d8945cdc44a0d98edbbb6a78442b6e659f82a3e07424189ed2a39b0e39e8891b

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5346ee2271fd1b6be156388af09f183e.html
Size

17KB
MD5

5346ee2271fd1b6be156388af09f183e
SHA1

3053ce9526d82007e7861f4543dc5f1acfe141f1
SHA256

d8945cdc44a0d98edbbb6a78442b6e659f82a3e07424189ed2a39b0e39e8891b
SHA512

273b52f611d6ff58255de4392fa66d4ad591b09b04321fc96ea01827e48335d915408fe3e8862102edb6c68d34d2edf8a0c412f79ec6866f936eda324fa8d4f9
SSDEEP

384:NfRIjUDGO2G9kLL9jhgvH651AkCRhtkPziMKxvyY1dCjepJZWrFV:NfRIjUDGO2G9kLL9jhgvH6zuELKxTdCJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F6324E1-B06C-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0993e6a7944da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411130952"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000feadb8ccbd8b3bc188fbb3a244790e946939cc84e36c20d4379d1acee6c15a26000000000e8000000002000020000000095909b11894eb19d3a18c6812b3d831bc99f1cf6aebecbfd9d540541ae654ed200000008869ed8c30f848dfe0b4fcadabe48b19ffdea0a17ed481a5a23011407fc632a140000000024d013a1cb0fb51a73a0702249f56da5b6efb0663273216d507012525a99ce36bdcb3e7fe895d7f608c794fa532bc4aac5c989664b2c14ee4912d365faaef73	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000238ae14bc7447fd778ebd88e274927139901fdb786508c16c267dae7df243139000000000e80000000020000200000001cf94c24289dc8b2e261826d64ed398d14854ce85b5cbf029903930d775be403900000004799be6bf3211ce34ad07ab4d650bf0dd5a622d07f56ea73aa3134d1be2376b01d8308a4c77db01185fea9f44f07f2ed0c456c19007176aba6be08e4e8177232045e8d1e3ffd83d4510841533c94eb2df53de108887cce87933e13289607b5b9f7822c232315ac048767471938e92f2a8340783b5a1af0c292e705083f7ab2113ed6252fb271aac6d170a56dac89348e400000001585571b7b3926b286ce4b854de8d1c3265af1d9df499b7cb47fbae25e6e491edb0793ea30489b2e08e01e96d461642242502f57e696eac2a7521ef8d9f47eeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2776	1848	iexplore.exe	28
PID 1848 wrote to memory of 2776	1848	iexplore.exe	28
PID 1848 wrote to memory of 2776	1848	iexplore.exe	28
PID 1848 wrote to memory of 2776	1848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5346ee2271fd1b6be156388af09f183e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b285531365ba029eb2d0d3591a3ca7

SHA1
f3f30fdd35e5ea4ccea9e69c79809d5e8eade7af

SHA256
bca6de160f87a1a5eb276bc395e7838929aa2836dd3443e5680a5c0c514002a0

SHA512
b34c4e990be4c6b349245662007c7b803c6752804041e371d7d731fe055c42e71b4a7aed4ea4c0c0fd003b663d448e75efee43c75230486b4ccd167492a9aa65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5377e1c4e5d1184bbeeeb7e6f7c2c4f7

SHA1
9cce03dd4ff70b076a5d45645b90221846d323f4

SHA256
12b2fe075ae87e9f0b713dd6ce5a893f502d6090731ab7a0cf0b3d3feb01c28c

SHA512
ce8bf84d1a1993bb9c5676fcd5b6fa3727d9ec6809403748582f243649347fc76e2824ab0f1303ee112e28f64c10912b5c47177224b0fc38320187545498b5c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b891f5974a3927aaf266481ae4df05a0

SHA1
eb9a84cac88ea8ee54cb6d202234b6f5a46724e3

SHA256
fc6923c2aec50a962f0f2239a15ee79e35b5468cca05823f45935ccfa21baeca

SHA512
79ab5cc0872f1b64e867522446ec9733039ede27daac707a585896d1cbd07bcb0c7f5b66ef305f4376590da167672c692159bd26be0f2c41c8ba4597dfe24a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e7d0aaf68077625ab2e39d5ad1e17ec

SHA1
34227096455e18f0237ca00c84977d9befeed4fb

SHA256
a496cb053ec031a8a5c2f9a3642a19ece781f1b4200ab865067be5b7dfcc169b

SHA512
9f2e2df7ba3858575c853de02ddd956f1b3e15b402deeb06a3f4a30aa59c0c09319a860f8d158161eb1aa0f7a1503a64c42288b4946e2f729de05bac687866a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
663ddd0564063ceee1a338d449c9bf29

SHA1
cc472f76bf05beae124f2f0f25b1bf629f0b700e

SHA256
708b557f4909e6e97b20fce45e5f0e7ee2d0075099b59e4c4cd66666c40eda79

SHA512
f536a5412cff38c82bc4e25c3fdbc10159745fb1baa51ff747eea1c60c824cf299e79342788083d01261422d5f3f3b79667746bd3f982f9a6eb716615fd5bc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9716ffef55c88b82ab4a86f78bd70bc5

SHA1
6bd1512946a306a33d62b134db3d80f807240be4

SHA256
b4b5ccfe65ff85a220f061deb59062a4a16f41fabc175d39dc88d0532131231d

SHA512
95bac96e7ceaa62ec3a8ee58d9854ab556b42940c3f53693b14d6447d468eea7c8c998b78fb94989faac5f7f659acf9f68fb3935bda8d805e428de496e834109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de00617a6a2725ed2d04b5b50fd10486

SHA1
b7e7ba4d8e33feeb3d069deb54dd3c9d9b7a191f

SHA256
1bbe4616fc0136206dd741521f2e5ec97b4ed58ae7fb04c8cbe6bf521c8588ea

SHA512
192467a11173c762f602ab82286422732bb399a83092b4871c8cba4b4111fa1a39f4cad78146a84da576e15642481cd34c1d5fa1fb4c45b1cc8b49312cd7877d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbfd4367fe20c49f023408c01283329e

SHA1
fd16cf7e8bb1a4950a1a0eabb5f12c5197c3fd8e

SHA256
c0310bdbdcfa91d72a3c71f3a3adf2559c0a3da9a9085c9e57e480fa5b669c99

SHA512
4686275e1956e5c1dd15ef6d711a5af4d16531d7ab79954df7bcfdb6d019c41c9675c9fdd32fb65b916e46b2596c186ce87c21cde355ec00ba20f553a6aea8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3c8acd9053f230239893e2f4373825

SHA1
5c8537530d55de187ffcd63c82f082665d991b2b

SHA256
57dcafa2bd54a7ab8b64bc9bc8db82fb8a69fcef34e3d9b20ade35ddaeda3ce3

SHA512
46f8c41c9eacbbcd1cec13956a3a7ce6bcfbfaf84dc80b58ee004d3d2e2bc6f258bc6f3381cf1f5fadb7f13cefc114b826a995251eda52673a6973828333df78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd0a97e88360244f7422bd2bfe12aad

SHA1
47ff626b532b53c4879ce9e130405ab0e41f38f5

SHA256
4cc772294fd559d1a339c7bc676e8666e5c8251f35fe3484ee0c016cb2055153

SHA512
219171efe79d99c8ecf32f241b4eca73c5051c1145f3aac7f7f4488f5214a35173701c6b851c1c2e0808b9347b1e8807e6ccacd6162605c606f7abf2445b26af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F61.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F64.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit