295dd8d6459d3ab3340f5db0db9b84ffeb00f04986c48063f08f7a9ca6e199fa

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

571b98cf3ce129dca0da9e9fc3259ba2.html
Size

12KB
MD5

571b98cf3ce129dca0da9e9fc3259ba2
SHA1

2b34c630108a44e3df122165b203a29ce21a2337
SHA256

295dd8d6459d3ab3340f5db0db9b84ffeb00f04986c48063f08f7a9ca6e199fa
SHA512

1d61975181b9f01e3bd2396db764834daf118008ad7b81f5b4944e6d56ba6e0c66ace3dac5003213cd655abe5eb5c0d53246d5cae573fb0f43e14baa6995de3d
SSDEEP

192:FMnELUE0Ez8ULwRWXMwmI3ShtG/wYElUwKEpehF9mymB2SvyIaekwx7tL/mU:FMEkW4XfG/wh6VEgy12Swez

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4FC7571-B172-11EE-8420-EED0D7A1BF98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411243649"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05853cf7f45da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cac420ae054242e1b1500c2aece359496330044b3c2cf975e752d743833a9ab4000000000e800000000200002000000083c235798903f4ef4b93c6348ddd4902c85a48b65cf5e301ee2013b0ed2e6547200000007af3fa3f821cc06822c68d285e692dc10b2c57c679da23066c54bb9cd607a53d40000000dfffb12d776bfca1da51973f4c46162b42e27276b53d5af913bcb2eac7ece2f9193cc72efc5bb9e95804bdd24978b0e5d5f1caa7c2fe9986e2636a4e58bf698f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000636bf6a2418823e5668944ef3c509d67902c876bab193ccd01c55eb20d60436c000000000e80000000020000200000003ca4f13c8ee65a40e92488fc154358e89ae8ace9479e27c755d7bdb63ba56420900000007e14bc11c88e19f2d7e07e3f38afa3e50c490612aee2121f9617c842ee4c7eb2a9282774857cd808e2ff35cadda93e93231e0fc890777a1b6ab09e74a186429250118026e8b042d1a695fa4a2419e4cfad4e4a8a6ea6e405c862d26905cf94a03d5d688833a47cb407458b6215cdb73598351b28c1e7ac1accd49da0fef2734ca48cd7482396ebc48be055e8afc24b3f400000008ced60fa3b3d015f4d94384dd14a2eafbf36e7b6b9a9f823bdd29af934ff72b9b566b00a3c3aa3d2d7bc1ae197a8083053c8f9efeff9f9012108acce206dbe24	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2800	2420	iexplore.exe	28
PID 2420 wrote to memory of 2800	2420	iexplore.exe	28
PID 2420 wrote to memory of 2800	2420	iexplore.exe	28
PID 2420 wrote to memory of 2800	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\571b98cf3ce129dca0da9e9fc3259ba2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5de075410d85ba9487765e92982bb1a

SHA1
938c68f5e3a386484cce20096393b8b236fb248e

SHA256
03d1bee8449861e3900bb1b1af22c3694366816b94519e77472f6424b49fab73

SHA512
237d446ad1f26aeb7bb1b1a3f452c314fddd53ac553c91b54a72fa046b56387e5e215312b45fed03047408d4ebed37f145c249892a41c033525adf240fc9d7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735af6a991533c8c3dd110ad005a1c90

SHA1
73eeaf321af032bf7c5455c5628aaac6b1628137

SHA256
d71cc9db1ec61fb0bbcb0879bbd8b5208edc2421effc73edc503ea0fdfe1594a

SHA512
83350f27dd9c8ec7a3992fd02414f40f13a53b150e83b0b069458018c477718245bc2940c82aa6778de93fe4e48a1d68d9ad4ea803cebc3011675d35115be73e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e693b8cb4a5587d0ea139fd6d4dc42c

SHA1
e4a507f91bd3a5b77ea88161f9966e6e616a4275

SHA256
2173ece7ccc3e4353e39d0907fb2795c77bcd7b560b4f848a56a27be7c8129ec

SHA512
4a25ee71b255797dd92383c310cb9481b178a1dee74ea304854e2eefcf7694e734911d4ab5d35d3bdd38659725cb9cbc87d51c34e0974af9583dfe62b75f18e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
348187ca51c2f2df33965ed12999bba3

SHA1
30708ddc4fdbcbfa90227d793dbea81dff666dc4

SHA256
439c492b862a0b492f7a918ac217dd9f66df6baaca00abed56998a82274a7640

SHA512
70d30e2b07075624613080e695c6e54791934927d2bfc2138c4b1170ae7097aa0e379e4288d3505f63873b727a02a6bdd1e852ad732be45ca153217d61f2285d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce77f499b55a7f6cbeb336a9a3aef9e

SHA1
cfcf00ed3bfdc00e13d27f68d057a7dcfb00c4d3

SHA256
7b5dc97559562b53c597426691946a323006ab46c4bdbe956b5dd34f1acd4100

SHA512
04ced0e554e506daf0f17b54981347cf8112ae7211d9e82facdc85918ad8bb7ce53cd1c4238e11caa53f9f4760680005b88de9046642ecff2c0c01a94d8843f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bdc5d1294abc1f77d6399c571e59977

SHA1
905251ac3cd6ae36f2869f01b8e254f92dd8fd0a

SHA256
6f0c48d12e2c7ac42fb16793d9c31c0b549a29c2b86e711af25d7f76cdc940b1

SHA512
b2964028e37fa81029d92f3b5b5e76fb3e93a4a2d801e23d6941c694fb67a79e301c2666c72106698c0a3a17cd2a10455ba3982f3ba8db32a18598aebff56357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4646a71bafa63d3e866c68473927345c

SHA1
de3705cd24855bb60211e02e567e3b0359c4c356

SHA256
62be5e0e1d8a4adb27724523088d845e86b110f6dd3b8d78ae09d72dc68cd2de

SHA512
09341c7d76f00403525cb1c3dbac1753c426778eef70251a2aa686e1c1396b9ee77b0e9586dec7122bf63ab653ea8e2a0aaa2a0138c44c87ea096aca96d725e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b909655806fd42d9e98533170fec63

SHA1
c43d6ffdbc990745ec4575138a17595ce8ed652e

SHA256
804ae50e0252226e359ee20af044b9f033478fc09f790ad48747ca70fb7d911f

SHA512
46990db4f194b75907864905b6f50a73b5f0212077bdfe8d2792e0048f87e5e72a056c89ab14e97b5cd06a89114a9aa1eb49a9eed94f384fa5844f2e3616a954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b834b7ca36b3a17a351b0ff0591900

SHA1
aef88dbb5ff47e7e5b4b6851508ebb56da465281

SHA256
e9904238847a357a66d6cc05c1a68055e8c8af9751b2ce36956cdb5d16ad958f

SHA512
efaa7c10da2dbdf2760043c970b81fd1ad294ffb888ba61a4fab8aa2df8318a97a465e8eabd839cb102549ef9c36419bb495b92c28a2d799656e4c76410d5b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5618b28a6de2d15baea0002ab1799b0b

SHA1
7e33084f67ece72bfa9c980e411b8983a5926bbf

SHA256
d4940b16daad51bca332d0f9f7ec4cc9ebda102e46671174b541b8307f5ee4c6

SHA512
796edd85b640ff727362396ac48057d4f1d841ab9057ccc6803f9bf43f6b90d6f219b0b4d412bb9e8416f83e1831a3012d4285f770a63b17c5767b81c80e9b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb701b6d33f8cd8657ed721eff6dc4e

SHA1
6bf11682edc239cf30d91aa21574beaed853d4ae

SHA256
3fd99824d1d8c811fb2cc25cad5a91186fcf49593a2e4e897ab7e61db8e28767

SHA512
c664590c9d8245e58d9f18031a52f21ae2815640c5ba7792b8166b5f9f962faf8d5a239191e07828912f038224c7700cd391c0f811de31e0acb6d3110aaa551c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8036a86db0731bb88ac8b12faaff41da

SHA1
eda7c8f3b90693b1a13961c3b5e123a4d92ca531

SHA256
5915b752822eccc1d45af576ab5824946282bcf45502bae28a7b1c58e745a43d

SHA512
6e354fa398b3bd105178965029efb1e79e956deb40b6b5932025a98aadd875376c76b745ab6da5f3afdb434ce65bd5197476fe5e42ed52114ef5471e8f1b8eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB906.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB2B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit