a8b769e71fe4a844060f46d5066587a5b04d9cb5b9e155e9243ff4ca6bcc2fbc

Analysis

max time kernel
132s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52993c3b5f5c6c65e422b30205fd3b47.html
Size

125KB
MD5

52993c3b5f5c6c65e422b30205fd3b47
SHA1

067d490cba5c2d66c33b4486bee7e892f79d9b7b
SHA256

a8b769e71fe4a844060f46d5066587a5b04d9cb5b9e155e9243ff4ca6bcc2fbc
SHA512

1f5a2b6b3ebbd5c78e47b0e2f02d6972f76242de83dfcc057bd70bc970a150f07e96603fb73d0b85736e519dbdb5ca76e5660d0927aa516907a73055b85906c7
SSDEEP

1536:E7NozC7gxqzDxtRAsa7Deh+lFs5s+1nIjN/5hl:Vz0gx4+lFanIThl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000c86704b44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000058d6f20b41ecbb7934d8deb54d9f873f9ce1bd1e9916bac3b301bae7ebb6eebe000000000e8000000002000020000000f348d59152562d77ece851a249bb1d3c710b903588688287a58ae9d3309f332c900000007a2c1ff17be7247479561a626bf6a03e45b3b1b70da5071df0da08ac1267d8524f1b0d0e6922f1cd0f1d1bd81d363f28d0c02a30b1a2915daffa9a8de237360bab52e78e0d538013c925bf1a320641bc871bcea953c84439c3d9621d7a5098bf255f79048b2adcc4a3863377c48163fc39388900d976e160ebb8e79ab4952a7364452828ef7ce870066109e928f59d65400000005ebbe85066f0695e8e6508ab50395b5d2454651aefada480caa8a0e877e632f3ea96a195eaa73a97d88dd1a9d8163755b4e0aeaeb915cd4d9070b208533ff8fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411111152"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78053C31-B03E-11EE-B645-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000077119b7a6c2044a8d7e7c4af14fb6303f37a22518c02331f5e44a09a22d65332000000000e8000000002000020000000685ba4a83df41517f718c3f4e30cb842d13486019e64c691b528e11e5dbd668520000000f5f0e67f128b05d5db99dacf307d8542f32149cfcd068da25066c56659256358400000008dabd38c83bee691f3c0bb8ddbd4ced3de2a2fd5c1def08312642a8d6fc57d1a099a502b1649bfb15387d7bd4db75ecc4f2f3bf50bb8a016a823cd78663c33f8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2120	3032	iexplore.exe	28
PID 3032 wrote to memory of 2120	3032	iexplore.exe	28
PID 3032 wrote to memory of 2120	3032	iexplore.exe	28
PID 3032 wrote to memory of 2120	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\52993c3b5f5c6c65e422b30205fd3b47.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
489122ff8fbf417ac416bbf9cacfb9f0

SHA1
de1e4b54cc7dd2a9921067df5c1f3b3d9377e0d7

SHA256
ce72d4a320b3b7d4f248f0d905fa3ab2a2347707837d6f6143e255193fea28ef

SHA512
3391440d908d423e2951267c724162805513f55bf7eb2ff2480a2e9efdfc26bcb61d6f6cb578d43b34cfd433b7d37f0aded189f7450cb604e40d1cb8b9403a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7548f59032d4f92611e45e9e2a8534e6

SHA1
99b018b5ee1e37fc83b0b7ee374a0b90a12dd517

SHA256
0f0362b35eaf780ffa39cd55f599fa4613fc03feebba22c2c81c488f964b657c

SHA512
8e3f5cd5315982d362786b31ed1d5cca8028120c06981e9186a96268a274c71705ab6e67f56dbbfb3f49b7954d2018170d8ae20c2f9fa557e8b80343a2af9391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3aa56e63755daf2e1376eab35fd8b96

SHA1
b9a30e70239c8edd29c0f40da008fefb28bdf1cb

SHA256
7b3b797a7d2ec06579f4fea6c2d3b55188dcd4a555b41e26f9c65613520f589e

SHA512
093f677af66b93ecf16382af3d8a053097c4dbaec900ab324a8854a268043ea5be2591bd8d167f08f049e1fc0244d7b26edaa6dc62d53774124f62db2c3955bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0798483cff9de9a5d7b569871eda0e6

SHA1
3095e905ae10e50bd00ba9f90f551eb0e3b5e3d3

SHA256
70dda1bb73af3a38ea80fcc20abfcd060750a39d0361c97ba5f2c4deb79a51a3

SHA512
f27cb35d504cbffb8e3e6d3d7d0115fd580c1e710ad8b6255810c37d6b7a8f8a2f1995cc85604724318d43f86f7e6d0f7e40a6308845d2cb3863855db3abe385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d73eac17d0bc3c398151ea0f8e4a31

SHA1
7fc31b3fcf53b5858c391b57b112c9cccf4fec0e

SHA256
9dae4789b6bc727b106feff7bc326bfef14f5f52d1b40e6476fa716ce0011817

SHA512
354efaa05cf0a6e0a8b20942dd744f70459daaf5d8fffd9a41a69f24ce48810ae5894cfc8369161846f5888b16341f6268dfeb77007d0938a8a351339b30689d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07ee9fe42ca08be2e5607481ceff0196

SHA1
404bd15b6d926c151b95e2b11a0740ece0e39312

SHA256
9e004fe68f25ac7ef5caa3cc1c5dfe95f9ce7fdfc99fcfc57f0c3d7aca72c2bd

SHA512
2ba10270a74a6efbfb349ee64796c5469f914ae9a9e1614cea867c454ad5ea4d79d5bc546a6b8f238ab87af2317a66ae82607cba61a8e4d83a66361bd54ac1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e2f901663f3f838470b3b9c448a31b9

SHA1
0adfb28b7501220a08351e6fcc979f95d87d42c6

SHA256
c2a3de4b4fee836c1a347cd4166f56a82f1138079593b86778297a9167306eaa

SHA512
ce9e6045f31496783c744ea54cda789ef65135871b4707cd1a7798ba3c2f8b73e09a6f688384c1e1638a92bb571b4da3890d77df1e72de5581a824a9558cfc56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40b050c78dbe66d5eadc3df883339464

SHA1
45eed9cbb02e3d07c6cf87844b3186ce96813c8b

SHA256
8a3d91aa13ff44cd1cf293b23b676644b19dde7623e65295553e6009e23372a8

SHA512
ebd0ef807ed56b085705e8e7a1bed4547e2d3ae6d55de63ee66f1715fa0529cd7dcd2390ee1b6ade58f4908f93de9c3a874a4dfecebbc8f23f90d32d0ecabd4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd46525a86657ca9fc17b9e4789872c

SHA1
e1045780ae09f096cd39e998ddd59962b2475b1d

SHA256
18ad267cc998b79c440e62471c99d0ddf13116af1764463b3d56f819ba4a9581

SHA512
57eae74ad7dfea0a3aa2181172222125646de5c73ef29a0ef0cc7b675118d3f58b0b3bb362a9ab62d45050e9e0428d8a10ea73b379ebe3f1a83050f422033cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b921518bceaffc8a16552077b724f0c5

SHA1
fa18fc508436db91211641d69d9a1dea13dacb71

SHA256
801e4317ab75fd536611a130b2d3096f0fea1b18b9207d75259dd3c3caa681fa

SHA512
d688a502ed77519410953494172eaf74c8268e5298b523990c20884b1b14cd3ff9533d89c0aa69b4d43f0784d1248831f2fc26f64227aeb821374bc996cd4038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bba458e517ecff03201f06cd33ceb24

SHA1
076aa9516e1c4b06cabf2e6323f3bf055327cdf7

SHA256
ebabb5b4ca315ab4c64c2679a0c83ba0a6bea9ba577d31a678fcc6ede388daa4

SHA512
1248338db14b14e44382d0498d18495183facb91d1a7b8ae1994a387fe2b13c87e8a98feeeed4cc627bce3bf19d5f10a1e349e4c8b4ffd7d8669ab2ae4d5619b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1046.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1049.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit