94d8b6f9aaf668356cc58c264e3644fef37ffea41e8901dcb7b738e3ad5e6a77

Analysis

max time kernel
136s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81132181-C974-11EE-9843-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413883139"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0249e56815dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000072d0d64c41581188a88de66179c4fd0b81abfed3e5d427b36009520e9e0add8c000000000e8000000002000020000000dad57c9d743ab86c88d5e7d2e93c7d20ff79ab60e2e66d9eb065608d32373f8990000000eabf7d5d4777928c7ea461b5ef56f90be50fa481dd7d35d46b4bd556862f8582f710d2e5088b962ed4eecf8c0df11d92200f61c4d46e072ea302396b5593b4211325b95e61668e935b5d2f52a68675d805961556822e6d11e9abd3e7a6028e9adef4b60225a0930cc3798c0ff285354bb4cb09c9a65f9e71f011c695e3b386050a5444944f45902b0e98899997c3f01640000000b5da587874841281fd5f8b39fa72204167cfbbb81c99552e72e1adb160a286d5fad544e8d7befb0dfe92760cbe16d4620ed97017593891e2552c9592279159b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c0274bba66516eb4e8e3e1e5c5787daef2ce4d84efb2a61e4763632f45825c73000000000e800000000200002000000074ac016b7a0cef5d314eddfcee2fa4dfba4bc06906807f84cec97ed2b2490d80200000000eb5f3621ad4a64cbcf42f391a21faded2348599a280f664a4d1d70a7b2467cc40000000f15c29f57571bf7137738f4152d8ed480966a195dc54b3260c827e9df8751043b7254e2c50df06a5bb631e707b261fe4e96d0963d3f356b15294de05135a5689	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2716	2480	iexplore.exe	28
PID 2480 wrote to memory of 2716	2480	iexplore.exe	28
PID 2480 wrote to memory of 2716	2480	iexplore.exe	28
PID 2480 wrote to memory of 2716	2480	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jre\Welcome.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f65f8c4c20a0d48ecf90ed0b47d674d

SHA1
6fae85dc24a9cbfa7663655a607735a45fd9ee85

SHA256
9d7d288e98a1c33f970de4299f5e13c2181e5bdb6406e3b4fb09d59d94f6ac2f

SHA512
72a26239e292d8ca412cceecce3738b18dbca96a363056fa4504da9eda8b90aca326f03a59aa9f614a9e6bb693c0d3c42e12089681af22310feede2601650ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8314f00c3c339857f3b8e292e1d665

SHA1
76842e9b8c8b7a3907afc253abb7397fb3e498fa

SHA256
7365ecae30b571c681e9c86ed5f330af0db2381c68d045936e425fac695cce89

SHA512
6fc590dcaf779bbe93c18c6c04afa6687ae81311497777a1384a8e9f7008bc4fae901399dfbf9f823f6f7dec087d6b9af3ed0b21ebfe1c54060bc9331849d471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ea696aeecb49be8c983a9fa06ab149

SHA1
4b374345bfd4ae208d673923add839ed9fc415fa

SHA256
12dafcffa4f9bd6ed08aef729cc7d659207e51b7f9026b4c3ca1ec703ea8abf1

SHA512
07a074b08daff4480df723f543df8259e6a4a9874b028221bf32be36cb2055ed32c169a4fd98fcea99c1ebdd44ff7857383346a46103cc7cf5ca877a39495084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45472c6b8a5a82fb8a82b0d2859ac82d

SHA1
7c3b3ffe4b74be0ba1378e88339c38ddfa03b3f7

SHA256
ece96a405f352ac3fe16068f6ddabbf3f0e910d4b41728a515701b57ddc204f0

SHA512
02a9f42242af26ebc4ba880f669ec5bb316420a7b7b941574270d850c09825acac667a39ecab5b69a471d607d8558abf86e88c3850d86ef806af1b5aa656b9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
861381ab8096d8a65d4648b88d92cd53

SHA1
c1446369e2746a8fa924c5b56f51818ff3a9eb70

SHA256
528b6f933e867f329dfaca49d27b14148dc02ae86ed5466e63428fb00fa18ef0

SHA512
c932db18a3179402a267acf51ecdbba9424ec07a67163ccc448603fa21f7f4a679a2468a4229c0d09f87215b6a67b9b7fdd6f57e73ae4bb837419dcdd229cde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
102cd6e7934ada15cd8db31faa458b66

SHA1
9a86cec2c4fbb53bce6818c2a431f167d22c24b7

SHA256
de366f9cbdefaf30a978ed7714d725b9e8bf837eba94b719d48cb89022076a9b

SHA512
31f398cc619cfca42e0bc22cbde30f33b3b3334af4765c4a29b0f55ab402693162e71caede594abc4a31b8432ac4eb3c608cc6319b02f69f9a33bfbb1c942726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bcc0b5e497e1caf5282d846dbdb597a

SHA1
500f6fa500d341dee4d0853bde0e670a07731eae

SHA256
e82b6656d40b1a45d8b9bd1274701af801a4f5227aff82c278c2e44a9c7376c5

SHA512
eac8b3c14161ed8a1b75e9661aa454f30b5222dcc80e21d8609b7b36aa219ca9f8097ad57e0940904e7360f6eacf977ded12206e60628b0a2dbdabfa442e8a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab4ff65dcf4be86fbcef77606a02c555

SHA1
c1dc45195f6c33e155e231bff781308ad65627e6

SHA256
1761f7c23db004c47e57e4ccc4a5e00fcaf67d34d89ddb8fd19910b7a8f469de

SHA512
69c9d4f374ae309cce80febd1efa11b7944f748365c8add744c418e55b20af0acc49f22f5751e846f205750f8ebe796e8a757a70854e6c96848b27c1c58e37fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b418f323f951ab3f5a250f564571fb

SHA1
98fbfb4304dd8e3dbc6d2597afb109a519669bd3

SHA256
5393fdaff63db27001a9a6c3f683ebdef12bb94186e10f35d627b115ed7befca

SHA512
6ed95234062aeb0904a514ccc7c286692eb9f0368d661b42cbce6f1fa24049daae39e97825f8b1b9718d871966620d79afc0bce6e857384b881863d9505d303b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0335f9e2a47407c2a6e1cb60a0913e7

SHA1
83c182f39bd4679cce4da1a931f9fb6cadb8c908

SHA256
76b5706d13701fe1ac8c9189b8ada66924b5e7843514f52460ad31a1dd0ac5dc

SHA512
c18f8d4de1de619bd925a24ad5adb9c9f56b14d1f767208bab323bb21b2709942f5e31f747893ed9d725f8f77c1357b803a3774cd6f8dc4554bfa84a9c44f78b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ae1471709b261d8ed54627bfbe9d3d

SHA1
d2eb581819aadf68128fa93a1687d5ee3547f557

SHA256
69c1ae09f618a9b89ab6271dca5a3494a588759034d7ee93c62197a94bfcbcb9

SHA512
9d3261edcb01770e51968a0da89f9706d68c5fc5ed0139c38d64439f1a988a159f8d20241b6eee67a6753ca7235c4b690d5cf7d826b7bf1483bf0e0cce5269ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4313dcd0186ca95c3eb99e4eec9f30d2

SHA1
b0061442f62c4ce3f385734640bb5114131669ff

SHA256
c075d45189348df78cc1421110b2a5422eacba236b4964a6802e576392a910b9

SHA512
b7a3b6315ac821bb055c4ffa3e6f435f6bf26e0158436aac347a9d485e36fb9613b5f0e0b09ec550dcbb3f3ac60a94bcf1ab25299a7da3a61bdc3adc4f9ef048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8ad0ae53e91a69f6995a2c6e9c541a1

SHA1
73ba5d00bf2c2248120c482d75fafedbf90245ff

SHA256
783931cd105c233ee7066bad568318a84a4f9fbb8c3e51e50101ec636d4aec22

SHA512
5168e13e2a8385b5ee0cef526511105c21b30ce3a69c46d71fbb2cbd45d14a56418ffbbfaa29d7658dd606e32b0ebc0503361bdc270673201c9b5d3eb4ff3939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291345e67363b19f9cc4dc8d8527afec

SHA1
2efbcfdeec0c5924830f9ae1430fe2a1489f725e

SHA256
fa02d69c0f501c5b5c839ba021b69cd1ae414fa778ce044b90ab48baac320eb1

SHA512
c1658aae477c1e0ea7e232f577d4067dab13664c5cc5d9f25da654fef287ec7508a4a00d41bebb8652b631c7f8e15be0736c7bc2c9a8adc9c565c02890ef7b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ff1f2e3384a44702fb021b072e17fe

SHA1
bd64f1af5acbee20e554a3889268e3c3b12326a3

SHA256
62591646afd175e62490f0a61e1da1de01e4f5432172ac78bc8738b1e76e53bc

SHA512
70722212d2f8acd37f7c66f324236ecf619ee86ca1dcae56d971bcbc5db70906fe7ca27450250af87cc40276e588706d73985c1d8346c54e9448b7f6114cb60d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c083f26e6d4e6b4de06fa5e65be12a5e

SHA1
040bd0158095e563d931afd16cd06e17fff402c3

SHA256
1505ccf34c28b1f572ee7944f7f77bd4c4dcc75a6d12804bc02a1491a5085672

SHA512
d12323c26e700156670063d7298e4d560ad68219b2a8abd1b4d5658e6768671bfac489a5509166f2cfa8269c6270cff95f1ffd7bcb17a1201d2bb6bde509bdde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
826e6bfb9cbb7c826072a00794e4a788

SHA1
7620f2c0a83add499cea7e832cc96ca168bfc333

SHA256
3a1d6c2176aadb5dbe6cef06c76a137f70a9df267e3c9eaa275c08be748bf0d9

SHA512
9e3783244010e45ca9e0e33d044fb53c4ce630bc6114905de88e5d978ec7adaf744c00a405c3dc37db70f2bbec0229b35dbbd6a0a1a8dbb4bc38791b55164e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C81.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D12.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit