e6f96ac54447b30e75812c480332b025bc7fb9d059ea1f5aa9bc3c4dcf9b4659

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98bd1456c9a7287737b4bff323666dc8.html
Size

6KB
MD5

98bd1456c9a7287737b4bff323666dc8
SHA1

da5e439352bdd0bf18da0404b45586f8e033069e
SHA256

e6f96ac54447b30e75812c480332b025bc7fb9d059ea1f5aa9bc3c4dcf9b4659
SHA512

d5ecb4c2b3238e8c521c035784fa6f42fb3569ffe644cc58a815116c9f3bf008cb488982a71c653d6c675a229f082e35627a75f43e3bcba7d0aa6b47d84a6c2f
SSDEEP

96:uzVs+ux7trXLLY1k9o84d12ef7CSTU77cEZ7ru7f:csz7tDAYS/gb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413968412"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BC30EF1-CA3B-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000fa59a787cd8d60ca12c1fbbb3b5a8fcad291460f84e8fa39e5090d87cd991638000000000e80000000020000200000003e6516f7dea253a220e0b1bece660a53907e8f350f2f407810a822955e116d9920000000bc18eab022c4df19fec76aced135596d977b624ded90139f16e52c1be8a8196e400000004a6ab2380d57063c12875fba3874959b443cba4355a32cab708373790082fc949408f573ccd08b013552680d5e5dbd226b126afae50e572132d0b678267191e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04d03e1475eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d44a557ddbe21993002b18b8f1ce4c5c5d73351b15175cad5177d26b1e8c3ee9000000000e800000000200002000000007afaf929f1415a61a6baf6c559dab60c799018cf84a8aef3cdadf5822d55e1a90000000b367e561a85659d8e971d40722fafbcd48eec360d226578358f4c5ba6b530b699e6328ac64050571825cb9d50e8a087f9a553d8ea5858de49efec6d6c49ee4974fb7d39430a232d30f3f84a8e6bd8296de34e95da09410984e97fa6f29499bcaa64d130614738f18896eb8d10cc2a045eead952f28edb274cab777ccc212480851e82205a755828e497b67ab2af16e374000000073945ea4f2ba46c68292f94de7ac40c2fbb6c67055aaa00f45971b4660aacd6851a9dc7e4a53e62cba59aa42a83aa0c06ee27357763e72add221a7a1e7edf636	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2692	2444	iexplore.exe	28
PID 2444 wrote to memory of 2692	2444	iexplore.exe	28
PID 2444 wrote to memory of 2692	2444	iexplore.exe	28
PID 2444 wrote to memory of 2692	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98bd1456c9a7287737b4bff323666dc8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8161c6a7cdd6b102b8e4d0f3ca6c84f8

SHA1
9ddd7540c7b60c9d0272860c6402e7051304e2e3

SHA256
25917959a59384ece6f5088a673a351a0f2dc403cffb125a8eae1a34eae2db5e

SHA512
3236a3c7373da8212dcd551a34846e03218b8ecfb5a47605fa2adcdbf7358a66e508e7a108ca076ece462b11172ce34d18ed0e6e8e2fe5fdcf56ab08a6a1b5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
144178b48815e20528613fd0430ae54f

SHA1
1794d6d1affcbf4f23d20c6d60449ea8455490c6

SHA256
6634293be7e553b5aa9871c24e85c62bd6db827d1c666b432e35af774e769a7c

SHA512
2f8b0eee1b4d81ec201d16c836296f4bb2205e32e0d5b982f537c983cc46e3b34f4d8324dc85c72cf690521faf01f5e53d18f8150b3bf3a87f942f47f8ecb866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a3ad75b864e16ba0f0d52db4e58cf9

SHA1
2968912351d151fb369deafb33e2f773b1a5399b

SHA256
371a6c2c4154f56022d1ada6516c0d9ca902f0371fcc6bb6c85fa375a76a1a3f

SHA512
39b49e1e95e8a59100f4b00fbc5797374be2fce92b822ad579e724fc6e16d9402f56fa166e4b841b434d3729a4c3281ef78087f9c0f1bfea1ac71fd98aa7e64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a2f6dcc5bf4033d6038df5524d08fd

SHA1
e4bd1b4168e9c193ff28606b11ea5fa39b0f89b6

SHA256
ee4bbef1a4c67c8efc62f7304547eeaed246e4be551fac909b4b72aba8444944

SHA512
3d4aa5aee376ce1c0a43fe9f363a238d33df3f447519ee1cdd27dad24ddcdb07e0e351bb650ee7e8747621aa585ee04af4aee1272eb585d7cb3a76ff09538794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac45aa005e6f90199890f2556c9843c

SHA1
85c2cca1ab8939606a2084bc5889e6b2011d0f89

SHA256
e71dcd6d138f30583b75bc37ba92dbb695e86458cbc9f4819338e5a14cdf1a79

SHA512
ca99f79a5ddcd5f3f58e712f0a997a3bd282072002b57650004335f8c66bb8a6ff6d5a8e6957265d3d8cd255fdd21ad4d0220d2f6ea65b059b1252485d0600e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec02ca12026490be97abd0866500d27c

SHA1
f2899fe2313e4357c78e1a56aedea2b02d35cf41

SHA256
415ee6e6a8b1032022ac51a3b38ecca06a1aafbaac07e8c21a6ff9c8883ab073

SHA512
3d0b585ec08e16d7455e852992c845e9b61989a731c41cbe0765ef6e58bdce1e5589baee02140e02e88ac9f334d1ec592cd077bf305197c590bdadd8d3abe86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
063dd5630893044324b34bd628c88476

SHA1
157700e0be7dec7170a60e7bab75f361c00f1a38

SHA256
7bc44e154234483bf3c23719bf5db30c48b66067488935671108fb21ac7dc54a

SHA512
a62d563f88170697b3a83669c04ca4ba2294302e8e8c06f567d09d9918ce607f9ba2c1407af6425daa683e54a720b164270caa9267261344a9b1ac1cda67781c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a02039b61fc0063c860d8f493c568521

SHA1
a368feaf0ca43185f9a4d9d2167921514e58f29a

SHA256
13a807c2de9ea306db63c6de6344c971d403602763096323cc076fe91141a8c7

SHA512
9df36d5c65e77cdb43c06ad31011128bc6f40dbf046c349b864a8e40ae49ac28359db697a293bd66e99e6ee538f3d26f0fe9c083e760fb7eccf70186746c2e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5022a3a5ca8b751e83cde554e39931b

SHA1
991325d9f31a45ce3b40ae8ce2802db57b51096e

SHA256
ee611a6bb9110515915d8063824ae503bbed575f68960a17fb293ac0a7104d71

SHA512
6566534d337191ddee2c77f3b0f26a004a619ff94e25b61dd8cfafc4fb4b1f536ffff33802b01e50e5ac9b93bf2fded77fd96f5e3c664eb3194d383bc7c4d7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab261ae7ba9d11c3f6a9e8400183fe3e

SHA1
bf6acb3ae7486dafc11c9e7a02684abca6db8417

SHA256
d146d2d8acb78d3319d0ca986388eb37334744a59e6f2116b39410703996ba0b

SHA512
dfea54d93230a468fac95890cb60e57c5b1dfc755a5a6ef294f7c26d33811dbd8351116f92b6d13f97438cc048fdf30a9b8df98e2eece3f5a575ba7d4fe8c422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f635c489d0640729449c1556c36538d

SHA1
f60902a056021936986330600b6e180f55263540

SHA256
95e59d3e753bd4a757612127508914173ee574fb00d14507b3ff2e0658c32829

SHA512
40e793872e5ba658b90f99ed2ac8eade9e6775d1c0b942c22660f3f7c03b825b5e6ea68029d8bacc2dd8daff0cb05563318040c7ffc190da4211017365629937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab8913b9c89f8e210ff119693c77ae27

SHA1
e153af9b739a2601dba13fcc08ccaa6834619fdb

SHA256
5fa83351570a07173e075d08db271e9b74cd0d838a24712ac0315f3c92f81f32

SHA512
4c655e824ebeb282f5098b43a2e68bad30d9e6a469d8115101063af1ff08af028c95c2997843fd131ab623a9e68e5e434a399d773c0e39a2ce8669e1e9451bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64e8deeb5381a318a9e161262956242b

SHA1
22e7b851d6d15fbe4e64aac5f6a0ee35189125c1

SHA256
fd167c864d598d7812d00a042f49ffe5a900fd6dd4bb6a5387de4a459e43d0f3

SHA512
e8b5dd2f40631977d6d342e80dd113576de0807f6dd6dfda0b7c93d6ad895b4e7dc7ae1c9a78dbe138c2476cc3b33e05285ea8a70899004dde8180a32346108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3088.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit