f58841932f4fc1bee91914fec9b6baf6ffacf2b438c3d8c4c1d84ba3dcc3de2a

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b9e5268a794b8fcad4391360bd39f11.html
Size

1012B
MD5

8b9e5268a794b8fcad4391360bd39f11
SHA1

181abb05033fb4fa22533c75099b56661a854f40
SHA256

f58841932f4fc1bee91914fec9b6baf6ffacf2b438c3d8c4c1d84ba3dcc3de2a
SHA512

cfaf941a9ce1034071b942af733b03ff6eaac295c0ba1b5425921224d4eba3c1ec426bc36f3a993caa91edbfc61c32abac2e857040cceddd7c6ead5859e1a9bd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a6f3306956da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000088b874ca1b96a823562a55ab5387467a7b81b56c01d8db3517e2e655cc925fe8000000000e80000000020000200000000b46d341e7d8b43cf8c473634765c8da459bf5fcf4979ac41610b61e5f4e8cbe9000000085b84f4a1bdfac43c0d83a94a3874cb00c2964973d4bc5ba354a138414047a7cbc3db4ae3f0ec67ed7f4fb3cbd28cf5a1d46aa5e5c095ea40d270550df12a06e98e0035c57e2a6b44dbd9a230377e281df2d099e86c9b7f1e14d57d30c51fa287af7046bc77ac8a3d855855200e4dd744d818d45c37903bc99951c44b0ae5ac2323980d45d324f79db9ea1346f989930400000000439e1356a84cf461dcf93665a6e5e1bda27005fcdaa039d836a8dfb3bf6e38c93d08ca830fd258c94cf5a21bd986e2c4149c76cad184e7f2ae6bf324f198728	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B532721-C25C-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413103112"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000077d6ce3a5885a6956dbea6b7ed3b2b8557a276c245c4321097531c325ab0162e000000000e8000000002000020000000978c41610ef8a78ee0273a04cb4878c6d5ddc03ef74bc378db0e59710670276720000000e2ed2a7823db4f104018841699e854fed0e279da341e75b14909104721777b4a400000006e75070b57b3164f5f3d537e86690a8d00c342326b9dcf59160bab10a2ea3d06cb19322425c35f36c2f969a4366508c6a8131a7918b5e306e4de8cb46d0dc467	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b9e5268a794b8fcad4391360bd39f11.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c0c30e28ab430e9790e66a72297d51

SHA1
aee11f32001eb875b786697f13c4c5b29e8c8ff4

SHA256
a5bae57f0d76248f1496c2cb1eb07cc58612e055d1c40f887c9a4b91ed090ad6

SHA512
fee8c9721c962f34182dd273c774af1b7e79593b430a533158862c5133f2940aaf650fb1fceb5b003b7a90d8f3b76e969ca340617f7f68bf3f6ee8e3134ec610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8cfa64c906b494d7ab0e13dd30fcd34

SHA1
eefb50e292f299c63c2d329ad918c92d14aa0199

SHA256
249c9292d578b8c8baf7f1919d59e62a3e221196505d8785f9f57a114abcafb7

SHA512
9a83c5efd82cad4e353d4850b90ba4a57e09fa98d84c28f5aefc04d1b8e78fd96b298230bd0db822e155d35e9672776b4b59fbe4d784c78a63de1a984e601a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e561d2efa6d92c983348df3b26bf4713

SHA1
1c008247fbc2b11b74c442cd9e6124b564f90406

SHA256
cba290fbcf4416740508538127ed0c893327ad420b1236d3b26089ef0a4c58c8

SHA512
f2080f18d51f9adb24080b19d2a66e74db2bc73e6fa1fc51dfa02686556dc35cd7cbd464c095e4e9f6b85eda3305606f527ef9d30e3bcf4c6cda43b73a7b8e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4f5534426ac28d980e1d8834826fa25

SHA1
bb44f972ea80af0c271523155c77efe9d7ecc7b4

SHA256
1db186994019a9768dd1d63c2d11c804ecaed727b1e42588eb41c0612adc8cd0

SHA512
eb8bbbf6ce128cc3ba9ee4938ed5a0573e2eb2ccc5d6b9d1efc8177da9ed86a1c3cdc3a63029ea9100f8787d92fc9fbf19b476e2bdec67702ebce4ce7341e8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da98a8e61a5d05a12b1669f075ef0dce

SHA1
9d99c7ae6de8dc58be909e111adc08af79b404e9

SHA256
fe5192b39de5b0a60f799ef13f83fb493b41bb32dfca4385e2fad8ceb9fa7041

SHA512
48330236d0a0358e08cf8bc0f1b3b1287c63e48fe549688a898aece741edf952b9b382ba65cd60fff5a6d919e48fc9e0ab84479c228f55e62c6097a034843ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b9fd0913105d8c375d37935d8d99d8d

SHA1
5db187400efa8d5a2e6c3427b203171e1ec90787

SHA256
dd58d5e3f41f24e34267317e18bd45abdc744afeb3314d2db9fe3b398d56fc8c

SHA512
4c591a20a52fd3271e6b33be6caacbd8af4c94ab8ba86101d67a490fa83bcc56142fcae4c95eda0204db632fdd0dc71232c35e5f9280a0544b6fc33559e7f555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86767cd8538d261f8c08824cc6040e4

SHA1
fac04676c505b790e4bbe3009ff550b749cbbb83

SHA256
891db34584beb13099eb9cb7e07621e5dbd32069cecfe661505b323d4a4f0c29

SHA512
d7ca861da393b19a949e7d8843122b23cbf5d4d2c9dbec192ee14b8360b703f179f07d7c8fa273baa098ff196c3bea56988853ad7dacc2c7afe6ce205ab760aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e253db8978453739654097202c4330

SHA1
75f0a5ba563ae2e894d338a6632351b5cb7721a7

SHA256
5c82c2ab256bb43b887a7fb12f3a56376d7708638f33eef64f21a4a978c6e2ee

SHA512
a0abd1f30977d1190404336b22f258291e09c3fe89282ba07d286bf3fe4d2fc2cc53333c473a56dc2d6b902727fe302c534357275059286ca43a3a348575b73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fa79849acf69320979c31898996b780

SHA1
7ba7aaf09305d45f6d04cf247029935a8b272fd1

SHA256
5cd5ba3b128a51c9da260279eee68440d12bfe95bade4a475c503a20ef9b458e

SHA512
a2b4c9b74a9aaa3ef25663c7e1a983c0784b6e5376879940e3844c39fb77acaa58b1211f484b4d15da588ee96db7e87adacfeaa45c189b08ec2a0b0eea727396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8568670365b9f5eef2c159d5596f4e7

SHA1
a8166a9994f70e79047c1c04df10e19b8e76de34

SHA256
86dc662cc7b5c90478b1c6c45cc320a935c92e7eb4f6528448aac78cf75b61c5

SHA512
cb200152ed7e43e9143f35752bd6498d4fbf570302aee72b23683fafcc04f8e4745096e375b7cd1830832e47b32e03dbdcf1643ff78c011975989f95ec8bebb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f228cd6bf0991ab5fc9929e1475d8e1

SHA1
4382b1816109b9f45648906aba10950eb9234bd3

SHA256
1c3ef4b29b7decffef5392a33432f00d028f4ca6fb0893c69a14d4e304d81a63

SHA512
7a5b0932ff012308b5b3a74220b6c311d8ea074f36d362e54a25bdeffce8abf7876972483d8b0e5d4b3e8f5b0b0a2565782153811c29da81fca0fb5c17c0566e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caec1727fe852dd13b0afd60eec646a4

SHA1
56ca3b6d498bfc0676bec0feee6ade949a766175

SHA256
18b8b6c26ef22f874563316f700b641ea70652026c2b15bdab3fd73f4744b065

SHA512
9fc6ba8d260796b18761a59a96cfb7a16114a74dca113597b4f256336ac8ba42af1f5fd851095484a01621044e6dba6f4f5fd0bdb734ead282fc7dedbbe6d505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2f55a6ec1581254bee600bbd056b91

SHA1
446d2989a0f9606f265f65bbfb58993ecad698c9

SHA256
23fe778dd5e86d31ba6faf61c9182766aa6c5fba84d88c224dd2d47a2143ed01

SHA512
71826f68e1441d86317685f3158d36a5af9212322c0813b8ac287211f089cfd2dbbc473ce8e76a25da4475643b5a3bf38be8efb82d1d63e1ba2d97c910756866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10680c8c4a21cfc1aace49389e2fa4f0

SHA1
780f68e3dfb38d34dafabbb4d631eddcf35a45b8

SHA256
ae81d9ba4f18e5c42b932eea2f1c62d54a1fe76dbc2b48bf14b1346ca64334fd

SHA512
2f6dbc2dff6b7398ee29099015fe9acafeb18a30c38449ddd38f85fc85e4e4f5b212917bb11fd03ac926b8529b66fa835d286568fe633b1b9f154ca53396fca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5c50cf31b45e88e63e02106552fe03

SHA1
a87293565dc36b14d673883ba217c4561d5e7239

SHA256
89bc80b718717c8c07237f71a5d9351465456be2dc8ff8ae8beb4bacf0ae1bb3

SHA512
61942e1cd01aa50cf4cd47cbda73e41e1336bbe26b59dcd253f785f925a2d9c726782d05ec87cae5aee5349e08a271f28998b387ffea9aed8449b3ff486e532a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0bde346d7d6e7c0729518a55ae8551

SHA1
30ce8a7082684de4e286c1069e9edf48ad2c7565

SHA256
ebd519eb80f6853a562d159c575e899ac74e450ae15c4853020dcee23842365d

SHA512
b98735acfd51efad0bd0083542eeb14629ac252b3f4ff5c98badd9a8fafe4af799cc3f25d41668a9a2bf4e2d7b0ebe328cb7627664203ba94a47a03abf207a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8172.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit