ca5ef946b651c38b161323ca70c048bf6d035ee390e74163e2f60a2f7c5b6b08

Analysis

max time kernel
120s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5486cef128a311d68cfe6a841079e28e.html
Size

48KB
MD5

5486cef128a311d68cfe6a841079e28e
SHA1

a1935c0c0ab2043d7e4071882339db9015199b8f
SHA256

ca5ef946b651c38b161323ca70c048bf6d035ee390e74163e2f60a2f7c5b6b08
SHA512

b3fd9a0092b1a7f3e3c878b4297efd4ff07e2615562c20d2c1c61f386de74f71b625f3751b0cee162564ff3c958c94fd2d3b73bb931d652b0fb4a09d46c96216
SSDEEP

1536:SwFy3WMwBdVl/BpCaWZbUXkh5Z/ZEuPetJz5M47b7H82fNpjjy34uIQwuh:SwFy3WMwBdVZBPWZbUXkh5Z/ZEuPetJo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f555abce44da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006ff05339d72d39bccfbe158c28ca2f97c0b53479687fead7ee7641aaf77b66ee000000000e80000000020000200000000bef3edb5849feed0ad0f4c6a2ba51bca100fa4345d602c511a21d9ca4232de390000000c559b478f30b1c912d973158b5274f73037cedb66221ca44accb1bb4a94d9aa22aa909a53c70aa03f1532daf941bd6707becc0223e2645e6bb957c9d6d51cc7773213085e424dfd7df1c499ae0188c7252e9cd3ac7078c7fe76f3b899e28b87d0a9afb17ed4784e35f6356d7cecc0109f65ce7f293e7a5862b1bcef356f542494b804f9539332bb68f17095c6c5bdb4940000000e5f0337fdd47397c61db105ddf7b86713b94b52bcc71cf3c3ce005ec4f6ac343ac6e4faac31399449b0c91ee54bd5f73a9fc09b331641823b6c8a83aa5df01af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4ADC231-B0C1-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411167581"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000015aa03cdb903811cee519624a595cdd4601c0d6e632cbdeeb576cefbde9e8978000000000e800000000200002000000055695b60f5650f8c618997712395a17b37abb7baf0c53b87dc5c73f88de384f72000000070fcadb5c6dbcd96cf3ee8147b1ebed712e7722833063e06818864a199c26d674000000022a105fd9c194ba9080e7c8e463e8870dbaec460f597005a9ebb495ab203c956d355df09de8932bc1df69d636c9da564163d338480bfb71bb6a07b152bf5c08c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2568	2688	iexplore.exe	28
PID 2688 wrote to memory of 2568	2688	iexplore.exe	28
PID 2688 wrote to memory of 2568	2688	iexplore.exe	28
PID 2688 wrote to memory of 2568	2688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5486cef128a311d68cfe6a841079e28e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11bf9738246f1f0a4b16ddc2844b1bb6

SHA1
ba2e366b0db3a76a1b0df83b7632b21382eefc82

SHA256
c8d8bf71b2efbefdb0fd487b75f8312be53c606028e1f6ae8b163bad892d800a

SHA512
6c780129cd11452aa15d8b4335209d2a091260975414b051c45377be6d4470a65338778753e17f3b432cdc1b089834c61602f2398c336df3d6a40d68549f6f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80dd6696e41c54ace9546c7b62548de5

SHA1
b5236a06d601ffee2be7323fc6ec44e1adda63ae

SHA256
f9cc56f2c8b7b867e180acf16e3ed46dcc2868a023a70e4c0edf80f9213b68fb

SHA512
3df53a2cefed3a7eed6c70ef639d1bfd8861105b1e86a2c2db7596925b155760f4dcccf79a8e1595f74f45ee9cf4338656aaf9dcbf2fa3166bb6e456a970fa3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668453f7bc66b386cc049cbb26e81366

SHA1
058fe6d489cd19b0446ae050586ae24327a77e4a

SHA256
9f6e7e12df285357f10addabdbbfccba943e0300695685604762557a4fb8c9ac

SHA512
2ae7bd2a24eed263ca9adfa26c57d805d2cc61d1471664c02078d8a534f476b7cf164adb0639f33672a889196a1e33bcff03d68f0ba7ef2c5fd0d756d605a7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21447457417edd0e3f8625ac9f6b3aa7

SHA1
15fa1b4020ba7492a69a2d3db9163b66c1c76b3e

SHA256
6248100e237135b68c5624314e377d4340fa3f95506becbd29c61a76dc4762f1

SHA512
39624e06849e858c79b036e57575e5ba3d51651c2a9d799a73ca5214b84b7089c5ad2bbc7ea84c3308dbba36bf8a58d3d062c704d760153cbf8a62e25444fee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
378f0820590724db479761093995b3d3

SHA1
f224854e9d7109567d17fd15b00bd13005b33c12

SHA256
c51d54fc21534431c29517524e9f25cbe11c7829f30498e03f7d4c5e2091edb5

SHA512
b43df64f61e789ba78fb4999f9fb2f6f1379d3381ff0ede8dcd19c9199cd1546e1b5f7799108cc9708663d5c6590aafad8acfb7a7a5b7775193256c230312450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6da2c900d1c5291c12a7979bfef6fa

SHA1
188af43e821ab54c2fe4e6c153cee4ea92cc709f

SHA256
3e9499d0bcf8685528a5c0302c16d45844cd88cb6b7f42069401ed39b300840b

SHA512
a4b4252418793afd54bdc88429fa5063d269fe246e2e1f43beabf7ca15dd875d0d7fea3f110c9502c59f559e7f2b7708de8f993a445c3116ce4aabb6dfe5e755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b573b32bcd0f5d192f4e539b0d238cac

SHA1
b5c9104fc75121a065e9553043c8c76450697e84

SHA256
d5f840aa58fa91a432d3dd0ea6e4c3edce81679e1461a9a8245a28b090b059e2

SHA512
a6c9e2acc7b6b9f73069fb10b916ad646ab3459cafcd0a820e736d224bee3b21be935356053e63e3198fa8319ae1165632fd081d36a6cc77a51fe6e7dc158e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE17B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE324.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit