38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

612B
MD5

e3eb0a1df437f3f97a64aca5952c8ea0
SHA1

7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256

38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512

43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4781DDE1-B069-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411129544"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b53b1becb9bf55298ed6931b32c2e5f991b4de32a27adee677ecc9ab7a274ae8000000000e8000000002000020000000ee02f40fd09b5e7ae540c6d9687fc6ba60263806dcbc56531cc529c17b9c968a20000000bcf3b9b417adf3a7f550266563c6d8f7897db08aad5fdaa2e5e356d4a46a8868400000002740c16853ef49126ed18caa0b449ae422cb103f7f9d79c5c8d726fdd89160066c7dda4fad1010ff7b646bbbc81e70a38ef106fc4339ffe47c99efd35c0b77b0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0aaf41b7644da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a1d69c73c30ff9e0087eea1b992324eb79037f7a648634c29bc615d02f6b9ab2000000000e800000000200002000000058a270d703d609083ed88008641af95a93771b05dca5c362f35a11a33a1a3afe900000003b8b0a66a48874a8d65d09a71f13dc24f02cf0b9a41d34fb8cf9aef58859072d1bc0bc824f6cb2e6f53d923c4d8f35b825dec6367e47ce0306ec87cd5ad682f4a5fa5eee70fe17667ebc682d7b4af2c06226cfdd89634ceb16e144bbbabc6382f610d621b706f40bd7de98e495d58133238e648dc387db91d7d917ed2ab095ad31ca3819c0ef235f9f1385ee20cc1919400000002ff3a9c0a58f0199e0ffa94aa23e84a9b1c234680dfd556328473e4ebec87a72229a27b057a1ab6b794dfc5db84ec90818fc5752dbcded1f12a5c943e488c86d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2232 wrote to memory of 2264	2232	iexplore.exe	28
PID 2232 wrote to memory of 2264	2232	iexplore.exe	28
PID 2232 wrote to memory of 2264	2232	iexplore.exe	28
PID 2232 wrote to memory of 2264	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bbf9f09d6c90af36116e5448f5b0fa3

SHA1
725b08ab35bde04ec30f425ab22a77b7b7f52d6a

SHA256
315ca67cc5bcdeeef76241ea5193455dfe0721f357042e7b51cc49b69e29e854

SHA512
1fbb440df9b20bca6299d5353f03d2e73dd31b219606222fca7935ed174afad68c3c5295c6df450959567d77a577bfbfa49dd56ad91ddcb8ebd95430acac09e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fcc09cc5b7f84ffb0e24e4e6d9defec

SHA1
dbef4b90c219ef3a40c2af981fd3633a16bd9efc

SHA256
1ee64506aeff0105b9562064e86af6c2ad0a84bbfad35ae6f353f759b137649d

SHA512
b3ec88efc3743ff074ba25a27d9ed1ed42923ed30e8ba46eec4cdbb5de14a78c8511c22e94905beb3fb593e7d4789ea91309b6fee56048fad4b0b979a0f5ac7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7a818f58327d53964b1c70c2809bc70

SHA1
80b6e4caa7c54af3c647ebacc2fddaf5957acace

SHA256
470bd1c9a512c72a0afde0df2c4c07aad3cf7d017aaa3e15b4a66e8f6dcbcc5f

SHA512
2b24aee250ab5959aa2b5302fbe5213912abace8e8fce386947194dcc87fc99e40df4e5971944f34ec32287224037e68d0aee46d3a7b735f91ae2f0e4407f3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb5dc3bb939d05d237738241e03905c

SHA1
706e6ae149f578a254b1038fdf56a20ec5b14cea

SHA256
a242ff5ce2a4cc1e9a1499742c120a99c28ff37fa614b13050b0d1c4f4e41a7e

SHA512
2dfbeb5a3c8ce6da66d7b7d2c67ee594019ee29be6d8a300584c141b222ca5eb5d5bd3ebdde5c90e3dd13ac09da33613a6d30ce2aa9bec8133282dc5ca5a3d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e4d2b733eec2c819edf2c40e328550a

SHA1
d69980df2bec95f3f71e8e06508ce1ff0eb1cea7

SHA256
7d0b3a36735377c73004135f6914ba29c776d8a2949edffe945718e9a9bac7cc

SHA512
3ea846df29aec8dbf21e7113b61a659301e9d1a461311f515278a32665c4b53ac3a55e7c76c885ce4b6b0dc17a78c5f48b62df055b37e36d4963f5bd10f3be0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cfbc873100ad606b0581624a79868eb

SHA1
5eafa92181a0d6cd74b4e92df7e71153ce3d9460

SHA256
ab4fb6aab7d56d735ce556262ed25c5db468cc4890240796b42cec148f614326

SHA512
a0a8d459b7853b013cda23baf1e7d775475c030b4931ad51fd73269c86a208574a38031555f099021b797c651fd90d5acc5805bf0ee426b6c284be034ff580be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b821923756a84e39bde81b0156430282

SHA1
dc8cac7b3b25a911f2342af067d23de57294c1e9

SHA256
5dc8fa027c363d4430c79e5854246490dc986cc4a6e9db7f4a70a40ec2b65e27

SHA512
dbf7e77bf34e2fca027187bc2a6836a9f31d28ebfa153cf387dc846bee2b4b64742fbb915b5271948ab54a0f5803df3a2c51d2ba908fa78fbc2516911d600dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30292c337773d9211adb98b7c01d288f

SHA1
4ecc8e200316efc7314a988452b6d923650d54e3

SHA256
78badb40f9273630c6e1b860de491909cc59b4d7739eb2322b0b70dea173196c

SHA512
14a0621bd85ad66dee926e262b6092835ff5d8a4a1ac0cd020cc51a62debe7f335aceb10108f44d21b4eb725db92117ebb151c3d1840bd217c6a5e63084c026a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
622af1b743fb5c5ab7f9081adee16ff7

SHA1
c7b29d28297e498936b2421d98bcdb9700263d66

SHA256
6be1c4cd44a07509b1040f3283b459b5cd83f42af8ea30172a8d28d59479956b

SHA512
63d8cc86e2906989c824fe03e6627bf36b667b468ab140e59f00d53b76ef19f838b857b1c28b4c2df2618407798190f39f398cdc0a2af5beba654a8264700856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25954c2b49112d92604ea3c80913712c

SHA1
fd1d2d58973d832422137d974060a272382e5a2f

SHA256
b4693bd9c9f1732752a6d52ff94bb22ff2ec574c8da942db64c1da128dc04686

SHA512
5f8f4b936e5002df719b3a54489487271868cac2b1399fb4ff133e6149b5097c53ffe835ca0e05ae7ed830b48bfb70de683c9ee4041d48163d9a4de29cd6b51b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29D0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3681.tmp

Filesize
127KB

MD5
6e3a386baedb35997ed4bb6a4343fdd8

SHA1
5dd34c8bc83289e0549d07d8b4e533a7e803edef

SHA256
9a1bb88cb0988eec6aea47e64cde030d2e078c8e837694b1f42540a2c552e9a7

SHA512
416c00c66b08fd9a92ff9fcc7ce54aec837f332654540a7ddc793549ef7bf8ce3753116895f722ccf2f6e740931e645290bd98982326451d44584751f736576c

Download Submit