44e1d4ad034ff63081eaa311350282a6b72bfe049552522d9dc848dc1382af4a

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5889898042b660eda09b376e636204e0.html
Size

5KB
MD5

5889898042b660eda09b376e636204e0
SHA1

6fbd3f160b4292506acfc374f50858f8990f9529
SHA256

44e1d4ad034ff63081eaa311350282a6b72bfe049552522d9dc848dc1382af4a
SHA512

ae52a04933ccd24bf95853c9f4d0973b0446bc2f04b6ac9459da23cc4f29213f8ec02ba51826819d2719884c5aa60a6ecc036625e8350969c32311b8af283869
SSDEEP

96:1zt2iZ5+pEIIbpEIPcnUIXUIqZR+Ea8L6XRW96fxGKWA6xbOg6v:v2iZ5+pEIIbpEIEnUIXUIqZR+b8L6XRj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b694cd70736fd6d03299fa76b8f9436982bd2dd6646817b1590d5fbc81018ccf000000000e80000000020000200000009124aa128f2b07a0341f120970b51118c9d3397c06ef6a16420b522295f36fd690000000188536e077c0f96f84a5f99348142853415afc3e2d7f905eac9abf61b5a050f4636fd8e47894a675e9d218b1e35c923d90ca68f9f7657821be5bd9479c7073045c92b93c939a3712a2ad6fa59fa4f148798af2e82f09d026351b49f84081e6a6c4f781316193088c5b22d12c53197c5b035bb7b3f655c1758bad918c78bd535c3dd6b2c2b77f73bac2ea2db269177a3f40000000fbdd8ee9b42c7aefbdd53d62eaaea1dd382e8748588a52aa3708c531e4dc75bab5b7f97b88e0c756a32d97f5e15595431b9a70e6e9552c5d8b2557dd4bcfaab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AF59681-B1F3-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01544600046da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000067c0d3b44105af00121176440b15d0a85fccfecf126052bf2baff283e571ecb6000000000e80000000020000200000008f101414a5ae5f4e99ba2136fb960fcdb5d99570804df0a66ff2af6741ba5d7c20000000103d7be1b329730739a2abebb4f986c49ecba61045b7b4dacd3137652990829640000000df465e727e291e08d112ed10052f3bce89ead4cc6802c0ea2010ef3cfb324d036bc6eb20c0bf3db6928d3b473de0d22260cb9eeb37db164fd5122bcca541acf7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411298877"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2176	2040	iexplore.exe	28
PID 2040 wrote to memory of 2176	2040	iexplore.exe	28
PID 2040 wrote to memory of 2176	2040	iexplore.exe	28
PID 2040 wrote to memory of 2176	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5889898042b660eda09b376e636204e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d567ea8eb698c54c3734894cd8d50d

SHA1
007e8b13ec76f7e506e67df9bcc9a35e0123658c

SHA256
0864311cabab668bd9df1655902bdccf296ac1d9155ae7ec90bc38986b8c806d

SHA512
7e3662525200a6007ba0830655a09aca0db1979c5629ac3fe9450f1ed6ca6e353a432a31e01cec3e001990d7c919068271f1460eb9d89e332a47517d6a21987c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a40be45d9b85716418b6aeb61de094d

SHA1
dd9501039dbfdd9d8157176b44320f215d1fbc8d

SHA256
1bae9968319a7b8d5cafb7e171daa68fa743661fa013a3e6bb9a17ef4f081358

SHA512
c526c7a428f941109058aae3b727faa2f64f22ca93a3fddb01151497fbda947370dab04a8598f32764dfed281837b1b03b839d9c92bc00b69a55e404d73d7c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a99045e0b51ae8e4ab57ba71a6518e3

SHA1
20b1fe415d1830359ed24a5549e051af5a869f82

SHA256
d89af7a3aff5d4f0064d16eb3fbc5cd7ddc772316b3c62ebd9cf31b0fa4c6436

SHA512
ea0e00779716cc8f19e1ce8f6e87311334b819208a087564a35c393128f006598be376a28da1035348bfb4682af722f743a3a5954b7abd54dcd23d589703e1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78ea1a1046ce2bb8a091020c902c89b3

SHA1
dd7d387431bee38e0f990bdc9a3607b2c19d561a

SHA256
cc76c530a6772dd72ac49b1b9e2a7607a47e444204b1b8b4425f9649d36afb82

SHA512
a7f4b856e286722271f4cae5faf05655d321e85df0112acc62a9e201a162af89a37f65fa8a57d9983ae5ee5fb85b484ab1bbd23e2381268e01550d2cb507bd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f1e1c9bfa2ce3d5d62128fe91477d9

SHA1
7e21e79de1b3058cca45273610943b26c121852b

SHA256
08e48c9c0e4f018f966e125374b4644604473f1c31751f40e979b3ecfd916557

SHA512
86e5572f3625a8f9b202eb3ef42244ccdc509f6b0f18a1a97757ca678565fbb9bedad714eb419a73007656b36545faf46a582eee3c8869138b77e98a2a765915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e422ff638cefdf40316e849a9a455b

SHA1
9d0f9f70587d9ff5779919997b00d128eb248b0b

SHA256
b67b249787aef5d3f4c7d077e5ba0e3d568cbc16f42ee0cba8c66898c37069ee

SHA512
1e541e8990377ac6622c6da86da792543dc5bceee4b1786c77546d559dd5535ba3972acacde04b37846ee23c34ccfdb88c1cd0d40c9ac2dd14383fe712d7a35e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee03d019439b8436308679f45cf630c

SHA1
d1de1129cd418bd6c6d94e21fb6525c5b3537408

SHA256
af1c756d3f87d59ee7d2bd057419f8864f5de41f759d0cfb0a34970baffcb3e5

SHA512
d733fe78018c38c36ecd79f37ecf2dfb7d92834f5aec1643a403f353fa2b01db49208915134f11db1eed5c6f5a054b3e06b43e2dfa575eb42932dfd60d6484a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c68defa8b831de3478d094912b1bed

SHA1
8d0a50b0a69992d87ab4415657ce6f554a904d41

SHA256
8d3be5b86a54c1b0ea9aa86317932967e5b8e262f1d777805455a73ddfae2bed

SHA512
d1742772e4ed2591dc81684fa4e4a942464bd64766bbbd91b2610e9aa735112d9ec36bf94168b6e01e5ca419bb3a88666be36f2e07f4b79d77eb5e3a59f968fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b27a7831c1affc24dd98b983dd9887b9

SHA1
a0584b8be7a9a4f19fafc0ebd7f09e4504fce28e

SHA256
390eb7d6f10d95868a79bba07e6f1c4ef419f702f74afa289fc976425660ac1f

SHA512
4397edd96ebafd74b173e55419ec13303ef4e0faccdbd6fe6953ad1469ce932b775c0811913f20c947cb8e5e2a1b4485dd83caab3baa586051c0b1340a634b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc9824ba713df8cf73c56c80a1d4a33

SHA1
8ecdf8f908046ee821d1b14faaa5e90dcb2c2ef3

SHA256
0ba87f5f5adf4b37a77bab4969294236a348bb088a6c9dd035d77fc26e5e9338

SHA512
5b09054e77851b391b7e930f9e04363a70a071d53af0b4a5f0265eabd95a406e90b46c512dc0758904d5ba1d1689eab271af97adfb845ada0d3cd2a3b0b41a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc2aa91340a6a5da9076a62311396080

SHA1
cc37c9f50a354cc87983cf0bcb7cfdc607db7c51

SHA256
90877f9cb15b7c0f3860d19667924c38d75238a0cbc465433f393be87ebcc7c1

SHA512
69d6821377858de07f74aa8ff17ab1b1c0e139aaf5ea9f718fe7b487c7a8658f5d535857acc71c67858c7ba9000b8eb52e09ee5d8afffa2a2ed5ab5f2218db46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4360d6860ec4bdb8a7f27f91b8127806

SHA1
8887b266a94cfc660d9d4990fad785d405939856

SHA256
9b50a25046eb2d024e0c9479efdcf230d6bb8eb0d54709de632cbae930fc920e

SHA512
4989298a6bb777e6527c150cbd001df5a10174dba7b329a87165e66284370613fa8c57a2b3a8d5e4354bb4900330573bae057e5b9c47d28970286cb938637e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e5f39c930527368a217233a2f514b0

SHA1
9822a0bbdbe7c70c68cb8a57c4e7c3d8480e7d72

SHA256
7d9b4ce8a464e3a70d824c87d1276044f236981c23b32ccaf257e45023daa3bc

SHA512
876d0e241224f086e3d887b57c968895c3443614ae51766a37816333cae12fd2a9fe2790eb58b864e164c8e994d2c865dea5159441c3c8d5552b1326ff7b4c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA193.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit