931f5de97cb5f2d57d0158c65a3ce50b51e7f1cabbfb4b1d004b88be1c6de2f1

Resubmissions

12-01-2024 13:14

240112-qg1c2shdb4 5

12-01-2024 13:02

240112-qaa5ksgdfl 5

12-01-2024 08:15

240112-j5sjsadbf3 5

Analysis

max time kernel
363s
max time network
366s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-2.html
Size

1KB
MD5

fd63e8e2138fb09ce6a09482e40e0279
SHA1

10d121a4531b4136e12acac7266ba745448e9b40
SHA256

f869bba0d869e25cb892024c4591ee3802130ed4f6136a9d8457cc9dd7c06be8
SHA512

838262525c9eaa7b7986fb0b80ebf48a0a013fa02bcf42e6b101c6c0f1cf579ea02587f6e4e034c016a30966db0c6f4e2efda7d4f589144cef36aec971d33e30

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000ee1ea2d8faf4cfe3e00652f784044cf430f81e9ded2013e75e3080916cf7c17000000000e80000000020000200000007230ed437e61eb73774a9f741372ad32512cf6e45291f02e08bdf2f619a4874090000000840fffc874fa57e5d2eeeb9c286619e200cd6a319e530e861f81249638016ac25a61061bf290590082a1d24664746dc4ca0424c9de78c3295153f20f91181d69b75f4c8a41c26f8fe693e43e0831f86a81ddebabec1f654e3cffaebf383d8b62ff3c2652de23be1038f9c87b4e9fecce7997d688e03169aa73fca072ce0be49ea22adfe8af985a51dc0c07583c1d3fe5400000008fb8a99898fe77af69f69b17148d69b77133b503e3ce94dc4b4ceea5594753f39c4271eb5f57ce2784044a55e2a1ee211e9baf6ee50b34508dd71aea3fbc1bf5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000045668dbb5a3f7431a09702bb5feb571e5d5ecc758fab2cec765332131a610f74000000000e8000000002000020000000b32fc03f84670f6dbe755491f3549188e152a9eeaf37cbc1acbdb32cd7fa5902200000005c675d96734a2d2845861024bcecbb052a525425963e93beea6387b4441399fe400000000ee453b59b6bb1c3db42fc6ac54316d9e456529c5c9893756a402fe5e3e243a76a8980840d6d76645950fce6d0dd8ec9d83b0292f685a29f27a50022bc030b56	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07649395a45da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411227520"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{648F40A1-B14D-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1456	iexplore.exe
1456	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2536	1456	iexplore.exe	28
PID 1456 wrote to memory of 2536	1456	iexplore.exe	28
PID 1456 wrote to memory of 2536	1456	iexplore.exe	28
PID 1456 wrote to memory of 2536	1456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce3b757462e3e0240f409e503635dd67

SHA1
15756269b8df9a0339ae2423e6e76fa9589fb124

SHA256
830f56e0eb6833edcc4b1b1d7402857bd207b00dba6516f7b1f42b947934d0a2

SHA512
ea0359ad5bbd49ec86c9f3c983dfc923fa49e1e69e71ba8e30ce8b450e35ad613573fcfe05ad0914f5b07074562a9abc60bb5c969b665362b2338855326a4f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267bfe31a0ff7c7f2b05f5cb41b94cc4

SHA1
25512ac8453f2076079a062b16d0a4a816feff65

SHA256
6e4b798256a4cf885024a8ef189bcd69cbebd61c86035b467a5150059e942757

SHA512
17e844c5e2a7fe063286e5e42a8830367c512b288e91f89107aaa3df57269b51ac4186d441a2d0b6339e9164bb64d91cab2fec0b0255e09fbcdb13e8e2ec550a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96516dc8ea450089f3a1fecf25b1d33d

SHA1
8634f4420405a125f96e4dfb3ca5aefd2684f47a

SHA256
1dee15d9733156bee8782aac7a8d893aa8cf9c97d530336c44dda3a9f8c40a18

SHA512
1279367e1f3e331f7a5becfa7983a7c0b4401161ab3781b6e4163aeb92ebce36481d76755688023d23f55747a30a208745494029cbe2aa300fbaae87e38f2255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c4915cf4bff7b584716c0fb8d99b6c

SHA1
873629714b75b2ab2f4be668e47c082db8705588

SHA256
a365465db2abd6976cb8fb23cf3c022659b8fafa4533667637f70c06c73a5d69

SHA512
337a8ceb950d90b21c7d6e15d4acbdee590fa441dd03343ed8681d12bd92700803a469a3f324c68b31e64cf251ddb4481d08351328923600b53025b3858ef334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c869401dfb1dad88c9598754b5632508

SHA1
bf5a13885c6009e172457692f1bff5fcec1da2db

SHA256
7d181e64c94d1275eff3c3f96be481eff64176b9f759a425750e6fc0a08ded40

SHA512
ff18028e648380dce23eb62131ec7da8de00a8380d90e990b77305e8c5b652187a6083ee2b2150cc6456c12aed3e7b041260a72dc345684896df9b6713130254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ff59e8e0d68560b7e9b9fdb1bb6d8fc

SHA1
99f1a7d60c7badde5348fd51acfc4c7736aa2232

SHA256
8e5513dd4e2e5b2a36dea2b037408d208e67da845121e96d6cbc091a914f2e97

SHA512
d75f45c7f4591fde3e961fd78e8cca8d247dcbd8e549aa5dd2f6cc32dc21c2a411bd74350967bb5ee22dfb041b0e2eb34429be51ddb0158c33358c0e1dded350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fada3cdbd90116381182aa8932ea1eb

SHA1
38bc26092988aa3611b8247fe1237b018146c192

SHA256
7b82a8237e283dbfe1dbc3107763e147cff2ab6d1c4f493fcb225f20fc5d760b

SHA512
4cd87278bdc38e2496da753eb67b8f5d9f6ca937beb18bf7ea4261c296720c14953f9f1e9a94b6f97aeb317c54260cc23ba614c8287f2d48a6664b7b2213dfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe674fbd05b28291f1caa7d0fe49e74

SHA1
cf5e92df14a65e18fb74881d4dd785916514592e

SHA256
fb80569320d4d64331404ed7e72935ea570e470163f325ce5974c003025a3fc7

SHA512
74191ea61402db43030eaa386edfd3a01b2641fbc7347ff6567d4c801d0d1c9db6f34975b8e85142f18941b74c497eaf05dc3bb38728f4dd9a00d8b291d8cf0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e808450066a22191c8687a38dfe15dcb

SHA1
78cc58a0349b7aa4bfae8d34cac2ee6b48671875

SHA256
d486c8a809b77cb4f670ad3672c6dcef2de97f96e1f681f9e3a9d55f1edf45b2

SHA512
15e4d60cf0caee4b57bb48af4679431518370a60dfe14322a6f8ccfa46f5b00a6ae7463f887bdf8e9eef58b0b212207263a6d2ebd0c0467ee3278cc80d1e83c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab785D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar792C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit