f87a2d0999bd06e09197c5a69a4a7993a96af1d133c8300ed421c795ef7076df

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

532568ec76c79b6d1cc551cba0ef8f95.html
Size

63KB
MD5

532568ec76c79b6d1cc551cba0ef8f95
SHA1

458611228633eeb6d6d81a117c15834ceed4dd82
SHA256

f87a2d0999bd06e09197c5a69a4a7993a96af1d133c8300ed421c795ef7076df
SHA512

dd4692b70f18e55008e035bdf220fb0c1016e5a374ec523acf088bb3d9a37cf00a04b4855f401746de89a2e847137c1047adbee348d0b3366cd8d7ba1797ddd3
SSDEEP

768:ZULQMc2cG/DInNDPYyMSk7vyWWP+16YPtdI27ccVprpaDT1/lfEDjTRLBrs/4+E7:ULsYBISprpaDT1/lfG3RNcPEL3599

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAC15411-B063-11EE-B645-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000bbd32b4cc1febfbe16fd49132c2f692e2863357b7760741d3b9b097244aede4a000000000e80000000020000200000003c2572da1223f34e5216316902d013572a5201aa342e7ab56d9573b5a972c2f190000000713e3c92b6d853699514bf1b54f2e8b84168b7a647ab7252faf3b90a6c666f553d134160d6fcf9a04391f1ff3d65f714dfab92d86a4bec4888b87abc273b4ed66b600a42cd235ecb7eec8e58709e4444acb7869d6371b2c9e235ba8eafb34bd2509467b07d96b8cbf6d0999dcab9a7ce2f8a2763d1b6a8542ed6c47ad74e57d90acd0e0c706b7f1fea433b8719b6100a40000000ffa4e33bb44102a01dce028735e43a178230c0c08d86311fff3d4d0f24f2084da8aab35e469e3af724e6ef088cbe14117a9e49ca73d49199cea55e44836077b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411127209"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005db3df47e77cd6bc9b27b52be917c62e03a65fcb8552101be8cac0e5547b6c1a000000000e80000000020000200000000691aefe7b1f786e7948519747a857a4aa0bd9aa5d2475f0c5ecc4e4744a3f1120000000922ea4771130f024a41b97b6dd45312879d01f1bf951cf2975d008198432d595400000004564b4537ed2a2a56ef2a56817aa132f19a5836616a7106980425cf4d6f1a30a4f81f16dd5121e7eee663c84ea9a7565ca95764196df355fdc293aec3031a5aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e159af7044da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1448	3032	iexplore.exe	28
PID 3032 wrote to memory of 1448	3032	iexplore.exe	28
PID 3032 wrote to memory of 1448	3032	iexplore.exe	28
PID 3032 wrote to memory of 1448	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\532568ec76c79b6d1cc551cba0ef8f95.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f18e4f91cd8ee3ae52e6fdb37f339362

SHA1
7c2229499704ee7e87d232f2d45b5193150f594c

SHA256
0441185c213f8ca4138f74fcea85d1f4f0d5add02f9b6cae0f07aec55d30e69b

SHA512
c0a9f695b7093075733a3b3b9b16570d6243e129332b0a2008eb4b371353906d5f645cfb3ea593647dd95fbc3ae8004f0d2e4769c1abb2bf79244458c361786e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82072d202bc3e816eef22f6668d4d807

SHA1
a503d03eb8cb9caa41498ab593529caeec4dfb62

SHA256
f7e362d1f379c3d207ac0e927c1573ae0a8d501b73247a4136c39086ae938d68

SHA512
965e5f14b0611a0f493b74b4d38f44790c6912ee299062b58a82839728de298f1f0e2285f43a07dd459cdd01f49dfa9c002a9ce0caa82f06cf7bac0c0ddec803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdaa31d912e7033bdbe0cef773fde840

SHA1
f95349fb03918be4ba97a9efd6be326a81ad067c

SHA256
0635a1fc8d893ab6470f74ab59d12f7e6befb33509c7b86aa6ddad08fda3da14

SHA512
48dec58406693171daf172c1fdbce51f2ebed41720a301e8104e3c4257b0fa5aa3832972c33b4e453d4084275aef5f85998fad8511984734f60ee71c1fc9c233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13fd5238a87b9698260a8295bda87342

SHA1
ea9ad7a03d2291e02ed5df046bc6559535d7d889

SHA256
61594285e1b580e394075776138c4523670f579804a7d6922f2e35511c0a7b5c

SHA512
653d20802d93f138a3aedde23d3c64a97ea87dc2d43ffefa928c13a5e38758b5bf405bdf4daa5541fe810fc0ef777218fa7f8f12ff4674a31577561e6010b8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29aeeae3c4ac07e947d8aa77c98335df

SHA1
a2c6b96ec0d949fc5c6b5b988e4b109705e43805

SHA256
74fd73eef22a6d07a80cc1385dc8d7003d87f72f39ccbd4d3be7e1bdcdb2d71c

SHA512
476671aecc7cfc8656828230c1d022f1e159238238db039e76a3656dc32d958d77f7e4022809779b5d0f2fbae4c5290eeb9d8f764980e78d526b6a682cf5b6d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96d7486b318e2827bcea03c371c217e9

SHA1
ce07cf05107edfcb94b1c78e8a374d53a5cc94a2

SHA256
0366825b01ba11908843f2c1d570a9b005b932f38c4d3801b3a8516e4de85ce2

SHA512
a8b1233acb4f6d6ce7650e6c0aa99dd24e13fc8a98b64e6fa3587ee7f896a247d7ac7a9e69a9392bd9366fef36a654858d30c96814230fbe5c3cc5b8b4e4bc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e377aa0a68742c027b21a510bc20f0

SHA1
b30064f0c0f5185a5b3bbec42a72a33a4f2fa9a9

SHA256
c707d8a1c59398484fa2fae739978fdc793d316a7d10cde4b32a327aedc10f80

SHA512
b25a20ade9d44b7919a22f9c770163282f1b6402c476cd986388f4f38fea2fb58aa62305fd07881fd08286f024fc15bdc1cc14a2ea9a7ff6c4cee0194eb0bb06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6105d6790fd1cd2f0a21691fbd7bde

SHA1
38922bbddc0fef2a6c19c7c6d63f29c3748f2350

SHA256
465ef00aae3f3cd5775e5be458718e5d02a210dcfb650858a44e7758eea9c7fe

SHA512
438295227ca0f51f36f467e460c06933994494c995a8248a34526a5b9421d646e5aa618e6873afbe9a72097e63dab32fdf5dbbca3b5f6ebab50d00bbba32bbe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbbcb53708ebca63b1f1128d88edd09d

SHA1
6ef3ce6a1ca529609373a0162a8b89cefac36b76

SHA256
15378c74efeb17fd8404f1c6b9f37cd6208da26c467c476e2586f281c9e238e5

SHA512
56c06e9b6caa5793baff396c012084f57e9fee22f887608d88c6224a9f917eff205e017c672a63543e3f242847a298e1859527e9e9946a548b1595bbcb4571bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212c92b549fff5a523c7da0158a54b28

SHA1
332aa7f2014088ad0dea2c3856e0f94e9c0aa688

SHA256
4a370280cf5e5b9a2a3a1fdb0309739ffe851b26645eb1fd9623d1f69683cb63

SHA512
06bc07160e841009568d68a6314a8a3a53c4b8c983971b484b128d71de6c21c9d525db7c1f6ec914cf260be749dfab6f47ceb09b045edcae5b2ffec18ab5979b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad8e2d4f3349d058fb62b9348634267b

SHA1
1fffbd6fe740e01150fba7355a92b936e0aae63a

SHA256
96b2d68af15c63ac01d97931cb3f87e736b0109f2b700e5d6b8b179777f870aa

SHA512
6d0595ca58f0e3cdcd86e7f2821b3b54552f4fc9d305a654b5c9660481309529ca91f46e79f56b8e05783d2291498d00110d438141de27532b7b6707c8f7eb86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27EE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28AC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit