42a9135f75e7e873329119d825db50a41b34788384be1316e42a00a88f76a493

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510c295395e87b5088f8f6756488c09d.html
Size

3KB
MD5

510c295395e87b5088f8f6756488c09d
SHA1

406ab066bad8152dfa0061cc2126b0b38d069f15
SHA256

42a9135f75e7e873329119d825db50a41b34788384be1316e42a00a88f76a493
SHA512

3bcfadb64456e7d55f015121cbfddf2fc26db32de204e689e8bc10d010f5b3ef4c8358fab7fac073ab0d4aa3b90a34f5ae3084009622262d56e07bc1e805f538

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB104C31-AFD4-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009b3af68f8c4fd9e2d49ec39a2b7bc9f141e22ff6bddb1cfe523cd538a296d905000000000e800000000200002000000055fedbeb6f8289311a51840da58381bc39fc1c607b9bdd051d51a65d6382577d9000000093ed942f87153cdf27b76d99ba1e3120d6441d972337afa8467b5cc8c6618da3918cb4a05ceaee6c9c27261119aa2bce8697eab8deb6ed261d5a72fc7afff8a2ee25006b1eb81a9c2af266fcabc1101d48542838336a8437b28b53c7c898ff56ee5e75eaaa60dd696513f0708151a7e8bc42492b44c23761a3d0d01e7d244e308a83ed13e6610203a2e090bb27e3c77f40000000941151198f0ef0709d0b40fc2b4e86f7427c7ee47853ca31e946d7a29bd373b4e28c07baccca95896fd8591431c4cc032c8bdd31520091e964a53603b0a60077	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e703b7e143da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411065805"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000023d3f905e9c481bf612688fc6605a0eecd7328dedc20a8084b17319264028b83000000000e8000000002000020000000d690ddddab7d76f9371f80c26aa8f10850cc15dd2a5eefe3d267689aae23c1d32000000057e2a7f8393df93f5009130afdced96d90b9ce4c651631fefd286ddceaff99eb40000000fe4dab85f9dfad0a3595af55e2d1366f05237af7a22093cd1c2fe9eb93a0fcafe4e67f269451c6cc53abcd8ed6a654a8df8805619653f1e9feed03fbd92653e3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2384	2188	iexplore.exe	21
PID 2188 wrote to memory of 2384	2188	iexplore.exe	21
PID 2188 wrote to memory of 2384	2188	iexplore.exe	21
PID 2188 wrote to memory of 2384	2188	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\510c295395e87b5088f8f6756488c09d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa083c297030e0d10af5dd0df35e2b6

SHA1
aec8b137dbad1b44d6e75d8c738ff2d95a960fe3

SHA256
04ec74a19db1dcdd46aab08dc63bbd6fdee9f427e5b5f66a4d5afe746fe353c1

SHA512
c6f840424dea5992f6641e5bd95e15568a6fd3701c5a258dc9cd5e253a53f6dd95dafe018efcee41c2e99992cdd608cbd06eec9811f3970021380b58e92f0c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a4ded1c5dc732c075e7e1d7f571501

SHA1
dee90b808157ffde1ab682cf3cff60739d4d2b75

SHA256
9837ff476048eb0d82da3869abe641aca2d71a435051401fd36ec294afd9608a

SHA512
24508e5eba68c4e54bbe9dfcbfebd36bb2279c939bdf2179aa890349e647beee8b1ea301fb5c7cada23d1126deea0785c0feb13cdad88d89f11015710b8f4012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e76df44e0f3c6f9bab58904e03026e

SHA1
02b926ec3aa0d1f22fd71bed902188cdd069e931

SHA256
84e9b4589006acb2f8a6e41aff17f4ade7d006a89f28c25dd8add9b29837e48b

SHA512
fb3a33061688d82bfa1a0272567fdec6e1d07dfc051ce1e114c6726f85b7f65d2965818bc51b21acde220dd703ec1952b82ab7cf2321c60a3c2888cc30b89eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9214710a07a7bf9ae2f66b8bcfbef8d

SHA1
9df727dded656a2369c4a290631f75effa8a4ddc

SHA256
5990c521f33c3851b96e9ac2098e2ffa80855ab19584623d11f0e3ad8988a442

SHA512
d41201fae01bfa81fb9fffdf469ceeaa5320427319513a3326c129bad841b80f983406862f392338f81eddf0299045ed6fb0724f16e1856d7ca624e47000ca85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f77069adc71da997a50163c8fe6f944

SHA1
63f8d541fc3a6d1f8a18b4680df1e75da1e793bf

SHA256
14677610b58edcdcfc68739979598bf29399a69c95930b84f2b039159b1ae74e

SHA512
46d6586b9672e2fb66393ddea468a49a0bfcce2aa2448ddbf0873016304fdb6fb7a1ef968d5012f65ced9dab701d6c5626866839078ee3ab7899eaa40e73358d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6b567b6002fdce490e8a1faa23ce48

SHA1
0a51cb206275e7ab873bfc27c893964106b8566f

SHA256
87ed332f1d44caab89c083a27702662d9c10db06a649e58950d6f1323c5a2710

SHA512
46c4c03da6d3c055f3fb284addc4156e87aa909c1bb40ebb09d70afe0e197770c41b0f6764d3fe84aa73ed613978251549cf3d77a1cacc815b4812fd4bd481ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
278bd28ba230c807ccc7ac10ebdde9f4

SHA1
e087c7f833b5399a616bb454502eb4405fbca438

SHA256
1d4a858392ca6cd0c7331ee1063ebccc822fedf76f64f2e3213d9b3d9ca03589

SHA512
a680a45828e8e13865f682e82cc14552c3d861ee4e6e895d47a277248d966cf81014f6af3c440909a95a927feaef3177b07d835425ef3b7676fe094184fef8dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a55d988394d8b3d749d3acdf717826

SHA1
55ea6c58910d58663d3eb18769705f00f429e4b8

SHA256
b728021cb27f15a1a6d499d784410cfc4ca4ef4738217122e89eafacd72510a6

SHA512
ea0e21728db0a3726a3b7f785af7f01d189bb91570b98a67bde81dc8ea8a9b4c27e301b46fdeab615b5cada26860ac53d45de04648e80f5a2be43323108042fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25a3c8eb077242fbb77dcc8844caedc

SHA1
919b5bf72e2bb6f61b183a52dc812001d1bd4e4c

SHA256
f71f71f396e85765c33dafaab00dc874afb726fc21697def3c44dc4b6e8c013b

SHA512
13c969d5a7e142c3497d377cb01fbe01bcd698034e01ed4959ebcfed9756185d315908182d046021c57ad0d907eec6c3e4efc268fb804e6f0b7a279c431adc14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55185105af03bc3f8a85e15836790488

SHA1
7508336937e602deceb32fce37a35c111ab984b2

SHA256
bca54177347034b3b0ae25eb58272f587eb303fabf57495f40ef99ad7e7ae8ca

SHA512
471bd55c5906e22eb6762679b79f148e13fd830190b0dc6fb7a27443826a08ca7973c762e5808a67d3d8f7871388a69783ee99422680ebec7c6e6ebd5e94c6a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a25223c07be79b654050152de28bab

SHA1
13728bc3e62f3b46b9500008d2390a6f1f31d8d1

SHA256
55737ae6aea96b57c5add14d736a2bbf5d5e139519fc0143405b48349cbd5306

SHA512
bc2c0af6d9ac1e48e73d404dccb55fa3d292382e1fa6f2f4ea47aa2ba07ace0a06cfe67cc444fec745f588a1e95d0f3d594957b57ea02a4512e31dcd331d5198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5d1fad36145fa9ec0f1d2e7886ddda

SHA1
49c0bb15b31ef9005309455a525746d5af7bbce3

SHA256
9c6ccf7e1e82c44f8f3b1a137608083913f65f9654c5a11ef6fe4a4ce7ce8bad

SHA512
6fe469877734afcbe626e6dc37b803f16e385e273767b44cb84d3eb5b7557a955266c7105c174f5a6c18f3fa81741debf409bc9c41eb6134a1d4d74d10c3a6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6ef78eb4ae7291ccaa20cca8203446

SHA1
363ed11732624d5bba7c4ff6ef48afff7e32c49b

SHA256
920fbd5f73f6187547f1e597f31c871be78d5188a22c94a62fd0291ba0fb2a31

SHA512
3c64066fd7c72ff73d6d0467a8a873ea6b1723bf8281e6c36192cc59ef751f72aefbfdfd33ca76cf78918c98d2abc684d818d68567316b1d9ce5615267b99991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18cce5b624f7934cd63b2487fa20c45

SHA1
cefcdc087955284f9810be4277faae81c3adb776

SHA256
4f786321cfe783d8fa825fb03217c9190cbe9d857f83fbaea5bc1a91d4b6a391

SHA512
ebcc5c2a700e4c89b62167c7552f436d1a47f2ac08de64798f45ff8cc473d2378c789a4ed082794aa94831235e8dbd22df0dbaa18f48506a27fb4fb6514ef6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a4f37fd06d7b4ba9b3ff35cba3929b

SHA1
1d4b7f5bae37671b4b3953de79c755046f41b08d

SHA256
5eba457f6e3beefb4fd7ae5009e7c74e810bdd908f9baf2ec5e00d7c7ed8ca1b

SHA512
397624221bb5153472f3cb3921ba4833488f828f51bf52ec6911bf66d2549371f1fe23b7310d3f64b0e76fdd19d7e659c1eefc46b3c195b48acc87b268f28817

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89DA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A0C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit