fbdbc67ef32f548574bace771113122931e0a41413551840cbc1c9527483308f

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5359148ac7751bc3bde60f7705d5c909.html
Size

3KB
MD5

5359148ac7751bc3bde60f7705d5c909
SHA1

34abbaa80bf00d1e8dacf690e1ffca5d56789ce2
SHA256

fbdbc67ef32f548574bace771113122931e0a41413551840cbc1c9527483308f
SHA512

9dd1a4d2edb0c1d225adc959c57df24ccfc2f10ffd5f9b7b5c57425cb03e004c53ad7882ff030be7346df0f6a9a9c48ea50a6ea5982beaedf667d84a90a4b1f9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42BDC4B1-B071-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d59fdbd05d742eb59a7b3abe49bdfc7400b5fb9e0cda5ff9966160b26d03be5b000000000e8000000002000020000000bb185732e8374276540cf222ee0a6ef35080414947950209c7e31c8e4a8f231c90000000d32dd8ceb63ab5012dfd50e95131a930f595c965566a4bae21084af491cfb5b8aa5d77ce988d494e5d5fee2a35f4afdce50af637a2a8ad47e3b4992f4f6c551b8c5e1e519b608553e0fe36655ecbcbc46341baf5260745f81e0cbcb2e317c20a6734e79706296dc20969d75722fec55d4bfbc984f19742be6529f7d364b938706874339e7eafb2def950a6ba13853662400000003048b8dd2dc0c57210f98dc942aba181ca81290244052a22b1e197d65e0eaeff218836b7f1d5385f3a799404374441604e476ac83d02019ffef4ac5fd29de350	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000afaf605f17f01e6155415e8165b7b8e8190009e3b48c05e11683244ab03f71db000000000e8000000002000020000000ac1979f478b31218dc4356f4e469df5921170497e2e54d9eee7d9d7cb2f0d874200000009ca17c25e34a14f4ccd4c7e8ab8039f2a52a7fa7f30e26a1b16e941c1a344b2f40000000b8d4ac92eb129bbe8c29d136b5148137dfcbc0b5b845ad214cf258a2994deb6837b2265bdeeb2a79a21f08bab2afa5266de0421318402825dcd7652fed7bcf8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411132968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603b7a197e44da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1800	1684	iexplore.exe	16
PID 1684 wrote to memory of 1800	1684	iexplore.exe	16
PID 1684 wrote to memory of 1800	1684	iexplore.exe	16
PID 1684 wrote to memory of 1800	1684	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5359148ac7751bc3bde60f7705d5c909.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604bc9197c577c1460aba50b83af2a2e

SHA1
abb8ae1fb749c73d6501d0f9a1351e977c84e613

SHA256
b9a40f3925f5d84655551575fcbb1278bfad8158965e73cee3c4f62f47a20c9f

SHA512
4f5cebb00c4785b1109f292ce957eea0b6a9e0fc9dc650a0e38b2937d83c39d9725af93fe0492e3028a7343ebe17facde781fb7108f4518ea38d09bd787d79a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4d2a40db45c5c188fa2efa60b99914

SHA1
13eff0e7b71222bf37b25fc2c2cb9ff4b6c34ccc

SHA256
d07d09e31bc6dfe251fefe7d9641f267f0ce45e4bf520cd50888e17088fac936

SHA512
59693bd840fbddbc222006b804f49dec02d2905e5974587c0b43732fdab71b6af3e45afd0808410f3b681dec3d6cfb71476b56652b7ca5fac54fd01886c504be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576435b8867bddf91f10c485531877eb

SHA1
59f72a385cbffc0bc5b3feb6650fe4f8440bd404

SHA256
5407bc6627de6af308bec75941ffffcd2d9a5cc3f7eb6794f016b174e7320cb5

SHA512
c203bba71c812044f143abf01808b410f3770d3ed154811c8fddc95688be159155f98bc6d533e01fc57fb5a59bcdf4df337f80d2ee7fb3efd6ed0a6f6020ac41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5322ab781446b57f49343e81106dee0b

SHA1
0e2f3d42aae40828d3f19980f9f778f6f5835602

SHA256
9bd708c4500d6695f25cc72109045483350701d07c6e3e6a8d860732652d36f2

SHA512
6495a9c7a0c406f2b405c8a6499002326c230cc7ecda237e6ee38d09be46ee765d50d4040b1b20b6fb5a31efb6fa260d71180c73faf2c177812dbfc899cf2560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1ba17a8ed881af7582919b29bd6de58

SHA1
442064330c2a2b6955e21f7de62514c4f613f696

SHA256
01925447687a1dbea3159ddffd62f160c2aedd01b354daf1fef4563829f07542

SHA512
2ad04e8bdf716c8415c03baf2e239576af2ed1e07cbfce3423c37a30d19db93f2ca2ab6c99c67ad223910d7cac8c0573bb384b9508f5940f4dd67a1335f3828a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb3a53818faf5c183665ea640e7adc44

SHA1
de04a2284352ae1a6e85d7d8d93a47f1e2309665

SHA256
5745177ea09d176a0ae56159271953a937ed3653f1807f20d994693dedbc2049

SHA512
391265a1154a4a4796f00ecdf1dc84c18131bb64b1e23b18165c2ead41b56b0f1cab51a177e3cfde220fa0245a9aa7ac7fc68e02c573d7dffe471c2ecdbd872d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35bcc145ba01857073912b70ae184658

SHA1
e4d26b485cae9e9ca581e40010e4d64f81f1049d

SHA256
eafc189ad73c1f2fd2185c7b8a2c71b79b2876e568f71aed9619c6d28552b9c9

SHA512
ce4ecb7b80aaf9b710261b90cd220a9b2d0f64a1a86a55f7d1c99958a0628253c2244878ff5c55a0571b3fe86a1b29f451d539546edb41cbbfd0d1c5db15c026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee8b69b29830752a206fb190dd033d45

SHA1
7d4a77f05104064131ce4f59903a850700e75cd9

SHA256
30a435862dfb7861c6fcb39f41a20c3891db7853e772836a3e2c91b01c255b30

SHA512
1dcaf933dc2f3c25b0ef0c8805c42e97a0fdf1c01d6e34c55d1c22a32242b9bf2e1b44420bff5b542ba57f08fa019c07d2f2009145ccf31c08cb8d4098a6ff9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89e16dad4a6f75c0f552ced80e619390

SHA1
6a6cdeaa3191f04c130997fe637b03ec101b971f

SHA256
b76643e0661cd35dea0c3b35df918fa2be2aa8f2ae9e361099ef10fdd6c6faa1

SHA512
43f810953e56d13457d48305c7388a0b5a5191d4f3fdb3f1de55d32b85a3f8776f2dda56cc6bb447a65f7274a978c74ac57a654b286c7c12e7074f66522410aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a219ed02fb254dec07b68c4374ae5f93

SHA1
6b64fc72b9e841dd316cbc54ceb1338bf2e12753

SHA256
705e89965951f2e5485af63979bb7e6e8ed1bd96bf464c009a770925b1ba5817

SHA512
b7cb53b9fd3dedba2f2000d58978fd114b3bb43a46517fee33a79061f6ab363d11dad43238c8c086176b2a1aef53825bfbf986fbcfd6dfa2bb5134abb1b22317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cbcd99cd4e5bb40fda7086db2951fcc

SHA1
4f0d4bc4afee3f88c5920528fb83b8877848971a

SHA256
6af2cf38a3ad32207abd61987cf3d8bbf70afc64ef85f4289d34cc773b83a093

SHA512
a1cc0a7d1e3023ee3038250916629aea0e332717809e9bac72a19ddf0c93ce9c49c37b2ebb891355d911083227fc22efa31c0c5906a0f2b39cae1311cb020c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b311631e2177fb5066de82f651215f23

SHA1
a63335d47862829ab7b563655898095dd347b3bf

SHA256
b0c1342f956a67f8f0b2dab8a95ee2189668edb18149683824ee02ec4fb6f613

SHA512
2fb44fe76a53f452d5eff94b95836379430531c2e9c58491b97950e89589ec1def0b927dd2e72a3a474811fac3643d0ae5cd4005517ccad5e11d8913addfc517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596339175ce08a5a423508c3ac855627

SHA1
5b7f230823fb50d1f2e3597235cef29c824d3ff1

SHA256
1a82ce38f48ac9aa38598e513ca5ace99578ba6c73fa8236632b56a3a37e50ff

SHA512
202c0d3a781b627ea48a3ceb485784dfcc6a4345fef98eaeb33f3d775cf79eb29ba272a3cf53515a0a6cb7e6189f3b8bc31afa3ea82a667ce31ab81d407c06ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f9e3cd1a112d4c2d4b9eb28a5ea59b

SHA1
ecb94618ef36d89282784cd4a751d2c499034eb7

SHA256
e54655e0da163cc2ff75ac48d9508c54925e4437deee4bcaf18fad9e6dea8141

SHA512
7fe41d2473e5a65c4dd4550d474e73bb89e5de929c3c26d8945e11536fe0aebf1ae4b993f5cc1ce6fd76e0b2d3d7f80cd4b152335f5b14482baf6627d9a744e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab233C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23DB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit