931f5de97cb5f2d57d0158c65a3ce50b51e7f1cabbfb4b1d004b88be1c6de2f1

Resubmissions

12-01-2024 13:14

240112-qg1c2shdb4 5

12-01-2024 13:02

240112-qaa5ksgdfl 5

12-01-2024 08:15

240112-j5sjsadbf3 5

Analysis

max time kernel
359s
max time network
369s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-2.html
Size

1KB
MD5

fd63e8e2138fb09ce6a09482e40e0279
SHA1

10d121a4531b4136e12acac7266ba745448e9b40
SHA256

f869bba0d869e25cb892024c4591ee3802130ed4f6136a9d8457cc9dd7c06be8
SHA512

838262525c9eaa7b7986fb0b80ebf48a0a013fa02bcf42e6b101c6c0f1cf579ea02587f6e4e034c016a30966db0c6f4e2efda7d4f589144cef36aec971d33e30

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a3065f5845da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A5D54E1-B14B-11EE-80FA-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000df12401432dbd839739109b04c3264431ff17cddde4760c0291d0d257ef9f415000000000e800000000200002000000082f274d7060e89d9b8c2a9c312da96085805a6239c175d0c38ebf9d4db34b1cd200000007ffe838018c79c00132996e6683ca7f451184d928296db5ad32de177b7c9627c400000003998bdf174cdb9e34d25c4124e745aabdc5a48dbd519a47146a81402597f0b63389e81a47a44db3304289d67a482b6ec447904646ceba5415be053487c72d5a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000c8006b2205e36bb7afd7586840804720f1375c470e6f81bfaf1c40d7184ccadf000000000e80000000020000200000000691dc18144d6e71961afa537e3adbabe62bc2592b6adf2cce057b3f67978bca90000000bc322aa33bf7050c7a35665c35a4951c3ccbf1b0073b451d9c3e5f3f91aed5797f0ca878cd72da2e056403aca79a26030ee0b183a5719af4f9a4c945a8158303133201b08459e78a56aced01e31f9b6f5ff983dfe0e50915571e82de1bd301f1a059a9fe41dbfeec7d0070725a0047b261f9d91ae9685e0798a08b46c5ec49ccc850f6e814603e23009ee21625a2f1c740000000d62a4bdb6d481fb293b8ff346a0ebe2eed75ba69ac0662e6ab4866c9f7f11f5bbea57302d4552ff5a43f5cc1fe48c7ad4048bdd3c570815ca6c941df2a64f5d7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411226721"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1780	iexplore.exe
1780	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2380	1780	iexplore.exe	28
PID 1780 wrote to memory of 2380	1780	iexplore.exe	28
PID 1780 wrote to memory of 2380	1780	iexplore.exe	28
PID 1780 wrote to memory of 2380	1780	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb987584ef45ddf20b5a139e2b8d312a

SHA1
e7f54fc3332db0be4bdc92f1e9f2e6b054535b48

SHA256
b979162a17303e7434c6d63c34fef1a85e1dc0d2228b5ef3ae9173b272036e25

SHA512
d589e2624d1c79a3782e0215738ae5bbead95743f5eac5756eba4af11b295d84ba6fd4ecf5e088f85ec1e7d388b07752b7b504eb6a17726b16be71d6e037b7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59376d7906989c5f6e9750737b78e2c3

SHA1
e758fc182064961cac3f08c92d58664a5aab76f4

SHA256
d714cc96d0f66f5c0613289370130171b8e40ceb267af451c9a5070e8c3746bf

SHA512
7c5942725c9499428edf096f83f615c8129a871ebde82a3b40719b05df26d17987936c8abb9598deb3b7b48ae5cb1b87b02d0be2a6aaae6b35708ba3d2a8aa99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d59b2e49cfbb1ecd2bebb712a4c48432

SHA1
5b981d3b8cbee3f5ce5640e51b27a6b88b9178a3

SHA256
4ec4b53417482cfc13a801289383cdc400185cf97320e347fa0a39b25159a71c

SHA512
f948293232018b37910a53cc0cc9b926d89c25fe72cb46a3efee16eced4e0c78d20d731e8d1f0bd8278cefb7fc0b636166521d693b92ae091ddc3954a4757c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35d59d896290ba94f911ec44c1a1fbe

SHA1
2e236f9e730ba2e7bc7d3c6339eaba76b28d89c1

SHA256
62b785a0a26a04f9b3be12fed59ccb1a53fcd836ae510c325f0b7a11ea275a78

SHA512
0b5747885937ddf9534b638a87bf60ad67d2bbf1de9899410cd751d66a940a83f1c7e7519df4de3d73d35486e472eb8b47276c9d8933699ba6da0066efdba4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263ebb2a142f8cc5e66031770b9c815b

SHA1
526c1d8f966aa4a7ed8b302123032728b335e2e6

SHA256
e52a1243a060cc2a0d966fd04be56e7b0bb7cdc48cd7f74527a357615159a8a6

SHA512
f34f49a8e2c6358b1ceb2f1647015433a5ef26b4dcfeeb1e0748b16574cd157c4c2338360f7b26faf19ae1ae8e491649a1b9eaaada5d68f827844ee27e88e668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b7cf736f7a09c3e8b0cc4441bf2874d

SHA1
04e75a3b90eaf32af0325cc7244256d547f9c4f6

SHA256
9fabb23f59c1d35ba72a223417466f3db319e9c1721bf95f43bf1b3338cab4d0

SHA512
8b5d2481fe946d85c1a7d1fa6ce5408f7fdb4c8661f89602a75b9802809104e308eb35797f321855e15d67734e25f4afb25479cfd245e96abb5feeb1a41c15ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
915759a5aafcc9dba9e5ddfaaf5a69be

SHA1
ef3db0e3a1070ed0279b93da0e40bc0f3e8d5c28

SHA256
ec8986bf5a114dcd16c595c60f58ab88a5dd665b5667687b5e9c8107f98e2cbd

SHA512
11b42b46a4e694e57c6511a9d59440caf42e7838c6447be4c1ba73e47368be1d5f487cd09b554a4644af28fa3ebed4f111e0eddb0541344dbf7329551ac5765f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba36a4b6db6fba095a4b48b73c88e15

SHA1
43d6b48f4de1692da31307da8f9a73b26fc2fef3

SHA256
2149c93845068709bd5f3ce2da56993cb07d8b81844962a64c0b5acac3ea24ea

SHA512
12760eca21f97b8916578c24b45f4115ca59154b569b65e341599cb780718594df430ce16658ba7b941cac4e31658b9fdc93c69e55d8be1369171007742562b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8652ab2b879db1670d8bcf102d3ff46

SHA1
ce3617bf2b0bf8674b8a5eda47cfb1547e4a23f0

SHA256
10cf038f66cc674ca6411c909407937bf4a37541b7f368582b4f09bfab84fe35

SHA512
5713705c69936376124f6e0b119979b154ddfce10e0f007bd1b7f0e5e4cc88b5827d226403e4ec97bb4bcc308d3a55e5634068566a117a2d531374393ffca996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e6bb0a2276bd0c52dd4ffaa89304a7

SHA1
2a181cc8982be06a4f484852f215eecb213a4684

SHA256
c39697c7a4ac89cbff2a07fac1480c2c0bec407ccae999f3c16ee41ab0b77293

SHA512
a106e6f518639081cce282ef58ecc3287d8297106e6cc42c434c9aa3555b0aacc0002485db33b89654b749ddc3b4c0e82a4bf73da1a00bd1704160345ec12407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa57469299228b3fdb6c874ae790439a

SHA1
9756cfa452f9504ad411159c6abe6ff4fa9eed97

SHA256
77b79787156a021573d05b368b7d64f3c4a00920600f0ae86ee81ae072470024

SHA512
dd5a5c67bd2e24172d4e2beab875f83554b2dd2555ae76255f67b5dc4ea0269b8fbb79fa718b44802ac848ff26576440029f7b996b645d2918fe74500bba6df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75daa21bde09bd58e9d8580c3e688073

SHA1
2538c6f27230c03d7edbd61473712f956888b72b

SHA256
aef66647e55d1c06103b3f754370ffcd639acc038a5f47f0e26896f1d3e0e3b7

SHA512
f9c75dfee4b9067a842c8529a34632bafbc0a1f9336b71f61e6ea429bca51a4ff180edcc4c2275b39a3abae54dea31a2dc6da7872d7ce443ebfa8d70edaaf1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09441df8518217147c955c6c29777091

SHA1
4204e164ef77b57299a962fd85489abae66b580b

SHA256
b6a426bb77216000276b15b92ae62004b2c2804e2cb54825d71c06615119c7dc

SHA512
dd07829eef280980966c9c0f0d4744c528c4672d104c60f46b3c99f29a6970ada35c4ff3e155330eba134bfdd007a9a6e61b5fbd52458b0bda7113c9a7c205b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53532bf7cd926031969cb80c5be44a4a

SHA1
851bf25e16c18ddb56951b1ec9060e965946cf50

SHA256
d97b6fd1699398f40068a4fcc7e269ddb28a442fd4b736f854cbedd5f264c98e

SHA512
64c04cc1ad1432fe4608e1b8c609da624bcc814240d7ca45ab046ee7dec1ef36c4c633b81ead2fc47384254abffd3a7db98b922ad52941e5262e8332ab132a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222640c84828afcf36325c4f06da6f76

SHA1
609e04626161f63b898a577d04312cd883479977

SHA256
6568542f061b8aadc4bde3454e3171d2e1188fa0ff3242760cdd87391b72f64b

SHA512
4437e99074f756e331f21f8869dd3bcabd4de92f16967ea99e3f6141fa674578f48143c57a816dd192979d39743e7c460624f1950049f079fd3d7bad24577883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8421.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8453.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit