fec03ae1c4b430fcb35a4923b3d9a56a33ad380cc9cb777ead15e3770748ffc9

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5301d52c9cbe5e837839217cd9adf668.html
Size

28KB
MD5

5301d52c9cbe5e837839217cd9adf668
SHA1

77dec56039216ae999cd4c6ad070e4fb8348f635
SHA256

fec03ae1c4b430fcb35a4923b3d9a56a33ad380cc9cb777ead15e3770748ffc9
SHA512

e2999501d928d5b97374f28003af0c9d2d8333c0d062afb5f73d4ced8b439fda3a56ccd791356b7dd7a9307d1ebcc0e66461b11734786ffb1aa9254263c92f6e
SSDEEP

192:uwTAb5nsvO+nQjxn5Q/OnQieNNnF6nQOkEntKUnQTbn9nQ9elpm6MHRi+5Ql7MBU:wQ/rSAjKRiTSU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411122883"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB10C381-B059-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28
PID 3052 wrote to memory of 2144	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5301d52c9cbe5e837839217cd9adf668.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d434c2de9265848ad5eb8e6830d7db

SHA1
2d735d0239b64e9107adb5a89e36aca2e30db9cd

SHA256
cd14123c0153df0518ad64eef37d72d0856c0ebfa7d7b74dd4cfcede680237c0

SHA512
9c6dd02d93813fb8a7aa577fa7d9cd0b59060bc6bb26b6e9c7e8b2c10d8cdfb0fa05be078a6ad7443839c37633f533baeeeb67028900529628a0735e1cfbc3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4de33b7faa560b0bc3c393a30782c47

SHA1
ff1bcc5df8cb5c25a75775f98aafeaf31f803b60

SHA256
7fd33b7c2bf66f06547f446cdfde44931aafe49d9231728bc99b665855d0ae1c

SHA512
b412d5f199ee2a52051d6bca946d1dc135b24653ed27889d67811cdba08aef2b1e4b0bb9e8132630f7da2bd9975f4a47eb45bde35d427797b5553ee10503478c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2fd0c0977479932919687785acc5a3

SHA1
d855209d8691d675dc71a6cf4cd9b06be62ee91a

SHA256
aeccc8445bf83439b4cf99e3a91d9253f3cb3b10c9475076052000c07d227a95

SHA512
854b7074b8dfe7d58eb3a7004a09bfd04889f802c4fc46b6bbfc0580e3d680cefa30ced00d71046b4b49f158f09079b67f38d31c647f33794c73f9dc37636ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e109adffe6ff48aa4f300d5b414bae

SHA1
15ffd16169b516fe43d2f6a01ad94762be73957c

SHA256
db94dec8ce047b2a559561998fa868ebccdf66f16d8f307a19f57792628bb8e7

SHA512
2f2b86b86669b5da306a196aee23c5889d6b764906215d0dd861cb1922ad6a80c365acf469f4d71c7cfb8dffc73c9ecace04030e6ca4d51b63080d859ef12f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18939ee086df692d09ab3065f1204159

SHA1
1995e559c4c333b563f399f0a1ef250b6e7af590

SHA256
d174f5527babe8d6e8fb8928a1d131bd9674a4f5f2426acb77e1e13d87bcc100

SHA512
a80eb0aff4b15c93d72c19bd362977f9d4b4dddced1edb7fb617308eb7d1609397e39e8ae8825a103e3e2199a0e08c8cd9fd6dcccfdca03f4bdefff09f435df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e365736052457f8c669338e3e829bdc0

SHA1
e5d884a2223ece3fe3350d556323e48996624bc8

SHA256
b0439c4ebd1ae508ceeea757bc44b62107b0045f059acbec0beab5b4ab9d5b58

SHA512
89ffd136e9a03bb597357d0389a67b4f0f99eecb201a214edc896d7fa766f3386b83fd1e1da5d40f56152206d727ffc983d613a9986ff4efdd272f4948d89b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944478a4c4cbfe4b793569b6240bcead

SHA1
dff527db41953d79e43ea598f4730249b1279a9a

SHA256
0f9aac0871fc2a423ea8c2ed792e3dcd8f374a0755323fc68f849e63b51e957a

SHA512
15e45922d9e2efae43d68d580b9f729479985f9ba9cfff00965f8150b5d52c34405ed483160b45e31b6a0a1b037b934fa9128c5b7bd384768e0d292c76a29ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8335e679aae091f4c0efdc50c7dc7d67

SHA1
615cd8ec8f47ce6ce67e02fe0447882c52cd9f4c

SHA256
d4bdb090823d880532790e5208fb0a5fc2a2a21ccf763f889947ba7c2bce5331

SHA512
d3c87ec8bc4775c9ac2018828b0920f57e1bb5c96e734ba8d7b76c615e12afdeb8cfef701620a07fad523161bf37a43608a448a3e791b8ac30f4085eaafeda48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76bceed26c849a539db4b23f87a0c74e

SHA1
084351178c2222f84e6f9cbf34365313cfa0d7ca

SHA256
eb9d07fee446e520fdf6f9c5b2bc0deaaf9373681cd758bbbc6b21b91d183b9e

SHA512
7281739193cc9590c41190003b393631b7e4e296a37842c86ebef58f0ad38a779f86e89794d2bc6ee78ec2d10ff09d1c9cfd52239672f6d85b14ac1258f3d151

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FA8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5085.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit