9b109511517d379bc62c9057895a9b1d9683d6f3fd3740f0c8fc3c822fb23d9d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 10:43

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

INV-901926[2979].html
Size

253KB
MD5

97d3b1279d5d37ce0db28d616835aa38
SHA1

6ac39c2409eb7c02c35e9b7a083c02cc9c54b583
SHA256

080725a98b33eb4e11960cac118f810ae6729f3a74553a478e555ae89beb1f80
SHA512

d73a33a714c85eaf647ba1c4be4bb57e4643b0e91fd72c92d4c791e7742db9ca4bd497f0d5d181bb9d2991ed4ab854b776d8b453d05ae4d017f808f47e340723
SSDEEP

6144:nrDYKFE6P/KlSwe1BBuCpFDv/mht1g+OQ9MKtL4TGDL:QKFE6P/KlSwe1BBuCpFrWng+ONK9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005808f51c627440f85798ebc22d39ad5066a1969616f8b32f8ace279048beea5a000000000e80000000020000200000006968e5653bd0beccda41d6d24d383f064a52166bdd8e519c608fe196ad8b8d18200000001bb99511581d638f60e4fbf612a5484dcc1ba4a345e2c775009f4ae3f12fce7540000000ba074379c69b32108b22a23eda1f639e7f5c549eb2b2630e20a06561bde5d907e6e4f4fab633b578a73d9d09997992f29764e2645df48ba502b328b8eaed6d1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B3F9D61-B06E-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a8ef0c7b44da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ddb24ae0bbd5c64471f5c98b18d2769e56980037b745478be6684726e4f64b36000000000e8000000002000020000000585745e8c13d3c91576d84ea38253e7e51cd88078faf9ae00e3c3a1d4205b7b2900000008e217d0c209c83aae1a1420484920fdd5fdaed7959d2da4a9296d87b153d22d34c1addad8d77f4f72957e540f7ce55014a208ca82950714b70ced1da0c2aa47f794fc8f4c7ed4af146ca26bdf3e66ccd5b4d8fd6b8079bc5f10a51794a55b7b985d9312d06ec32e2821652ff028e769540af996ce3113246dd2a940e56600bae0ac796bd3f1f7a0d193c8ba7752fb805400000007b3b8c602209cba7cac45724fe8b51f33217f0b6c4ca16b7a822913a53c1e5d0b60ba7038e84230a0ce6c2aa0582d859a9341f6243d4ad87903cde79828508fb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2448	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28
PID 2448 wrote to memory of 2740	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\INV-901926[2979].html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1756

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c5dd6c9d70da80bf9f0e626a1b67bd

SHA1
cdd648416517692b778f057003d2fb87eb858664

SHA256
f1e95b8708f8cd1ae781bbecadf4113609674a5918c1868276894600b825e7ef

SHA512
b0da2c1467c441e1f81561cbc17f566027095ed98c4f1611fc1e0e92f14240fdb94c932f220abb493543818ffe1d30dbb5d8d1624a290887ae7243b308c33ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
208dacbc39b6108d52a0bf3a275a69a1

SHA1
e651ac7ca4bf7f772809e127e151e20b9932fc44

SHA256
b58dba3ae9c9a0b8f45ea787ec07e25a77d0f7fe8dd43528410069f7c71efd56

SHA512
6db5c89ea3b3cb959d66745a9fa05efb4b4c54703806672f139cae76845026832b78955586f2574029f943e171f063946e28ecc3f06cb94da59ce93fe0318aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
febf7ec20a2649b89f86466f60976fab

SHA1
710498d0bdfd9663c5170a7b8b017ca375bd8075

SHA256
29a9b17ffbe216e30845cfed1e02021375bad3d0393d4d3b90446fc1e2b16888

SHA512
8db84cb80399cebfb858b795149eb6edf0ab46c3cd0c7731b23349e066323014281d49b17e7fd866cf7821814c2094864e51228db5173de89be9456c8eb37abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81fb460d82dafe66ea062962a6128e8e

SHA1
2352c92bbbb7a4ff49694244e70fe3e61295b7ab

SHA256
9b8821bd4ed044318209170706a76dfe88ca9435434ec4898ed7ae4aeddf77a1

SHA512
1d9ed6925046bdd10c73ba351d9f20bd2d62808c5b20fb2bbcedc83e1c01265d761a3557a94cc36f772885bd3ba3683495e3424655e15a51df4fa56154864f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de491b433725e456c9a714b525b9e20

SHA1
cf0e085a154617e13dbaaedee3750fed3f9e225e

SHA256
cbfe78b0dc0a05477ece01cc1a8a0b74685f15869babd4f68bad3de9ce11416a

SHA512
3b2bd55662da65eecbe19be8e047b3830348c9cb65a56ab46d66049a3c0b88d91967d7d8e11223a7ea8ec17866dfff7b3bd14415acc0139cfcabb6a6fb4158e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
739405879dae62f077b431b2a79484b8

SHA1
cacbcd9e0c371f870c345d9ac2af7f7c371b14aa

SHA256
2ac170ed22efd195d777ddd27f27cc807cf82749fbb371932c1b19fb6e47af65

SHA512
82afdd1f07b6be2e0447e74159cc8d4328814e0462805f987ee21d56cc6a040f82679949b2f49632f044231f574a9a136fa89e55a5a9b16837cabe400aaa00f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dfea65e4df6e7ffac2fa257a097d89b

SHA1
5d2acdec78cac4d8a5b455e009d38ee17266c765

SHA256
9418ed8b0aafbd0e86aeff738a5b1a215616f642348f4c09cd943c03398a8d49

SHA512
e13e8b3f579f92be2ff18965a0a3a1b9e2fd3a31620edeb45bc7874d1375f16e018af0a53758851ed1fe36266e9455904deae07dbb497147004cb894b6f12406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eaf93f6cf90c51c1127801b551470dc

SHA1
6c37d6e451cc4fb93365418cbe76c797ce65f0bd

SHA256
1ff40cc43e3a3579351a0e787d7a7b5ddaecae6b78d03b5aaf43521358dd981b

SHA512
039c066ea88562b94cef745827b1331ac68d9a2b79d65bda43fdb9a58ea464310d2b109a40d0f714b8e11478947e63b4b753d22f037ef434b1e910028b0ab0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a8b22476832376f2bcb6650bc99ec4

SHA1
2e62a755fd94dbbcb7e3801937c59e54ebe6dbea

SHA256
04ffd4f085bc81613541dc39f88734e3b49335f43069ee591b386693420d0752

SHA512
fe71ff31af8116871353236f2a05e3a486a3a9c7958dda33567768a4a4723b78953355a7209a199ac5560e85f8b49399f6ec9f15ca06517e1f5200fd0c740cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aebfb7cb58bac6c80a6fbbc1fb84513

SHA1
cf4c53bca8c71fc808bc66b8a0475c6b18eecf75

SHA256
f8a51c8dc81ef4081f9439307c31aa7fc1ae0598903c615573e7d5f3d8408fd5

SHA512
35c890860600f42a12212a3d057048a21bba96f8d18df7eabb1df83229cba2e57f650fd06973e105989511f7bbbef13476036a9c5580332cd50fb9b798284c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56aa51428ac986c83500e0f7705eebee

SHA1
7493a16778e8a3dcf8894833cda7277eced5f8ef

SHA256
f0a507ae18a1504fb1c78ac03c181a5e93552b0b8f6c4a922870d7741b419a53

SHA512
cf60925c8d158b1039ca904fa7c402a97d9e36aecd5a863c509f78e8f122582d3a7e6a2ce277a963f25656820ed0f4b40585726c999ac093ef293ad1af4c6fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3008b13237da77bd565800343d875268

SHA1
38c3527a5356f58272ca8f2cf3a23039e017a791

SHA256
85afb428adff632972d06d0701a69d8820ef77db9e145340b5a675be7e1b1990

SHA512
3fd39880aba4dd1d1c5afe2ca5bc4259487d095518978b5602e23882875033edce45f02b5378a0049b8fbbe20f6bb340c5d4e7c83855fc586cb2314aebd7173b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66cc8296566fd8f3c51df9ebb6eb9ea4

SHA1
4982935b243d9575dbdcfde225987832d4ee7012

SHA256
51364e2ae05701b8979c20fe53ff315041dd013faa6daabf1d138b95a60f7eaa

SHA512
45e4e52d52a4e665fa916cf479619455e5570dc2fd9af265abd406265cf1006809cb4d4941e51460a0fdbb640d457452287d17cee1054d487fbd6affb738adf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc03e245d79509091c5c9f86040eadd

SHA1
4d51ee48034d7be5438ca0615d395ebf5908f031

SHA256
ef67f18e6277ada84c336ee01c7a46a32d00c7595a34d4ac4a75cee834f3fd24

SHA512
cfe95c16f970b2d0e0673285b8e905ba43a4c0aa751ce3f9f7d737da7090b879ee62de72eb5a4e66809032385545c820eb1b043d0d3347b555a8877e7944b150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0730b57766e7f30ab52cc59a0cec9a10

SHA1
6d63069f3bdefbf5ec5abf5dbc1ec1d1db833a9a

SHA256
8a001b16e9506b8e4658a32648ff9f05a8ff643892a31c11e641b3da99d1e81d

SHA512
66e2ca2d03aa4400fda4ef5bb708a57a99c9bc9cb116e8b6b62c364dd160d4f38c6c647bf3ed2a3c257c2b648effe3f69000f1eb943e0b60b8509f4d6f3a3da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5314.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5316.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1756-987-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/2588-988-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download