94d8b6f9aaf668356cc58c264e3644fef37ffea41e8901dcb7b738e3ad5e6a77

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50032272665dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000076b1db47e2f94363ee3f44c1a65cb3c1309360eb47e40d7b12adb718c38f8359000000000e8000000002000020000000359b0424aa5385be713ee8b341aa6bf259deef92d41f68804c42b3e75e23ff9c9000000006db26da6e24d9f18e0ad0be50f73c7507711ccf43acc9244ee3689c1d2e83b6eecb197d9d7f90ae3a68f3687c02206818e70099ef84f0604fb2bee3cedd4be87acd8651fd002d64eea369053787b8e7e914895a820c2bcd72e4d88d9b0a176f2a9449f65c90e3a55de59955553cfbb331475c198a9658d3443e0bd7af2a160231c65fb8e6cc646e0861d9251ba74f0840000000d84064d24bb300071fcd2b0bf11516d67d9b42f38f375628a378a35114c76ff49c647e9f05850796df67d6b4e5a328f005965532050445574249f1cd7e97dc22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f8f8035dedf58bcbb743d647216ff00fde244d34a6b61ab727753cabaedcdcde000000000e80000000020000200000007849d49dda439a1716bc84c1ba0cf1960e17626f54094c290cbd11caed9699d520000000098b8e998ce734f57efff4038544cf708cc66beab0947bd4f342c6e95aed083440000000bda4eb000e6035d46d61960e7a5ac68776c71047e1168bdabeb43725080056de0c1d35935ba17b693e9b8115997a7d1e3631a5f422428a28861d51f68fecb2a2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413871590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D135BE1-C959-11EE-B928-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2712	2288	iexplore.exe	28
PID 2288 wrote to memory of 2712	2288	iexplore.exe	28
PID 2288 wrote to memory of 2712	2288	iexplore.exe	28
PID 2288 wrote to memory of 2712	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jre\Welcome.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e626ae2569a4b793f16b30453e266b15

SHA1
d94dade74921acf631b2225f751a912a7432a8ba

SHA256
73c9ac6624fb4390e472e1a00f7732d9e4bb47315003d6808acd83aad18d15db

SHA512
fa7687469c5ccdfc061ef138919122efd75d8db178af10fe8bb8f09be8c019aee1f721e2e875c552231c21c8f735e4a4e2096141d33b9c61c56f68d26746d704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a399cd0ecd2ec187cfdd1a159b669efd

SHA1
3364e71d86ccd0bcb70465c9453e394fa14c2989

SHA256
da7cada5d05cba6b31b14de2b75db1df9204d70598ae02281f73313f10a34b15

SHA512
f03b138fe748c171988599670b9dff43e7de90ea9daacbbef0e9b3935fea19d1972d6b803ed642a29762d2cc409ca9041842dcdec6495aa5f975d7731488316f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af1961835f1b3411e50c7d1399063ef0

SHA1
5b98d4e3ba4c67c209dfce455d5d758232af148f

SHA256
d3eaedfc3884cb5a80205a17594277b563d6f2dba37398f164e857d01827a555

SHA512
6f1b7a7c65a5fa665a8c26015bca6ea3a1ec813b7c56f197d9ae7f362ab510d59fd9f2741f596574575256726d335da5e0770e117dbc32cdb86e787f24812638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832944d42ed28862d91c662b69a7413b

SHA1
772ebd442d49d419e0125d6a320dbc5e760f1d09

SHA256
45e2b5af1cb1ecf3284f02ba00b613df3bfd5ca25df4c2e4c963aa574f590450

SHA512
821a68e1a06aeee1976750df3d5e867ce0855c4217d88513ca5ee11d42078e8f2ab0b7fe4f65036fefe346a5a22980f2827cf030616b67f5803a2bdec9600583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2881825755152f52ec79a6aa74a6fdae

SHA1
240d83f60b7bbf559ac50e42661a56e02166a57e

SHA256
07d0454d5a06b751cadd313edec641de6226e72dd2bf3756f5ad00508d922ea9

SHA512
83998bb445d6ed31391eb08747a5579967c74fe284abdd37d5d3c241dba4ebfc7267fd3e8688268efc29507b1464b5f8e2248a4807344d21015b33090bdddb7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
198845ed5a47ee51b52958e9ccc3045e

SHA1
9fae1d2702cac67635b709013bfd9f5fb5d64ef2

SHA256
7c1f0133a24596c7d2014561e2d45d9d32b906300c4015d2f38781c57379c2a3

SHA512
75102c21624ac4c6464145f20a92307991e65ce7aa0cbbfbf15c96e099132661a3d006fe2cd28551ce1930479f5bef5764dc77d99cdd64db91c269eec603bdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a6fda69525551659e580cef0b9e439b

SHA1
f3606b78fd8de65ee0d501a304b7918cd550b08a

SHA256
172f19a5424bab2f3410d7aff671b439f0d2cb83e7414f05119370d5d529b456

SHA512
bf2680c416f4a3dcecff377018c18259bb94904eaf470d957882222c0b7485982ad9fdf87edc0d08c368587dbc74c53b263a85c4263e2ababf7e55f95370e286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f578c47671ae5a208af2802b3a7074b

SHA1
9bb3b52c2b9e72756a7e0b5b0dd76e82f93bb3c6

SHA256
dae6cdd2961b79f8a230854d0f136b677e02650ff12ef18c26a4ae516a11cc4b

SHA512
d570b02a9d043bc058c7e96e814ee74403ed5e7424b2f4575635289658d638f0a878dab47e45f929e81856520f8c0217319908d7b22cfbbea890bd55e67b5b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bd0930be89f813419537a44682a63b0

SHA1
89f2cb07f552ca1370093faee3d8958d4efd51b8

SHA256
0bdcef43ba9ca522d2e581235618fa215f747e431c3255b3f1effda5466621a7

SHA512
1fe4ed8df106933e76a31323ea1aca69e21adbbe0f87d1859b54cbe84f79ddf7697936d1e350ba9758673d8dcecaff90d619582646f4a86f7775453cce5f6b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5622e662aee3562fe775d439993c871

SHA1
aeb9230aa2f289f52c2afb4632adad4f4b678a0b

SHA256
9a3d6e548a1f01670158ab020823ea65b1c06ddac35d55918a3246a2a5a5dfe7

SHA512
08a33f8d8b73e19c925b4660042c771b654abe72fdfa8c56a0f9bb80e595f04b3b14fd75290596bbc6d9fcce1c9acf6d59c5394ce5150d26f4f6e2c3af8fe146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556b03c2ad531198f48839f7fd1837e7

SHA1
db145c9ea376b2081a1d08e3b7163de49fb59586

SHA256
9d638df89a40de43abe75140b4dffc33fb0068ecdaa1778b72e25d67b8e779bb

SHA512
736cf7f89528c9ab566a0c6ec1449954d503c232f6c57c9dc85c4c6363b4a2c17ce9eba177707ed79d4a6e6d7a6920e9a51330d7614c9ccb0025fac669a65a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc75de1516bf1e957774d64612bb8580

SHA1
2a003d4e4084fd97bd202c9c1bc739f62e6b41ba

SHA256
db6728eec709ac7f042260981ac620e6454129a40b83d7a5461c939904e4a3a1

SHA512
ef98445a5ff4ce3435b6b894c49aa170cd4a7bae79e9cf0ed0e5d2bb3fc190a508d70cdb9c358794fab1ef039f558e2fdcda4634d9893c88298862876a83a041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b88dc480d92a9efa866dcdfe30a64c

SHA1
bea9c084e6181188e46a8b64cb95e3bd0e372d44

SHA256
32df238e9759e0b298dd9634b354de1f580b4d3d6691b3a356d6d0c02bcd309b

SHA512
a662ec8660dd8e1c3a2d64ca61a21af8bce9468e241c423ab0fdde009791d345ea350e0d822cda643f2cd0a3d9ff74171c1dde6cf647b026f70bcf4385d3b1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70fc3d02833716047533f51701b02594

SHA1
4cbec65fd85fb6f6c39f15ac91223c74d7ab2734

SHA256
48d158085ceddca2dbbab9b63e25d5b301d490da01513341da8e81f1a7743102

SHA512
f71f2510e360abd1e4f567b76c2b3b8d87b864068f474aeb970ffedcce7ccd350d3820f479fd14e1c59b172bcc78522d15bb78ee372ed29a9f13f5e32d2c824d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2860dbe26deccedeb2769209cff03e28

SHA1
433cf3f561d8169341ca57eda8834006d42104d0

SHA256
ca7601cbe03f5820e651aa4d7f06e616ccfe39083822bbb21a8fb5481efcfc20

SHA512
6366ff5ab89323448f9a44156781cc95b5f5b0d03d918cd45937526aa71c8824c40d505d258b65d25196901c5c46177e0afe49d1bf623c887539d98971b38f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ea6940c2b36dbfb3d1e7d93091d39f

SHA1
5b3686bea6d98bc56f36105208d1db6c220497a7

SHA256
8fb8ef01819ae0e54430738d90ed971fa5b4a350ffcfdcf7d5d8064dd1eb6ef6

SHA512
c218fbde994c0997c41a8918ccf04d05426b637480946894678c22e5f343340e31e16fb5ca755b40399ff36708702c892fff7d7f31854da743c5e14fd186e546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
842dfd483f9f8130e73743bfd755a385

SHA1
cabb61b819e13b2058d57ed391d8b7e4d7f10ff8

SHA256
98fd07e65878e9274ee198662413faaa5baed8175c0ed51f41f9a28ea465ff22

SHA512
83845951702625247864c285b9e84dc7943f340bcf1c20cb9848f8792e4a8230c430e500253e9ee95ddce39a8d49e014758faf8080fad20ffe1758592680ad11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fff3d6f661f1a41b189bd11710fa82a

SHA1
45899090045dba5d1da499d47375c9995065a4bc

SHA256
b96b216501725d97745eef63869bc50fe2af92e673140904ea6bfe6c0b767eb6

SHA512
530732d9ed12aed6efcc4f85adb5f5550ad7c027a71bd1e7f673b218a3d632c304ea6fa5f5741626d49d50f64ba3c71e321e3fb66796e1a5486cd19061e159a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7BD7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C86.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit