4705b829b643238548777d81c8d68a5766f8e9a2bc97df514b8b474812fa2100

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

secure-email.html
Size

572KB
MD5

98fab066fc2ffc4c2befae37ede9cd8e
SHA1

a48b73f24984c154f1ebd5601f4997390e8e8373
SHA256

4705b829b643238548777d81c8d68a5766f8e9a2bc97df514b8b474812fa2100
SHA512

bd8b1110a48a7c9ec7b4acddfff7ddb91d666c6a8383fc061a04cdf4172ee2d524b13a6c1dfbac93a17b52300fe3509fe02eb7d92d8c94ed6dffdb9034b6e996
SSDEEP

12288:1LHh4tGUfSeTtWkhPqPGS0ZcofmvlNt3KdDOt94BDUk5vX9:ph4tGiTtWkxlFZD8lf6gw9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411177270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67036BB1-B0D8-11EE-96AC-DED0D00124D2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b2617461a71e6418e43118b8befc5af786a6fc79dedf87c2158962b907142083000000000e80000000020000200000000fb8ef45b67f5f2baf1a09cd43011803bdedc5b6df306258ea1445dd0fbd06a690000000b779891b7a6dd0ae914637fbbef8ef7d932b1b365446cb7bc94f2c4c12dcfae4d4333e29ec820fcd0fa0d582b5b843f9d569b402d440f6ab42c81137da9b26ed0ef0b84250b2f4daf01257b6c6e396935a1896065a863f0535bfa18b1ac99492ee41b7d356767a2b96147a6ebe593b5e14ec118175e36a4bab29896a6e5cb1877d48771f1aef544895e4db54511f2a854000000061dfeb039757c46ea87cd926c0045938730a86d1f1cdee051145e649bd591ce9a0b386d1269487553d6d63d9ee2c54e5ad3a41c4a66b5a24ff54e7a52b62d2ad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a23e3fe544da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009b70ac04aab665090a92f276f19d4d44f96b353954dbd63294f10cfcb0e98737000000000e8000000002000020000000e9c82a6a7c3d59f241081c4ad32eef8921e1e84e20c7314485ac706bc56b73ce2000000019e089b5df732064c7928956625ef8c7c714392270af8abb4a2049ecea47bc3c400000008f9b10f9f134c694a8778a2d35aed0a5f35401aaac91be63d2cf24caed1c2f39138d6a3bc11f3c0f4b0f0613c0c6dff43d0a14dbdaf2c2ba659f352ca2b79077	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2796	2844	iexplore.exe	22
PID 2844 wrote to memory of 2796	2844	iexplore.exe	22
PID 2844 wrote to memory of 2796	2844	iexplore.exe	22
PID 2844 wrote to memory of 2796	2844	iexplore.exe	22

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\secure-email.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd6995ed68abd786becfc4da80d782c3

SHA1
f60d6b0c65f353f49846af8f48e97eec62cf9508

SHA256
bad6bad160452297b725e8a33f0ed11a1126fbe241e9166d25a0e2d1cd392849

SHA512
ce6e4b854104ff857e4733b1f6f37318932ab7c41d48efb3fa91ff98ebb0d24e8f867b09dec046e71751ec7111afdc95e9151aa60a1d2522c49582405e3dc870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65da8de3e8389efab877b0ce3de185c6

SHA1
048112deb841dec3c047a2e2a6db5c8805933c72

SHA256
c33a5207aa8de6dd84da969a8e4815710a3d7db94bd057fc793fcdc0f2a31c7f

SHA512
666336fe709186d12b005e8f10ee7bc4c30044614e678bfd7328e1767f1138e0001642a23d4515356db0089d1cbceab003db18bf113a02734a64393785460596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3808dbe873b672c77adf862f8ec2183

SHA1
c0361511f468334eba72856390cdbbd17da7e179

SHA256
a2567f26b3e66bc9c20852688dca6892b14de72658e7dfdbeef544b92bf9fd8a

SHA512
23733118129554e1fe56fcf10fc0a604e79c228ca6a3bf18ff26e168a20971308546e88e5ea19b18f455fd46b26779b0724cf1b203bf7ef642395fb2ef6d51be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b059749d4dd2a97125bac4920af02f

SHA1
c38614586d117d3dceaa92964321b7af6c7e5085

SHA256
d355cc6fde90d7fda377d89b8f46a7e6998d470ede3afe10d2b5c2c917db1729

SHA512
2715ce06ccad93ba39e8b653cdfc74cc39d7d8d2e75a70a77f9a2b14bedb7a9f8ba2d27f48cfdd5a9fa51efbb18d40418898897714f39b9932b689014d651c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804588b7b9bf30e6ae0f2ab7ea9755f4

SHA1
07597b5dcf1e0c2f629d8c960d4a4331db2623cf

SHA256
896558754d6158cd543d37502dfb290a09c13f1c1fb41071af724517c142015b

SHA512
8c2a61861332ea17527507fe3440d189eea827a21144f6a15aed72dbfec56b717c7bb8944495d6319de1ef94cdf398269e3c664892ec98264e37003a43b55ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62d87b910349adaf8e32372355ec585

SHA1
7391f5be5143dd5b3e862b2ff071a261390f1d05

SHA256
33858b782cf03f2c1f5913d6ddb1e975a922eaf01e6175d1db2ca2e2ea369684

SHA512
b56a80e8b8fbab536744fdaa7d77fd7aa5aeb386b9e6ac271f4409f390d7ff6231dd2031f57027e6611d25d6761256c71a33ef31f3110a53666a8748f1e7c1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f52f44bda6dcdf16c9f5795718eba694

SHA1
84933dcf4cdbd2c898ea0132bbeafa62422c907c

SHA256
e8cfccc8a51d7a810b1e49408a63f52523e7c9e4c976772c2d19e13fa51e3395

SHA512
3bb1fa4bb4789beaff14626824dfba48b669d88ea189b6d67e8b2596c19dc2d015c415f467b8a3a5576e8732e6277fa85eb50e24f43610996a3e5fa74dbde09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16365a33a1c1eaa88fc7001402f1df4d

SHA1
94c9348d1f90512cd062781ec08f03de291d26a7

SHA256
a12b327436415059778f5997e9b340b810db4796eefdbd5af68ca673cd30a327

SHA512
e59c38243c5a0de80181dd30c6787397c9376a173c72366984966970d588e24b81381fb503d591e9b5de018078ac4e8794e260af508dea0d4400721b4d021949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
708c9170e30529ae7a0aa54d390b7dbf

SHA1
e964e41764bc12f04a43852ee67459a08fff9456

SHA256
32323ecdc1346ee71964792c412f525201ba59fc04bd7a402c2ff201f5cb740f

SHA512
c47547e0000b73251cfc09d746c4e68e2170e1fa531442b5fbf744925be9ea48075e7b00c6499635bee412177964023919a2389b3bd9660162f798a650819867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8ec5e648ea41696e940abb9f7baab2

SHA1
569a8c15a72bcd4ace765ec212818d37dacfe122

SHA256
1280968eaefaf5f1761a47baa01d338883240d18c9e3350c6a7741324c6bac4b

SHA512
9914acd4fff5d4205cf81b93a2069fc748d1a4752b016862c15a0e3a08c3efcdbc66c30a33fc6309e9ebd6b5ba48f24346c2f8ac2a3b39df678693e3fc4dbd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45058c25f0d8c9d2731e0f17e6c631ee

SHA1
62c95e259555078eb432b968c843718e373629fa

SHA256
902ab9e6a3087fa460a82c82456d9c9f38b4ab65a696f7c27fcda33f6d1e8dc6

SHA512
1e4ef0346265b4dd7765176538c96c09336b40c2e9c64c66715b25430ce529ad12ebc391437a1d7e15566c320f8498a55dc193540cb29468861d4c78f90134b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c6e92cf1105403c3aa7a6f00c9453a

SHA1
e644637af940a0a3cd9223f0de40edec23b0ad64

SHA256
d89afe78c44c0dfaba8ac061f9ca937c9cd908009d78366e91d84909abe3c140

SHA512
945055ed89232c1b600e9637af57d728bd89abf8d83f92a2e5379647f85719fc5b2ab2be4266c873a8d8b669a54875990aa57d0a6329675f8df87d0a4620e4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814d493d0c3376d3fac70559a44d0b97

SHA1
f1b7bd3a3537fb0d434de19362e75f6949f9e8fe

SHA256
b5d00dcaa4dc5553117d7fee2ab7a93bf20da25524b07d39f0aac531216ab8f3

SHA512
73ad60291ca1b3979389477b67ada9cf4842066e2d59812bcd5678c0d3e7ff9c64dce32cc322d99631d55f415b9b8759523083241d0f2b942a9974dac185b1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6e4dde476919ba4475c224bcc5ff4e

SHA1
e8daca92445717cc780eb1f4e4b4dd6a596225b1

SHA256
efb0e5fd745a00539de316aec01619cceda30c2651b31076ac8ad3056e664651

SHA512
ed4e2ae502201fff79c481b0d6bf62dc02e5f4d7ec857705c86b1b18cbf00257c5a5749bb54d67473f370f8c618983fb2ab039f9e74ad9013ddb892c60870e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4368.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4409.tmp

Filesize
93KB

MD5
ac61eaa48255890d137c13baaf731c5f

SHA1
f9ae28f6c21358660ec40239618f6ef9f6b333d7

SHA256
a1535f48249efcf97d37e825a27275a4e0d7e4ac51bceb4ff1262956c6e48c2a

SHA512
e36257b46ed34c2ee03231464ec70d889d35ea9f7f9255ea8bdb062838df8a4331fb6e8808bcf52323e4c26d6c6e9be8af4babdada794495237fd51f75b79449

Download Submit