e2d120c5746660ef75f646e0c7cff049bf5664384754e49213a1ba148debd3ea

Analysis

max time kernel
123s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88507a0c776fe2b344d47e78ae4606bd.html
Size

13KB
MD5

88507a0c776fe2b344d47e78ae4606bd
SHA1

a6a3cabb9aa4184be8b5cf4f7cd1e876ae75c0e0
SHA256

e2d120c5746660ef75f646e0c7cff049bf5664384754e49213a1ba148debd3ea
SHA512

91bc36642f85cc0f1df668b3d912ebd69f4fa0aead7976415add2590413dae8bf97cfd9c2b785739bc4f15d0209fadc575d8167ac46e521339299af087d467f5
SSDEEP

384:sPlIc8OBVjjrY/gunBoZ4nEBP8H0ImzguLZ:Jgh2r6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E53A3E01-C172-11EE-B311-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413002839"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1300	2332	iexplore.exe	28
PID 2332 wrote to memory of 1300	2332	iexplore.exe	28
PID 2332 wrote to memory of 1300	2332	iexplore.exe	28
PID 2332 wrote to memory of 1300	2332	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88507a0c776fe2b344d47e78ae4606bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4afd34170e66a32ad013b515afef4bf

SHA1
a076baadc151b1d1568c6b1fa06589f1aa0ad906

SHA256
f09cdf7dbc36352d3bde364019c5b1c35d550587458e54f425bdc3d853203847

SHA512
c3049af240f981891310dc1713300e3493e4463774da3e772e4bc005bd07420dba2303b44abf57c1ce6afba01a82af211e929d3cf30a8cf97c68b2f9c98678e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1253f585721e746b5d8c250696984c5c

SHA1
68f34ac5c4e4fda664861322d6fc2cc41ba76119

SHA256
676a9c83831ac01b137b5f2d617cf8ef7b24a90bbe1e98fdfa7e114d05fe9587

SHA512
4f307122f0c4f79d5e3e69ee1d85e41e84651b0f2c29341f4247b567d9ba8bbe022cc657d0e73b6802b72d03ddf0a81fa75990fcba456c2e051656722c733169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65c20d99a048e75c55ebe6c08c3a29c

SHA1
465d1de8f36d013771819545416f0da712c84e14

SHA256
8066cba28eb3b68d3ace2f462d6e7ba23eae6e7db21ee8af0e3d3f7f5b5b0f93

SHA512
2bde45d9469de197516955730df53673f0f4289bd5c1c748316ab6cd6c379f7a90c34dbf54fc8ae2ff8d57428feb16156919122ce00280410d2cd38a37b673fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bc02fb6a447392d53efcc14bfb4024c

SHA1
d0bb479dde2026f384617d0f96f1302494c2c459

SHA256
90dcd2fdb6c677991f3be4053b25c2e9df45b78715b7305e97170b586c052041

SHA512
502c2ee95f326576e95d84e79207de23d2584826b24a7c7a5404b9418cd34ed33063367faaeb30c94893fd293cb509cef1b5d9601bd74b7dff1472c29ac6568f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747517b7e4b209391f691bc3e924d81f

SHA1
65fe90fc658fbece5feb0570390267f6cd85eebc

SHA256
62ba4f35966430241591be7c0005e7aecff8a71147761701649e6e8acc5b265b

SHA512
b3eccd0db40fb386546f09087e5af0c20dd4041e6a79fbdad0119b21b70f372d1b49e3b2784911fbc8ef2a1c1bae2455e1a3ed0c880c0d50ab51bdc6ee873a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaaacd449965420ef56eafe472d924af

SHA1
cac338c85fd84b0f658835fad3686f1d3562c32f

SHA256
1d9dc3f43ddbd0c0487819b9da1cc6e9711d9d42d9f2dcc607e687eb427e2dc5

SHA512
0dfefb4ac7384c578388c8f79e84d07120c4513779174da5a18a759474d0ca00fcd364da76defb7af9c97d4afbb11e36c4b482358e7b62d9ebeaf79f43eb7afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b172e25a965ea6ab7456f55950bef1ab

SHA1
e11b11104d5a8f74ba45ccb9f6d1d99fff9de4dd

SHA256
5c5c71cba0ff86a7b443d8ed7d62f2278b52cc0f4aa4c34ba29c1c5d421d0423

SHA512
716726c25557ef8a0cf9724ad851188f62c46aeb64be560f7ef20e09144972ddb1e3220c35142c07205b882c150511d432270343b6e4f3e293bde964154f8072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e4896fd6d3d7758bec506ffdae70fda

SHA1
28ad29b04088682d6ddd8df2ed3757157ea27ff9

SHA256
f4c18690dd92883998e98cd6851038b421a03a5e705c41ec59078750e87971d0

SHA512
7c0a3c8f6f190238f878b40563ff186e7366237486c952e5b65750aaa631ee702a9807bc1f0dd55bb4fb9a5ac8d7ea5840d46e631396b3c9cca1f9b14de5e61e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0cd3fb6119c370473db438e0e8fc1f1

SHA1
51cd084d38eb381830bb49afaaf643799d98a5eb

SHA256
24f381ef1c4c75bdcb3d52e796dcede482656d1454bba9281bd46fa2701ad02e

SHA512
fe675294c72a870a380c974b98bae047d785a9545f664abe18f1bd90ef69d653f716809c0962b33f8c82952d1078a45fcd9308849d42aeeaad0b57c88cab90b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb606b23bef1aede4caee914e0845b3d

SHA1
603f263b04ca25bd5ef8bd14a477e76e94e13a48

SHA256
ced981e27dcc127f581d6c2b4202f4da7d55dbe5364a861791775ae1a9e5e615

SHA512
424dd77bce70f3e3c8b2db1b64ee8d9bc7e18a6a8d3656231e0c3015ee936252590c9a67c51ae0e360df74f93bd64fa3a79f1bd366fbf7fac93ae71af2275b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26fb373eee9b2545cebf5a78a114b282

SHA1
edab4473bfe36eb846347a5ffc34c0fcb1f638bc

SHA256
2816370e540f5623e4b45a769ba58e76aeb140181977d469aedb0e95a9ef1bec

SHA512
ac2292155fbd1a7db6b0ded568978fff3ddca0f580b9a78fc73b5512a2e0ca14be408967f979e261ea78b2c58bb62a2d3a39a50d3b921a7c9ee82fb2a4986789

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BD4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit