94d8b6f9aaf668356cc58c264e3644fef37ffea41e8901dcb7b738e3ad5e6a77

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e99e80615dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABAE8081-C954-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000028562e2d717fe676783d441e9f91b505f4014ccf20b92beadee3102151fa065000000000e8000000002000020000000cd68db53d0871e1f8c9ffaa17e46f045740e32d4972cebf5db7f5e66a46a17e6200000006c9217101a88484f42e51e08e4097d519e93ac2b5477456114617068f72f8d264000000081413c72c700982633dffb8a258ff5c80a49be780c2a28db20719fc1d499dea24f67d0b1780605a4a7bdfff0901a812f0627b7d89fb83426b58e637e2d1322f6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413869466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000087de05b7d2d7e34e9e52fc1d43b79dfc2c713a572f181208010602ed49958b2c000000000e800000000200002000000069a9c84c4295503875c52b34b2548585c2209ec6699c95fe93f43a79b6c8468c900000001fb31378d85f34f1adc107ed90b351a73280129ec1cf36a6203a2f0e4ba6e1070bb1962e3dd06cc4c0065f59e498dd797503006de547d6a9341910e0f1b681b82efc5f3a0ffc671eb0eeea11441be2325a0f8a237bddd45fada5f50258ca44224b6878199eeb9d52c7d2c95b2ba0cac2d8b78fed91a28fa0be9b6465408756e8097fb81d8765abad70e9bc7ee3adc19e40000000d3561a063baa6a064e05b602296f14c3ad2549fb0c210a9e49ea09295a52943b20413f0152b0d060437c3f9bd05f7449cca177d3141a39fa40ecf963aad3f29a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2488	1792	iexplore.exe	28
PID 1792 wrote to memory of 2488	1792	iexplore.exe	28
PID 1792 wrote to memory of 2488	1792	iexplore.exe	28
PID 1792 wrote to memory of 2488	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jre\Welcome.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70d23966fab02a0449832595df7f39fc

SHA1
159a156d002779f89419f2494d42745a088ae960

SHA256
5f8e7429d1779bac1de4199da44a6aa003bcf74709fd21c92dd3ecc34dbd3a03

SHA512
a51b120172438749af29d83befd4178b12ee24376de58cf75de003c870720de57aa6554a1d7ea91c0aae2086a985008e1dacb0f964f789df1c4afe1d6e80f9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6b98ea0f7bc8760af2e724d839ac24

SHA1
d6205fe1b1469ce3068528b959e6d225a7f542ec

SHA256
4226064f8c66232ec60c8405ea009050d73ed96448323a10719400aef3e98e30

SHA512
80ee974283da33d749529bfd2d4b8823e9b10931857a86178bfd663b3e8c403434081be39ee7d5e6a6f81ec7d2fbd62d5565b30040f78a1f1ad1e2ea76f15c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5ad0810bb5030529ff835b9c39e657

SHA1
99aeedb08375d769cb735e2462d98025de8ad221

SHA256
22bf347452d1364337064ca28592a5b8b711e00696c70c2b358411bf5aab15f7

SHA512
f54ea6d1edae3f5a2724536b9a3a64b139901f9857e23514d5a5d87e7cb1177006d16360e1bbf19a854db36537e7ab28d22a081826decc32efd295edac8d6355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c13f843ac9f6d97f5f930d9069a01a15

SHA1
f7f4a646c8b7781a17eecc79615f27f7905cb85f

SHA256
d89e58e5a0e315380a72931101bf47d66168c77726b13dfc1089bc2869ad2ccc

SHA512
6f6ba091e2cb873997801a000d1737b61d5308fb93e3371853cab1e7bbcd1bf78dfa66850db6c1317d39c01760a849659bb12eff52736f49e5c0b63b3dbab997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bebd60473604cd1a30140d8c1b21849

SHA1
7491cd56f2c2988d4d02b11dba5dbefac7b66fb2

SHA256
20b568d830e731b411e1a7a428c06337dca17d1470a3dab78b897a96be4726f9

SHA512
f2aa80a4d3eb1fa3b45ccedfbd5b01350175e73db85e101118e33c5aca8b6dddae8f22a1226e37b087a508f295f2c767e9c4bc8883d4a15cc9b4bc3ffb2feff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fae74f456587b4d36777d16184d4a82

SHA1
2a558eb5bed65843a84bc91022e9256f59efb20f

SHA256
d75ae74342f481148347ebc05868ff94168c1df631e125f07a82e2fd3406c96e

SHA512
5f2e6282bc3d13733896e8529182dd44264c857ede3f097356a158eb6a0113779d5b3eeee9ce5888bc26e27102321af85843230c8e088e4dfda1bcaedf9014c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec66e9aa72f17ac4698d7d317bbe346

SHA1
ee69df1af004c9ed36fca4a2b8618cb5bcc0403a

SHA256
55c1b289d7e61797054d4b94e49782a3cfa726d2d56713e5cd997690446f7678

SHA512
755093b5a7dd0c194e8630a4876350af8f0762ed6c02101f1c25634a97eb6512e7dce82571416e578d0acb6673fff065652da671c503d0b7cb09013f84303de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8b9c4c1913a5dd9ae99099d0a9e913

SHA1
9c6f8cc4dda965528db0d611b4bd466269f11a01

SHA256
df56bf68a157e2308189694bdcdd7645de9e8ec2672e6c72bb6d538e26fa8291

SHA512
864dd3f7fcd841754fac061bb01c8d60d72214594c9ae89d24223b4ae1618ddfbfffd822e2a61a429da003c071cc4ffc49d22e4b5f09f285ea86c493fc799094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4404ca26e31521746b14ea074a2dac7

SHA1
c6b406d540ca1fe1b715b228d11e98d363ddfc36

SHA256
cab1c64c0ba60753e9743f2b1db00d94355a86acf8c4e451ce0d490a53233f5f

SHA512
eab133c816dfccde6426013fc1037f6c0b2218fc968305c52ecc88a8eba902b693925e238bfae269c1552ff6fd7511b044cccae65bee2ce654cbfdb446964f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
330d438f4e9cf74ec484f43b54d4ab12

SHA1
47a5d740a136745a87ddb3887c36d30ce6c3b3f5

SHA256
1ce06d54105fb4c0364019bad865cd4bf55caa48c27262bae42ab50718ad4657

SHA512
aa04f935c4ed38a1f8a6cf1f0f0059b8d4e5a0ba8c76d4f0e8d18bfde20c2d95dcf7157a21acdd14b47b1b831606d906fa6251439d4bd73122f8d39306ece25f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
057ff2d1d1d650d25ec7ec18731fee02

SHA1
b67e7dfc22611e4973047a84b79592825b0e9f3c

SHA256
b69014f411265812ee76a943c4287fdc26a521e14d7d001e854f8ab36fdb07be

SHA512
346b63b860ec342af21d97ff0992c9e88d19dd91e25383e02bb9256f8deb121bea2f73c8328ede9bd4fefa4a6f3d454027cefc1120c1f46cd766ceb7de115e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
376de57af197e936431b3dc8954c1fa0

SHA1
f87aaae37cec839ba40f9ea896adfc5d07685a1e

SHA256
79fb9fb58f34843c0c43866e13c592f1d15e91eecbaf38bbd45060291872d9ea

SHA512
f7de950aff4056c1631fff3041b3d733513e1b18bf815eb280bed123ec767df4f5cadaf3452df38c5d21dae8d3196a55e67f4e362c6739f2efa3c7a454c24865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c11f13290833b13c23f64f85f162e77

SHA1
dd036e7f877502733807ff7915789468aff62cf8

SHA256
793956a134d9eb5a231b129a33b77ab91a3ceabd3aa8d3c14ab0c08afff89354

SHA512
6a56b84bd3f9146e0f49a980b4175c09874a6cc0d4f8c2545155682f723c97d1c63c82f1b8a5a0519ecd924bb09804adfe115f4e4c72bbec1c6ef9fb50e529b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e2f097905df17e567286f4749a38b41

SHA1
535282524cd6b22403759ee4ee1a9d9b3aec9ae5

SHA256
d2b56e8bc49cdc87bd80a696faa6328c43e3f3445a6d875e56bd824d1a332c7a

SHA512
4ecfa36d91ec7c62c618cd8add4ca9d7709f8ae8c57288118555110e00f4f992cf863f9842905d5e5eef3fdd009ba6c1d772f0ba22c5cdd31d8fad0c6e13a178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039e7999fcb1f1d8b61ea14c828d9886

SHA1
3ccd0adef876157b6b80d7544429e6c4a7818a25

SHA256
842be0914c5516d67af5f7828e51ed4fac211dfbf83bbc24f5556b4fe427730f

SHA512
0bf783b691c800a44a6bfb0d74afe265a197c2e0fc6d8facca2d57512fd25823211337efe85eea5165063206de4edbc0acdda94cc582e50c59705a1635d40362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d8003b5e2019987d4846f6c16335c9

SHA1
43ececc6b709fa653da038b5d7760a432f178284

SHA256
5be2760daf2669841f7b0b26d72d13d7dfd701097935e7f07f5eadffb8a261d2

SHA512
dfa5f1c697efb3316e4a84fe51fd840d284ede78ba5d5443b4629aad5a825c94c6c79779b3ad1f383890025492cf86767dd7b1dbb6d1851defbb289f07545a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79f933329c4146a6f197a68481e3030c

SHA1
9142d6bf86717a3193547d746e3495c63316bb40

SHA256
8e37c627193a0dc580947b7880ef17751285d3d403a55a20851e383d50b3a872

SHA512
16e8033efe68ed6ccc71bc609c25ac41886b99e4fdb4499173a8cfe582ecc3ecbe58c3e7ecd661c35fc8ccbe7783ebf842f3ef37bb078dad053a1ae304660044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179bbb2c89a57dc8e55c10310b60207d

SHA1
abe28838ca60cb4433f13663f6d4a243ab032e1b

SHA256
d6352a8b3850ae444e1d0eb10428ae0232f75f446d16cc54cd8934ff513a56ec

SHA512
3bfdaaa1cd05210e41cff1c850a4ab3198b85008b4f9c1be8f6ee53ddaa3e3a26c837d64400fe8171f7b9142851f34c63c2d341bb8f3f68e8ba11611ca15c8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3517.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35A7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit