e9b032612c669c1baea9003e8e9862a8d0bcc565e682a4bfe5c827f0006fa0d8

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

566bc3a7ca14100c9f6af09b6293e67a.html
Size

14KB
MD5

566bc3a7ca14100c9f6af09b6293e67a
SHA1

af1a52ef55b628e710faea360138dbb485ee91b3
SHA256

e9b032612c669c1baea9003e8e9862a8d0bcc565e682a4bfe5c827f0006fa0d8
SHA512

e84b1c2e3bb338caab41477b99180939b5548cfd2ca16eb5f052c0ee516c68bac599baa86905d10f6358c559cff8bd0f68690f0c81f8060729c5d92c478fbcb4
SSDEEP

192:ZWwFw7KtPstwnQwMtPJt3JlnQKPEP2tOnQ+obPgtNnQ+yZlbDq6OOZNk+0oJZ+vJ:Bw/Vu6OOZNk+jJZ+v5kDLyjN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411223169"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46B31A21-B143-11EE-A031-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000044bd2d1b6018889224e20de90a842d7c9cd0f6458bc568e836f16f50dd911a53000000000e8000000002000020000000211bd052bc174837c647c35dc69e77831c45ceb41bbb9660ed32579098ee4a5590000000021390e1914b558102d2a3e4f9e354ef392cbcf7c6e7a1dbcc7356f3471df631d8110fa02b9f46b1a60075022c9fb686e9541102d286d72de09c2c0bf7345725fcb174333381a2f047b381c3262c2807cb6c866d98556c69f6021b49de43186de3b8a1da4a9e5e20a2e139ada5981445c4faa2191499d1abe5494aaf73f6ac4618a368083ebc03e7d8ac31ddee81747640000000fe3828e72e6b5127dc9471eb5b5e58cb70b21af195f4b87c91d3ea495f1955c2c219315b965bc6f33fdfe14d6e32fc84e92e2add463ea1d008b30b68d7a66279	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e2350bab32da5f8dbf1305bd3cb470e9fbd46ad8fe13af6ed9b0bcaba9a99321000000000e800000000200002000000055dea1fa0c2e7c3cde7f71598fe4cf86d913157f4fc081e49ecef666c346caf020000000383badb205555e035ac2917bcb99c2d39ec1b4dfce529bb1eaa1b92cd652a6c3400000005d1c7a176f304d79162e36ff5cd24882f0b6b869a0b941753e33803ba721aabc8543a945ee2e7987288c15ec35eb6f88935ccfc56a39cb21b1af4504c7ca3669	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301abe2b5045da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1884	2996	iexplore.exe	28
PID 2996 wrote to memory of 1884	2996	iexplore.exe	28
PID 2996 wrote to memory of 1884	2996	iexplore.exe	28
PID 2996 wrote to memory of 1884	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\566bc3a7ca14100c9f6af09b6293e67a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a06d0d6c7ecf07bb3562bcc349b84c8f

SHA1
48a4e7797a55cd35debae96f146db7d7584baffc

SHA256
672e086634f2490cddbebdfd4735063ae4bf7538266dfaa6b60de7c92653beb7

SHA512
ecce95589b51650a44cd8a9c0ea9f44e66c63913a2ea9f6426dbc90b0b1d0d775390f54778cd42f63b4a237451479c2737e9839f95664474909535b79a4119d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb61d9c409b0a051959ede37d0cec3f9

SHA1
5cd20f05840c092a461c347fefd871a7760d8194

SHA256
c8427d55ced439de4fefad8e9d12c9a5b1c5fdc67b97e257be93b76690cd1307

SHA512
a5f2238824413675692f6c08839fa0ac721aeaff4b92b8e7644ef0fe3f51e05da4b706f8530a5d747755e8e3457b40b41d3f0198379d1fac87832a74ab61037b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fe5d4977deda4814ec412d7f9f51818

SHA1
85938167d60b3435e97b49e2e60805a4d884b9f2

SHA256
e1ed2e2d52663235474a549c286c173c4dfbf46f41ca5f1f8f02921318939c61

SHA512
59c4841dd29e47797d9ace989259d3b1561feba6f06bb6f8def7b3e3d6c9258a36ed9bda8709fe68c8ddd9c8835fbd3e731fde2ca7b53211f50e16d31705b9de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a028b55f5a0ca517f47aae1422925c2

SHA1
dd017cc28dfb829c74870f04e1a8b712c949b63f

SHA256
c775d616c88273879d9c58c5c5809bee981c2240305641529ae22182a5c73b3e

SHA512
2336200e3faf48885401fadd2a0a35ca23b6a4d541ebaa91847c88b75bf9dc81a735c632145575ba4f58b130438d666af555b0b01ce7370db1e21e4693a3362b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aec9d312d9ed9a67495c766fbedc3f6

SHA1
dd279527ed7c9098f9a594f98774162ade552853

SHA256
9b95a9682d3df387f0720b09623af5433b4c7e5b71ab209dda586bbb033b0622

SHA512
a567e1b2944ea4c952771dd4a56e9a960694913ec057f5f49ee41fe34a59f571b2585a883cc4565a8655d0f4c0202a3e5913d34f63c3042ac7fd8f5b545c51ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f41d1c85b5bb807c6a9e4f1a62ca2c

SHA1
0e9c0b3a9eebdd1348058428f75dcd5f220edbac

SHA256
f552977be45e9edd4d5e88b9b129ea4fcbf8a4207f966faff65aa4d3ec285a6a

SHA512
4d3f5efbc41e748195700dabcb0ffc196009cf9477bdb97ab4f7df44263504123f605236d89ecc0856ea356f1fcf10702d81c3a89c626971506dcd1847f52482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
304750a7b4f36cdbd63d72c0b42e13b3

SHA1
6b43eeac9f82dd67d3c9e787c1cb92c6fb1c1557

SHA256
db3cef5f24a2affae9a29c8377b105cc1df69a94a8aaf81c108c018f8d995987

SHA512
acbbb881abfe59a9e023970d5c62642e76558469abd6e756de0db64935a01b515026535be1efd53261b06dbed8c95b3ebea404565ccd971c285214fb3ef45904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
939e1e142edb3d8975129b699314e9f6

SHA1
a0e494fabdd7f8c59c6a077f5867b8f559dddb9c

SHA256
caa7e6c1022befb14973b4a03b07ba20b4b83b97c2af3d6aed68e9042c7b1bc7

SHA512
8d35a2f35913ef224223c1cbbb09e35543c04229a71fecd517bd726dfec0ea3e132e3fdce52a387df8acaa1436643a02ee89c7d78ded3548b67c959ad00f8024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f8e42c64bcdbb89741b5d5aa68c812

SHA1
d14ceabeb7fefde176bc2a1fd398ccb58b091c17

SHA256
c011274de557d2fa156d5128112dca0b5e5a44585894a84e86a24a3c811b9a03

SHA512
9f179544de7f0ce761ea9d3021a5aecc4ee85b76125e0206f6baa01e46d978166eb84d5e09d44bd407825b88170e680035a804dfdeb46b317acb15097eb6b803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2786c887a9ff2c92fb72b2cb343efed

SHA1
782567c1b7f3681dc165be09e7b0b06f294fae35

SHA256
d07cb1e69eccd3de95737f7f0fb885507367a62e3701b56b1381eecf15896759

SHA512
19d62d18881e5966f979bafb4a34130194a5a4425c579dfb0fa7360c38d907ae56f7254c94b705e1107a02c1059090af037d6203e9f434b308590da66e581cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f61ce4c3dfb08254441183c76cf5041

SHA1
38855a58bd7d53136e0eac1f051df3a2dfe49d16

SHA256
0b4939bb4e4c3cda0b58be584bb51ff9ba35b3e3cdb4231446192e51692bae01

SHA512
158b0a05a2cf92903d43a064524dc6258ff1f440ad675b199a8066742f47a243f4cc256c90892ddc33a2ae74a2ea2893e47b2e180610964570bf8efdb459f293

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8AB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit