7f6310f7b302ff1649429d9c5c0d97ea203141b7ab30feba1b7759bcc3c17c49

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

J2URQL5Y.html
Size

2KB
MD5

48149696a8c49ae257c3638c23b6705c
SHA1

a4fe733ddafa1238ea2990ad5e8cfa5f4f223e6e
SHA256

7f6310f7b302ff1649429d9c5c0d97ea203141b7ab30feba1b7759bcc3c17c49
SHA512

df319131d3f23622e4bc3d7019a683952ed9b6b9e50c3a9bf6eafe35a51c44c354d317635585dead1326b7164e5a0d13f3a960215d93a2189761a7b391585a82

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B58EC7E1-D2E1-11EE-BDCC-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000002aea7898a1fa5e7980c73355d445226ddde8090429e36646dd99039980b6ccd3000000000e8000000002000020000000dc207202f1ecc3cb69ad63912bbba797ff638414294bb4cff4802b41ffe6ec23200000002b13c660cf45cdd88456c3e42b24bb4722ee830bae89e6b0a47339991bb107d9400000005a55913c2a79d483264a4042bac9d3751bff5cd38228ef71f5dd84300e0ef4d7e3d44f4961346edb8e3316f40cacbe0cb19445bf3b35b2a48490e18eb23ab39a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd0000000002000000000010660000000100002000000041821979de3bb1f8464d4502d92d68c520ed74f00d79e683321e95cc40fa0a8b000000000e80000000020000200000008b68dfc6c904d829ed54ac9f166a92624370e5d39bf25d1c9c619c37598a1fff900000006de91ce058e06de6f53c15bd8308152a58007cc35b4fea4cec2b87f39fc63e3eef16dffb9dc95dfa966a9afa5ee420e297c18ba9275413fa70a7eba390382646f2561dba0156f518837f5dcef0116b57c6566f7fb991ae364c4c2a89196a6438a2382b84ce27b5cbbcdb2a4e0bda6d22d8f49019f6469d43fadb4211ed758e55d866d166f1510390a7d60cc7a54b242b40000000c8c808a4db849fb913caa9f588511d5ee04d046befc572dd189cb877dfdabe8d7bb42907918b29ef44d69cb0a1b86c08d3dd4ce4250891a799c4d7d19b2a79ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0317b8aee66da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2296	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2248	2296	iexplore.exe	28
PID 2296 wrote to memory of 2248	2296	iexplore.exe	28
PID 2296 wrote to memory of 2248	2296	iexplore.exe	28
PID 2296 wrote to memory of 2248	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\J2URQL5Y.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a1bd3338570bcc46bd68ad9e3737e2

SHA1
0173b25e69125b83ce6739764aa7c7eb950a8294

SHA256
232189c6a60df5390e4f97f43812641be5b100415564e3fd9830ee9d8fa70faa

SHA512
0b1c331cd34e28ba600a73035f4c7b3b7952c3f40d9ce369605da1b81726691abcd10cc6ce5513a816b3f5df5cb8948b4a3bab02d4743c070965a02af0a826c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a02fc28823b38914edd6a11a845339

SHA1
8c362ce707be5d0730bbde30d30f2978a32c3784

SHA256
a6933882102c396baa715e4481c21c8d4934fa7446e538a1ae515726df8dd8bf

SHA512
94f277376ad63346585af4840764347c1338b3f8798dbcc3c7c4b7096a92ffd2e2646961bcec7e64d243b0168413543c9105b854331cbff0f59f45e024ae9f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341ccadbe4b7b58aa7c608980428ab27

SHA1
2a8c0e8b5a7bf6541778ab5cf0cf0373ed71ef7b

SHA256
7110250146b0b38d6efa9cfb418d09cf1c573db5d6462d784a7514a9ceb81108

SHA512
c13f842a846f09ed44e33c03feb21c31274eb9912ba320704f0fda15408fdfb9e23afebe2e870bd70a4ee1c29a01bdc2a4ee53349ee3bff705f61c56dedf7992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1f15bf65e57e0e26811d5411975f4b

SHA1
cbb6095b9997aa98da1fd8573c40f845fb5a6c20

SHA256
887d3a3570ecd422e4469b3fe4dd0983fa982594e7f8ed02ab837b0b3f1d9723

SHA512
3f029d603f86c771dad31317795b1f4eebe4cc038dc6f7d9ba5c807e192d90ab697e6e74c2577735ed1f0b4a9784dc70a286125a4fb5d117d64a76895cad13f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b91c926894cdcdc9c0f17b05a94a23a

SHA1
2589cf5d5111927cacafcb7fa139a49f969c6e3a

SHA256
8db59c203eea2a298268179388bf008d229991e86dc581a3e41fc29c4470f6a9

SHA512
6a48df04c06bd2accac1f19bba54e6ba614773c0d4379c7387bd59ee4793e2ffd95039856ec39fc7c87a240d0684678e20563321abdd092b638293b86ba433d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ada8004e51e676d0c4df2f2d0390781

SHA1
c7cfa84d476475bf2ad4091cee4029f09c3ab3f5

SHA256
4d3982660b273adfa8f53d4b1ed4a9b6f3cc88e31a5606e1266188e6c2e07337

SHA512
165adce11a795e996afb7d2fce4e44d998db944bd283923709a51466f6a1947162b12fb35d8f9d7da889797ecbc528085b7233373cbae487210e59437e6ab223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd54bef9033335b471564544cf89dba4

SHA1
371567d442e88bc0eb51179000c7539fc3971e9f

SHA256
e451c8946a1dfd87c791b5e21ce7fda09ad0bc042e6727f1e5a81a8231a08ee5

SHA512
7bfde63e253a82aa7f60d08b1d3e81c5de8c5e89886c1160ee0bab827e1474030711e69b3d44211fa0c952ce83677dd359470452b5acf5ea27916a757d9fdcf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59356f7aaeda2e544d565780b1c97112

SHA1
add9c4884b422042656a8989135e728a71c561ba

SHA256
01ccf33194325278888be486df0fd561ac4ebccd1a8396356effbf44d6e3b603

SHA512
60481a31d571cc37201a8a4db503cdfa4b04a66568dc58421729f429fb5f943a45000dba9ba49831b92d09f734af194efa47fc32fcbfb3ddd4d12fce1f8aa7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c22fbfc7a7a6b4f48a5a58fc68eee3d

SHA1
3af37bebd993cfdbfa1076edfeac43aa8e2c060c

SHA256
96b1f1abb56213ed73ce1ccac1da6e4abacbe737db84e3982f05a2c550fd656c

SHA512
3c5b033f2218df41df2fa3d42c24eb31da3b7a8fa7c5dfe64a9a851532f7da13aab3c69e776c88613e7e7f2f4729356b72dd2ab0d919920d65cd865da68078a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5775.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5872.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit