558fb12a4f47971f2a72494663f9a3ef573ed2703e9b70e24b3c6b0ee35b4e6b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

m5hqrg.html
Size

6KB
MD5

a52bef7f7f9695a69ab3cf69d13ae844
SHA1

07e4ec3d455003fc3cd0f77a26b1492d4707e639
SHA256

558fb12a4f47971f2a72494663f9a3ef573ed2703e9b70e24b3c6b0ee35b4e6b
SHA512

3ce0c08b597b1888b2f3a0f883c32e8cc2471067f37dd96f368eecb309a834e1ff9082cde3942ca16381adecfd700c28cd32f340de22e06374c2ca589a5a3bbf
SSDEEP

48:09peQbSbWbNkNkyWL7vNgcSILb38QHKFIaMFJODWnkgaWXVXVNil2TZNcQZ9FGMQ:sZNfv9SIbHKFdM0ykpWXVFrTBFuz3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50088afc7c63da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006d907f33516b43ffa4fa01a84f67729e1a14d864d876acb22d4a45ac35101f1f000000000e80000000020000200000004370957c1861174da3537840f89fd79e4c2ae143c2bb55088b658ca1e5e97ac52000000025901d9202ab8a5a1697ca6ee4a2ee9d5030d402e944ea29cd85fde4a57d2cf04000000066674053250f193ce028657b36f8d1aff3912cdbdde1a322e479cada69eda70b1f566afe72fbffbe6ac5a71a05a0f22fa182caafb56df2ef1858ad17b300ddae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{277945D1-CF70-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000498c37cd1ea23180d5a9d2a5e4fa70f4f7b350c0532e07a24f62d970920fd61e000000000e80000000020000200000009d2666224b36bc437cd623fcd04b4fc72a774ebe32688b2c56174b58ca361ecf900000004224852b8299f00348954d4215f0878b3aa8da0d342ecfa900537428b1ef63b7d9f78dfc4ca624629a88eeffb4e4e4d5df254a0bbcc1d7a9bbc67c8e16ea74369cfd10514d2b663f383f0614b67af8678a50e23bb6e474da307a2c5ee5c83f907ede32b30f803da9f464f42e472c64c30f1384dedda9ccbee45844682e841f9d366f60f553e5474cd506abce60297a0b400000000d22c5fa9d3f185f98943fb64822416561e3a23555f389c376545e106de5afc708a202799e489f68b6de6e15883d6213759c6944c042bea07d1de4880ac02b2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2708	2212	iexplore.exe	28
PID 2212 wrote to memory of 2708	2212	iexplore.exe	28
PID 2212 wrote to memory of 2708	2212	iexplore.exe	28
PID 2212 wrote to memory of 2708	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\m5hqrg.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1be415f4f06fb9b0cc0a7c764881628

SHA1
4805bb3aafd5ef523044362cd36897e75338eabe

SHA256
c164d4a8932c0cb8a9df5ab2cd7d5e285664f92f66bf4e2830e93dc45a1e243e

SHA512
15ba2def3c086f4a98fe3032ec76b6ab8b4b4bda4f6d4da7e6ecd5f4f9613c905e1b25e5bdb4d917058713d033ab1c94f4f6f91e324f99236fd7471c800dd0ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d716fe44ec981933ecd272c68b67b37d

SHA1
6128a0cc71ed99927f64add41d64429ae39984b7

SHA256
ab9f83b60cbd8fcaaa701244cdab50664b70009c88c3fac8d6eace971dc84300

SHA512
e8fc0fafc9f0d37c6ae48733ce4e192b54fbd8efb5c448dcd9ae79d579241bd4192c9e7c3f36c51bf2aed8058caebf8374c48c910ad42ff80452a399c43f0944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5888383a1813b7e20bc22e635bfcfab1

SHA1
e930e2801a458c855d1aa1cb736d990ff9a60ecc

SHA256
661fdcbaec60fc8496a3f2b5fba64239d056cde9d4450f0f298b2c46b275cdc8

SHA512
7eea40f583122fc875028c7dace1f6fce65cac496ecab0e38413f38b9f857ca7ffdb0c8265d67296c351a87aba592189b67b092e23f1308c92d663d36facac2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c8c354ac098745f85aa373af830b7f

SHA1
93488e2f92d9387fc9eb92c4a40fd06506ff8cc9

SHA256
3444cc58c69fb1a5bfeca57e9ea0d184c4b22863083174f03077f099e3e801df

SHA512
680ac27550bbc6b11d5fdee6e30b3929eafc049354aaf18b0a644f0fed5a6c7ff6188eb833b3e81297009de34fcf7bb8d2cc0d92ed8c1a5c1d79921791a42764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c67b026a15efd5615cc6438b3e7aa18

SHA1
c487aca714f3af4a9837119d64034425add78b1c

SHA256
bc526344c7329da45ad20cd4616ab8b50f2f8af969dd7c5148f993ba6666cb54

SHA512
a8f6697b25f47da5fd6116479677c2603cf958da9c8f70bdee97d47be9f1aa4f6dc5821f867f6d0148ae4319e4129e8bdb2db1df89e1ae3f192911bdd33b166a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222e1a3a3a5722872e2b46dd838f3983

SHA1
52bc72482689f009e7e39472b470d417d62a990d

SHA256
f40ff73f53dc8c60b2ecc8c4418be52e2b9cb1fbeca30cd142c84076526a7189

SHA512
2aa60dd4621a0cf5df09f2913beb15a1ab412e26655394c1f45dadfe2726d778787da020729cb04cd22fdecf1d7064247ad50889ab997fe0daf37c2dd1f371e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df072ff5c14ef5e7497b8bf4138ee674

SHA1
2f79a8705d54a1234668adc6e78fc230b9db7e5e

SHA256
4eb50d69d8ccf24bbbabb63a5427105ab72c47bf8b465bb9cd7c5fe6b027e590

SHA512
c92f9df8dbab991dc413af2e9835357f846ab3cbfe7e1c7346cf435dc8a1ca59fcba35d65805e2d2d639bf0c7a45e9db5a052ce2c6be247ead3bc27a92cefae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8504b8970fc21d31073c6e75f0ace96e

SHA1
d8896bd65498899d9e3848cb873e1af734394934

SHA256
9cfcedb6df137aef8e57bbb2f20793a7a7ab9da794a3e096055f29336642e0e1

SHA512
68347ebdb5cd3612c0888c24a6a020cb99cdc12cd3c2ab5df36b61f235aeeb48b100a7a125558a8f1c57ce1e3c0819baf514d07f25f3f4bd6efa0fb951c27772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cde818c7547e41e16e02e7ec17ef10f

SHA1
5d986a071e21f15bdfe8bad725b6e9014e6429ba

SHA256
3a916fa2f4743a0fa544686d54627a4b4d375232839cdc2230f72622f9bddf31

SHA512
1b2ffb6f34abf53c3714f29bb079b082b5032f557e5525fe6c8c552707d80a0fc24ee91e4d51c694acd3c50dffa937e11c354f0b479f568a35e0198c8b934533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
128a4c375e4f7a0c79283fa4c1696924

SHA1
a08a1e146f61cbb6548169c5fbefb862076f3a3e

SHA256
5d6b678a184ef9f9cc736f53e364bee08864c26bb34c5a087828f3743189244f

SHA512
99d4a13583337e4b20d3ac2c6fe27a1273680614be6472cb67ceb9cfd94f258e66c598586459a01f684be7ce5d61bfc386e43160900c71538d431a8ad8c14ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bd2adaf687bd994fc4f8d5a0f1095ed

SHA1
4504617d96a732f17d5b206495b95798fb4c839e

SHA256
1c250195e3eb5bec4d49d466190b34b91ad47d1addcae32cea7a1c8f4c51cef1

SHA512
9ad32b91d165c9536aeba6ae2a52ad5d303c5e556bc15c76abb1a37fbc1daad03d09c524f93d2c0fb56acf29261132b3b93d3b5f5ae399045d5d70fa5e4c92fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4953698b2ac9966a83dd820b1cb09945

SHA1
ae4cdc5cef55accd5a22a95845a67a54eb71b0af

SHA256
e0156452ddb16db41fc15c10c26bfa5cd55e73d320a66e036b079e65a62bde65

SHA512
c933e5ce8876030811fd82bc3c225825798d5be8f3d0cc27e0859f0a7e12244ef68c79fd47bfd2d145bd50983efd2cdae41e3e7c8f1f2602875e51ecf1dfe077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411ea1b5e0187344986db9625c7aa1b5

SHA1
868a950dc9623ff1f0d4c67f95834c077d1a9b45

SHA256
a976fd6a0e10787cfb6c199373be096194047140c38d40ccc885394203e9fcec

SHA512
bccec9f0b20948b07aff252d044cf54339d5ff6f6603f20479f3ba814680241df4231eda4ddc194682891870fbc88c656b1a8da408ad24430744083199a57820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\favicon[1].htm

Filesize
1KB

MD5
0961eb13ef799b1c1f2a335965f343bd

SHA1
5d7ce0e0c0137d85da4d7ced88bff2bdba80ed20

SHA256
8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435

SHA512
554458650ceec6f091e6451ed3eb46141d98deba5cab9fc54c0b956b90939caf5d846edc6ae4d368d88a964c2259f5cf9fcadc8f7e610b30928ea65af9b5c777

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7967.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79C8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFDCC11603FFAB0AF6.TMP

Filesize
16KB

MD5
6a7f1994cfa8d7d20e1decc0dec8587a

SHA1
ba3d72adeff9d74c1c6f0a7892ac8d82e21cbd58

SHA256
beae28c5d2a284cfbcf93faf99fd8eaed69491ffe700eb0094b7de0e58809473

SHA512
8c6a4ea178f109f415e026b02c7f0712494f9eacf6882c89f98d3e165d88c1f315bbb4ea44a521514a9f4c6c345a181e9795769a58c8a396d35a1793cdb45b80

Download Submit