6483de7eb8879d8720e3fc9ddf1801cbb009aa7a00ebf5a4dd420e44e7c5c95f

Analysis

max time kernel
19s
max time network
183s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5482dffbb2c0f92b947990f060b3b98e.html
Size

86KB
MD5

5482dffbb2c0f92b947990f060b3b98e
SHA1

1a7f2ded223c625ff45fc6c30d478e6b7f0dd73a
SHA256

6483de7eb8879d8720e3fc9ddf1801cbb009aa7a00ebf5a4dd420e44e7c5c95f
SHA512

d7a8bdf1c24cd45bb6e92135242ff86613ecf597bb90e8e8ac6979bdf0b5c4373b17040e7c7d424e60a0d84b804f005758ba26820600840662ed3b3c49381149
SSDEEP

768:tvaVy2uy92RpgLIMJDpUQkT3Sj73h+ScQuCKCzCzCNCNC1C1CyWMklbmJfZWR2cc:iy2/7g922mmaaOC0iX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A74626D1-B0C0-11EE-9075-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2012	2712	iexplore.exe	21
PID 2712 wrote to memory of 2012	2712	iexplore.exe	21
PID 2712 wrote to memory of 2012	2712	iexplore.exe	21
PID 2712 wrote to memory of 2012	2712	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5482dffbb2c0f92b947990f060b3b98e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa92ca5739ef3af0aaa2d9c509e0c31

SHA1
7aeadb7c8d671b8d05e49d9f88c7bff3d69e4476

SHA256
84bbae61c925a93665790ccd7ff6b56942c989f70559ecd0a779d4c664a26f12

SHA512
1cb31f57ff676bc77e00add4b59870a3ca710f15fdc41cedcc13ce22b0c0d9ed7bfcd2088dc09520771cfd6240f150702adfa989c59115f6c3d80dcc163952a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71db6c9315232edfecf148f8c23bc3c5

SHA1
e4eaea087d1dcf68f13b627579f53addf9988311

SHA256
66136cad4843ecda4d3c43e5f6e48444c15d4ac840a9d327680f0526dacfaccf

SHA512
979ce86a30feb801147d03c37fc86a3733b425c9d794e86e2ed89fc47cfce2edbc0c6443c1850815a32837a47f66cbbe296497f1dd4db36da4bfaf449b930d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072041ebe71d8f71ee9122b64607bfb0

SHA1
7842fd303bbf9d36da8ebeb05956fe4af28fb479

SHA256
750f84f62ce623c4f213d1065344fb398d07a0db6392b00ef54fc4a0f3130bc1

SHA512
3b21cd98c5a2013133caa587ab165d24de366cfc27c8d5f174a750ddc715e09a1e8ee00e3073b8dc0772d647cd310a9ba979e81559681e5d2c571b76fc267630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e29c33fbc55c5ae030c88d13370b314

SHA1
a8edb0b7e84326e611fea9a3445f4f28c45b4e31

SHA256
f16c1c4c7ef7ed765978335dab2256316c8e1e03ecca4b396e268b112a22c60c

SHA512
76c09584cf504e260038d7e8cf0b55a225e7a115b5cc50dc8892b139d86eb7952cd5e8f3c8730cd4f4bdb011a9e5565495cf0f7e27d6450cf16e4e6acb491904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af378ded6202e15ccb55a0c3fb751b43

SHA1
5690b189910d6dff50a22e6d3be83d12edd9fd19

SHA256
473603d06692416faed8c566bc30f839f26ecc7312cab29571cc23e6fea2f8f8

SHA512
0f77b057108d1136b9e1677286a67386b2eb73f096c56d5dd1693575d9c2e17377926b231a5c562301940da881d407a02395b044138f782e48b5ea2692c6b50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b55ebb8af92845eb0bc5a7fa8b6dd4

SHA1
bb75e9ba1e9a3843da7d3540504776d467d9842e

SHA256
03eb6cdd1658d77d399ff7aa7a9b724032b0d2181f898ad00bc1fdd283cd9a12

SHA512
d13ed208a65ba75d0235c8f3a44c26bf0b232ca1baf63deeefa23e34c496eafdf706fe308c3ed499a015939de64cdb2765ebf2f9fc833ce9c5029b57da097962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b06fc263b23ed65d7dacfe4939924b14

SHA1
005eafe42040b0a6ff0158a958dd0221b3bd9aaf

SHA256
c02f07b1d2e87634b9767313bcb94c6592185b25d1aef454935f55e18c1419f2

SHA512
3360ad4cf7def53c324617e7ca707fd09f9bc7b1157ae8630fc577968a31b41387997984d83fa759a6f105f6c6f3e9f7896ddf2849b5b200fcb305d7a2e46498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8be0cc6840730ca51380da29c58448

SHA1
17bfee45290ca9b0d3e4c89b0a5102ece37048b5

SHA256
dc3846ee8b85d2b6d293dcb0bc2b451e5413541ca10b45ed106663737752f55d

SHA512
1b7d12570446df9853b13d6b620f5ba50b3238cec15bc405be9fff51a55ef369af1b4a315111ecb0aec5acb3fabdf649d940f9202ea61805735e860bbc41c617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2004791ee686337cb8ebe836a89cbda8

SHA1
b2fc5e89e72cf57016b4392b3ef604112ef1b75c

SHA256
6e9db12517959fd4a6a00639560358787c8f833825f931196290fdef7abb646e

SHA512
173d87f1bdfa1763588fbdf6d88eb75579316f7c65516bde65f5632c02591bf33e54ffa15ae04be64a5b501437fef2dd08e7d2d1288a0d2dd1cc582de7a9bd5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ab99bfb50855764863fcc18d09dc19

SHA1
a511410f430671e633fd7c945004d36b353da2cc

SHA256
ac04d1684046abb05e415c20dfca7be8c7d4f31821c76243cc893664add2d22a

SHA512
81cea97d09994f01b5ac3d8e63da7a75f79b75cb20ef6580e5c35be9d7b4b3344beb094de99a806270b1d39e902cb152ae449e168559a941f4602b835e6ee0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14972dad2eeffc3fefedbde51236c7a1

SHA1
94a7e44db2f218fb30a12e293199f5dfe4eba7e4

SHA256
ab1824d6b23783be22ca12efe85e9784cf56f9cc56462cf09257706679c6887b

SHA512
2207c707b05a5f1108076b219ffa6d956a20900de45211a6937da7ebffbbc266f16c9db34f275f1af1cd66d65b3849ac0a8f31c1de4d62230811daea7f3d4a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab5bdec655a1f81a560086bb0fa6791

SHA1
c6c309825e94d7696d2a8e2d6a6ae5c76037e4f5

SHA256
a56f116e6bf6631b0e5abc1a88bd61e985e1f61e1303c4d0d8983625dd613aac

SHA512
114e13b25a1048156ebb2fda017f319f1a85e100296bc8d3fb3904aa03654c93eb4ff8d578afa5264670a5c4a5e11d97eed39f1f945d4afb9f3dbf2e86e48e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1175dbe9b148a2e8507f9494b43fa575

SHA1
82c125cae7688e865b9a4902a8337e8e257b4c17

SHA256
c851a972a6a6383e860f6f0aba2952716db16ca78fe8c7bd23d3fc7764b5f177

SHA512
4ad6321d1f67d1ce758658e654e5b12e987d2c5f273481a89b76cc4d99c7e59b40a5600e8b84befa4688739f524170fe2af724ec7c52d37080e1e0dfa89e7a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b37c29a5964ec8ba21200418e5f8620

SHA1
6eeef3b44dbf13da7e675b6ec683d718aec23305

SHA256
0a658a745368729cd1ebb624eee557c8afaeb98edffc2a7d0d4a692bdfcf56e0

SHA512
594f7c86eebd688a56d946ca3ece83eb4bcc9d73296c7b0c5f46577a3875e0a441afc997c38d2656d3c5c977d6f95f297278c270e6590298e3096dc8117e4b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02012c0b73e880db4cedb1cc687bb087

SHA1
4332e12074bfb14c7005571690711352445a08b0

SHA256
a5b61f67224104674d0e3b93cc99bec5851245c0137b32ff6863af038d33bfd0

SHA512
e92272ffd19449cf9bfa2c38a5aaf70072e0d3a115e1bd4a0f97f65396e666f63a756dc19ee932ce5d8156e86b3d63047eb06b427cb64c39e34dec8fe2c5d262

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFB91.tmp

Filesize
24KB

MD5
0589381ef9f79cdb67247df98f4b6fb0

SHA1
b2a465f736e7b552fe0fe6a989bdd0281b59d473

SHA256
25444dce440fbf65f96fc6994a9f061f54fab5d881b13b0fd010826d94ae20b0

SHA512
6f661069bb36763856c232e44043e5e0ddde7b3fa431f9d029a5705aedc44032e47615e8416625f6ff2dd56bc8db7366560ff1f6c156697089c46dda94b1d194

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC08.tmp

Filesize
68KB

MD5
3ec50e6b61e83d58c52ca4d4d2cb8faf

SHA1
d2707d006c0e7df538d06974e84fd22962e47aec

SHA256
f42a84cc9898c3e19fc0e5ec4650564baefc9f1bef0343b9bf8d59a52c90bd93

SHA512
311552d6dcb3881c6beef596dd573d865d5bb8c5b7030e30b54c140ee86461a9d2008e8605bdbb2b46b61b35c472dfe802ca07b94e84c2a5341186ca85bc1cc3

Download Submit