aa52b12c365c824107526af1402f02782081e4e9f2f2a9f7a9d5a86080c3c5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E99F79B1-AFA7-11EE-A62B-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0df5ec3b443da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005f501f3d95285e86cd1d397bd83f71b992fcc0888239f0eb308d236648914eaf000000000e80000000020000200000003b3587d32e4a0aaeaf43148669f91ca04c7540ecc3564d11688bd08cf0352037200000007876bf3a331fa8f494af0afacfb60e4d92b9c3d6b08455ba2205d5039be31fd540000000e97bff742d937647e36e24a04c3bb97fe647acdae2072ab52eaa2f238b99f4638ca4aac21496dd17727eb29adae2ea3f2b834ddec216b2bb02e5d5ab9c05c270	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1216	iexplore.exe
1216	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2084	1216	iexplore.exe	28
PID 1216 wrote to memory of 2084	1216	iexplore.exe	28
PID 1216 wrote to memory of 2084	1216	iexplore.exe	28
PID 1216 wrote to memory of 2084	1216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Payment_Adv.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68215fd832eac7125fc6f6deede3b31a

SHA1
097a59b3331df98a8ba583e142674ff78d690bbd

SHA256
983712b1bdbaad006940e9128fb7ce525ec016567ad2e44b5a0ffdb2f3cfaf54

SHA512
4b91d1ba9c3c28895b09f45439e918e8cbce6820370cd44dbd074f9b554ca51ee44e76da8a46ddcab2d71452d68e1caef63bb0e1ceac11a58d697508fcca5919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa15eaf9aeec7d0eb9c5718581891c82

SHA1
9693f558ee0b787f91bb813ec11c0c2e4c0b4f2e

SHA256
22a348d3c4aff98383d0b6dc8b1f0ef0dc4af40338a35c20acd3d76842397363

SHA512
7df6b47abfbad19efb33c255dcb0a698233d73045fbd5bc5ad7c59cbc6bbb9fa74bb197c229b287d8b4a53688f3e16f333b6c278037c0a2ac9138a7af21c7e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf1a7e693fac630da03ea6e20312004

SHA1
b755b8a3c38d54369416038de2e04f30c39fa892

SHA256
9372684f47629c4505afe707693bb3e29e06cd9608c6b2004c15f5e953254ab7

SHA512
cf6ec2f5d6f3ae9b51a6ff74b914a9aa5d37286953a55eddc9f195feb8cc95d42c8c56efa507ca1d0f06cf6c49a34dde0acdee9ec54b416d9746488093abb75d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8333d6cfe412e9f98dc588256250cbb5

SHA1
2a5c8c66331c24d42539f3b85d7da7fc281e5c59

SHA256
e0eddb6a3623152ff092569984703dd34ec5b7126877e42f0964d60f0a4e3ab0

SHA512
1db4ed3a0a7fee6b1a50b2b83a9ba5f72cfce26a400f27e84821443bc5007368be56fc7704e2a3fd0053d1609d93ec97777cc606154baa8b21341167054e5989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f38f96198ae373c1f73acd881e09bd

SHA1
187c24d2b0a007e77e11e7fd2ce736adad03f929

SHA256
57e984c5b912c5aed3ed2dbc97801e0b2ba7ce7594d467c3cb8c70cad87e8922

SHA512
e4377f3ab1dcba3b26672e218a5a87257b9f76550f1b6a4af5e4e342d6312cc7f30b242cfd6081e838111bb55d676dbc7800c442b0ee6725fa9ed6d9644eefe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87da2b5a15d38aa1dfab0d73fefafcfb

SHA1
222a80da7713fa3e90c4d4d704ab68755f8692b6

SHA256
87c2a4cb631f9fe436c0a0cc9b05d1faea5e2d790687b6431a02714633bb58c9

SHA512
378596a3323a989bbc21a17a4cad608f57c7cad1255e7a77c3d23c07ed09bbb2cb0d5de3bae107da8232744a573caebba57943c1441a48472ce8316e58fc0736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63377be37e45275932083e493b52c198

SHA1
220968fad0bc93777b0c4cee24c89873bb971b8a

SHA256
5208b254ee290a2d096bc5ed085f18aed891dafc96f7d2bbe85a8ebc864bc529

SHA512
6496f1564fe8c26cd01f82cbb274216246a2b8150e148a629cefc373bd243692d7b35746a2caff23390342caf8060a53bc1eff0fa8f52d5c4b74082a441baa91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f99ff830849c84271d326b65f8c3c22d

SHA1
730eef89e4bb40ca477ffab6ec95f593d229f93a

SHA256
42ff9072cb8c143b4bb66e9515e43288a43a3695583554a29f39ddc8dbe04331

SHA512
2a4cf0bb0a85c416dfc36eaeac2d7776c301f34daf4708531f726fa0dd76fff6e3c4db12b244f553efb7f19f0ebee8668cd10876de2eeb2486cbc5ad9dfad58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8353bd287538e07a8e03aedf1d2ff2d0

SHA1
2e70cff94d79337ca67a94aec629efaf07fc59a9

SHA256
0dfd1b25e2d1d18524a647f738bd0e00890ccf6d448448723c53a8bb35184a72

SHA512
b08c0417f614e84aa8fba9512cabed08555e6183a4443f9ac81aa70c33127f7f4735acd40ca45f67851cf30b9b60f53fc7a5bc80a57ed9ad27ecdeb4c9c87153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36a9a7f7173d713678661ee945c23819

SHA1
c89c08c7d353dc9d7d714ab2662d6feed207fcfd

SHA256
24e7289037b714963243785794e2c21de442fa2732c9e5046c3c5cb2f36989ad

SHA512
7238f127e40f4743efc9b093899a8256b83dab361b3c0ef0bf0e9a40ac8029922cc65b135dd9031e45ba2d74ef08e8f3c655896685c50295341639b3672edd67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64fcb4442031cd06fcc852761744271

SHA1
7e8dfd93332ee35f78a4606842d1bba30e7405bd

SHA256
9f010c16eb0841150e38ade81254ff208256e88097e3de9e0b6549bc55dfdf69

SHA512
706df2469842e4b8e4e7250ba705eba776f84be42bf3992b4fab48e4b2377cd72fedf4499782210087801a3e1e3fbdfd31320cb7c5fd7188d4bdecd6514f7483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c13c25e576007e115859a4e9e0e19f

SHA1
78e07dc372ad504384f004b23ff8bb596b1cc6bb

SHA256
3f0963845658da5c6d290184c3f561c16894ec7ba593abb0ddec2117a87242de

SHA512
301fe144562a3b1278bc260c9b02a2777a8ed6229b43f68e96ec97c4ddc66d5c028920178df72339222f7a9c6c6dbe667f899e29ee41206947ae410c53672d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd488f415a6a19af34e91450fd429fe1

SHA1
890c9b2d587c23bd40e3ae65b749bce76474f4ed

SHA256
124c7c1496ddc464275c1fe64a21f08c518b2877b6d1704119326c822dc9b52e

SHA512
c10cbd3ccf6a4d814a8f4afc99dd531f98ff7941c2707cb385af678b0d6b870047be148963886022bf2f09c9b0e874bfeda4cff3ffa8017374f26fe117b41e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d60bb679c11941549937ff0c8ddd80f

SHA1
3e4a4cd46e48469fb503bec9005aa95e5c1deca5

SHA256
ea42f91d55442451cf58dacc2354224a34f113c2ea6c87feee88f1615c972656

SHA512
74a7ad83c5f3af4a232c6bd09c8d431a6c7da84e01ea0aa5c4e4bb5e1fd7f5fa2ca55e2b1075929ad81deb2ec8970f3ca77bde4b9c56cc99d8d5a742e5314c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e346e67d04b7034f85594292bc74c3

SHA1
9ebe30db8762080bfb09dbef2de623180a646dd5

SHA256
6f181faa20ea0f9c99817af009051d6670b6b43e656c01c51753a1c2acfedaee

SHA512
2038f31f1c7c503805b55522bf242c2ad3f755aeab12f0c7a7190e7d361c977d2878975039440cc4689a47666662a79b5fe351e9f683d613f777fad5ae318684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab226fa61919e164bffbb671401bf42

SHA1
b9aecb750f0271bd6c390ea7e31e761fae48c8a2

SHA256
5e69c496acb2b2e1b7641c90f69457cbdd05e5981e6522dd99b4e607f5ee0b59

SHA512
dba5150990da6b7abcae943cc92fdcf6dc8133ef2d347a058f1e81241a4ffc3f85d67e6d8f6bcdf3bcfa180520749713d0a9959205420ef704c4e492326c1cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79F3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A24.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit