4e98f8e7296bbc0c4b0b345004dd86f071d2a9eaab73b6fb4de8158cd8da70da

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806e5c6c550a148edcd2d68b27627c9f.html
Size

34KB
MD5

806e5c6c550a148edcd2d68b27627c9f
SHA1

c935dd370f34b8afc8c6d4029331e90bb2c2aa4c
SHA256

4e98f8e7296bbc0c4b0b345004dd86f071d2a9eaab73b6fb4de8158cd8da70da
SHA512

812a3bf68ec74c32de215a0fa83a98c0b273894c746ff6514bc9b4208058c0df4ee70f1b8b3c4120bb8f1fded96b182c1d2c2ee50a9f4e17f3b77b02f2ae0f19
SSDEEP

192:uw7vb5nG5oWnQjxn5Q/wnQiejNnPnQOkEntoinQTbnA8nQOgUcwqYFcwqY+cwqYq:ZQ/8iRc5BCdLvv05uy0/YN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000a0479ecfa94985c5d4f4090acba676999659b965a30af5aa55c18aeb43cef542000000000e8000000002000020000000a968f65fefe712709daf841a3a85779ee91b0bf9b8879fd3e4ca01a2b9168d622000000086c23ad0f1307f6731d46672dc44c6b701fa917a5bbb7075808894fe4978a6f14000000092ad5a72bc94b266e56f06a987534a8afbea9287f0f9b82119c8a5f5945770e497b8bf58472e92dc36334afd80016e3e5cdeb452215d6f2e1b57768bf806500e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e86f27d852da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412710965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000006737829af16030e1ff2a66e5d8485e48362caea1fa18ed606ffaf43af180bd44000000000e80000000020000200000009621b7ae5a7807e5ab4b437c8292438375ec8e33156a2a443971b11931b85796900000000955083e72d0d4f5bccbba7428e8f0c84a290430182f40e388dc2dcbaa09b4635028d0f2f1baab1d11ffc0f5e82b3c99fb9689cd10a8d94e3fb8e89b691171b728503c846dc1513505533131cd292cc166a9de7fabc5233c27f58286d32c075b759cad7e1f562d3824ce5e6415fea1749b9675827e4a3973e539316617b05b0dee617f21249df4b2bca1f1366db5542440000000e92c9bf04d0d60f9f3646c35d60faca6d2327f2226c41316dfb520d170e6c586edcdecfd5711c82c30756e806e12140308da560222fe48325726ec6825f10b0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{521A64A1-BECB-11EE-B7E3-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2704	2500	iexplore.exe	28
PID 2500 wrote to memory of 2704	2500	iexplore.exe	28
PID 2500 wrote to memory of 2704	2500	iexplore.exe	28
PID 2500 wrote to memory of 2704	2500	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\806e5c6c550a148edcd2d68b27627c9f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13cbee2abd5e2b28f2dfeaca7d3c2c2d

SHA1
ebaacca497341c38dcf2fc3c9ba528e50b10cd9d

SHA256
61bb868223351295189bffa6da0d3baa07cce1ef2ce4d9ae89c438e893292a62

SHA512
61b248de9d323355f4c46fe0620a9630e4f6c7b545061606069fc50d72ed2aceac1d112971a27367f0fb4e90e7cd39675ada53e11b41e839332251b859194cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6703ab0efc700c94c70408b6c3092d1

SHA1
d129879d4d22a3b6723bbcd50e47029185fb5643

SHA256
2098ce60c8e65c945fd93d5592991aa807e8e6af2d11905502306ac549943ab5

SHA512
da7945661d01bde33b23d7ff3cbf38f7235e6bb39a3796c6bfbec8d02918d5204cdce6a4cf5878fb441bfc6255802f5bd8ccac360b0d13f3256bd4d11ffed022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac56af07a5f12f0c4710845b8971f85f

SHA1
adc42462c34759b12862c71f2695776644e320d4

SHA256
a73f7aa69b1b723d7ac521af4bb37c27d97e689f630c1b6eec1e714ad2547ccf

SHA512
57f74428f92ce346da056b71978f5895751cab2d5b881fb01f5a5525179b5425ee24984d8617416303cfbdba541d82e069e62f75ec1777f789f25238e617df7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81fc0b33cc01e1c8d47fe0707ff7c1df

SHA1
1bf5af48071d40e35c9f2c3c31a74caea46e3ed3

SHA256
bba21e72c4c34a7503cd55dc574a134646db3ade623b917a5f779c5223fc56ad

SHA512
b73de0911792e899f21233e9e2e4911f12cd6fc50550ca4c09c55cc97a5f53e467932f569150d0ef7004d6afcfe4612e61eb47a78142799dca65ce77dabae0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e4e820a65355a046cc6ce4b0426d7d

SHA1
236ed3a362aca6173a7dd3d448050880dc06a547

SHA256
0e44a4a28dda562704aa26a703cd814c1543d87d41fdabd56c5fb1bb9eda6100

SHA512
72d40d0caf5f7136327ca92a2b043ccb6d14b4f020e5eab624ea00634eca909cbdc0b37fd142a3762219fd1a961ee735a9d566c735c00c88d27aefc3c18ef6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6374added87870e4c605c010b76c9efa

SHA1
5382b31dd687522183521c5fc3150ee8ec6df03e

SHA256
449c2835d76c52a3b65592f2dd16c8875a22329eeae2116a43ed56420c57d94e

SHA512
cad13207749f0f95c619b1b464f8fdd1378a203b3c5770574c5ee652c29cb51d1ad936d5e9e4b2a6419a35cdf45b6119a68cf3f7794f56d26e9b0eb51e2de665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c00eb4b5b6b16704c52b22e1e3afaa

SHA1
186bcb9310fbb7a55fce1f3d9103e907858cd3a1

SHA256
bbf5e14bb0ff8828a8208e76861e3155ffb30d0bf3478fd2e63cb2e052ce4fbe

SHA512
a9b6e8acdab7d5ecb01f6a20da38bbc701df02380495600f76c3190f860a952abc3af4b8655faca242a6879e175fee97c4fb4054d8d12d2c9261362ece9518d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b17de7dbe09f3c68ea27fc622f91d6a7

SHA1
48a0146945e0f474993ce1ef38db85e042eb8a5f

SHA256
44a8b88adf70b1625dee7079b31e2dbb47ec7004eeb398943a4fa346aa4ae2c0

SHA512
de0cac7f8b51163e777a5affd2213371b80e4ad53b4bb81edbac838382c51be052b80200b5d106ae605bd3f24d58b4166d81ad4388233f272e17a6f2d6aac1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
923a9afb8ad0f3a4c7d99baa861ad40d

SHA1
605420303db1343f7c40ff15ca4781d96f1d658c

SHA256
8311e9cad3566c6919c928f9c5777a10043dbc5c19690c0597d8c4470b7d7913

SHA512
f1f30b797f9d1ed9c513ab75cafaf724be4c2afe93f7e03cb6fe12ac8181350a142e62a407899e0ebb7aeca09b8c1ddff3c38679a5608131ea44c184c5888fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae69313862a294933f3920ddcc9cd700

SHA1
78512561f2628adcf7104e621ed771eca4d9c510

SHA256
d8c5daa13e617a6437f738db964b556f920325380a330b5191efa627f30d5c11

SHA512
2a78d4adba6287e9b54b42c8d88af0e69945ada8f07431e7b42b499e865f4e6e6dbef23044e7db5e12b4d91563d098c2a3e85f426a6a488ca7f30c9c250516df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7743db8ea76f429cd6fe5702ef2a0082

SHA1
3cf296bc68d984178f479d87b3aefec47c13d741

SHA256
531de69afa4a0363be7d48915b7ff207a2331c16a7b94102ac92b68b11dc8cf8

SHA512
8e3b4c8dca72afb50d9c7d3ae76d51651241101b7106164e960ac0e6bc65035ad19099824a2e1ed76f09cfbc9a20383d4068eb51b61e425b24e7f7c1b58987f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6042fa9f4e7551b559aee5d93c5a188

SHA1
29844738bc9931a427b16cf9c6790d3a1ba15895

SHA256
f2450cb3392941c68084a3659b175959055bb2e1354490eddfe3d3440c76c19a

SHA512
34b8eaaa97540a4e25fc256674ab31ea343c8a19dd60934580b1eca56e40ddf6be77353e27ce9843e47c2f660e7814bab66396d10dd3e52797bff383c5b66b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AF6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BE3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit