cfae053f993bbf14ca134e97bc148c7f457494f243e0539f0827c838582fb350

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b43f3ab0dfa8efaa428017a48952b5f6.html
Size

4KB
MD5

b43f3ab0dfa8efaa428017a48952b5f6
SHA1

1952a58c2dfe384276337dfd860dc16ea9b24d34
SHA256

cfae053f993bbf14ca134e97bc148c7f457494f243e0539f0827c838582fb350
SHA512

4116c2386dc98afee802d81161add73464a38ac11a78358c4de39cefe6da6d166d2592d15afd110d22cdda4e3e2e4d8e00a143c5382d1576b03d21e2d5edbb1f
SSDEEP

96:rf9seakGiwLsvfpFFOxUExR4vBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaTvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415788900"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d63dacedde42d5d490eb32541273d03f723357a5b08b11cf12160e0164884063000000000e80000000020000200000006d5aec8bfd175fe4db0d404f544148c25fb80e2cb2422c61384d1c96f167e17a20000000c0fbe5c7d89186bf181c61aadc792678dccd82e732b361ce6a2258a0f370bb124000000082a794d081e10e8eadc564e1b63b60c593984526623fb6917ec989c1eda3079ae8c0445cefb097133cffd032a2f18fef394668ea4c0e72be32752839cb6f2325	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B27D4D71-DAC9-11EE-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f6388fd4aed9ef4e81834ec57272fabe530bc5a75a659b2cf8046c48f91ccb85000000000e8000000002000020000000dc9847de8b5313eae4e1729873578f5b7720703a749b95db48da91f1f36dcb6090000000ace238084a2206d0bc266cc1db803b9cbf1d930b0016b3192050309a1f76eaa2a7c08f417fb7ee3899de14c7e1e093526bf57115c582ec257809653d61c9cff7db31b4e7fb98e6bf71b5381fcbde47534e37d6f17993edea55b290113648b786bb1dd6f61706734831500d765d7fb3c9215e1c5788e58e0593c9ad1c00d36cb7a822239c8eb259ceb795672500c8455740000000344aff3de13a14fd9c521d19ed6a3b340e96c474a9d8f8e0d7e31d9a3486e4c1a7eac7b392a84918daa3f3961bd4804b342429f18c944fb32fd1e63024064c66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0df0b87d66eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b43f3ab0dfa8efaa428017a48952b5f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddde4504bc7f3bf623f78c4b00e3ecaf

SHA1
166c554d4784f4b57966c7fc2b10cfa57f8d25a3

SHA256
b6edb4a02b5b37db80fd6fb75704cffe3b65427238bef47faa8e953dac20d77b

SHA512
4fb1c633c4da66212231cef1258439037c4b698f57fea94a4e8d4283568d790ed64c08513ea99713ea5daa92546fe1cbb0c6db68fff26f6ed1f4d82fae9f1774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0820d58141254c1f5010d8724a866cb1

SHA1
40390e14aafe6012ad5c75d3ae16131780c7cdf9

SHA256
d71bb868feb97f4627b05c505d4a304def210f6fb5a634fb0f10768399a3e91f

SHA512
63f082da2ea9267618cfee6eb12d9d3e13af1172e6da678df7b8ae4b57e6108fbf742e068bb4aafae81f2b93b641ecb6ac198b675f70b57509ff1723c7999f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbe9962bd20ae5750a93e31e553264c

SHA1
e4df542f47dd44226b10a52e132c912db4d624a6

SHA256
ebdab74d3747915f677bea208edb2ef8262eeb266e7a055cc0b717a860a00f00

SHA512
71ad1c12e232cf9b5ca50f5c241289251c057335d779cc62a66c5e173dc718f95e297431b34618c144b9d7d5d10fa8835ef59aa377a59985b82a30216a8a685f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa14f080a3cea8fd67ddf1ea34e70066

SHA1
1103ddeef956fc7a20630b45f14f18a643c3880d

SHA256
743ad2b7bb57e97ed49b5faa57fe3f76c12d4dcfda62aa44a20ab11f889cf0f2

SHA512
104a63c8e9668ba995f73376dc784f198ea4a0b175e9f39c68e86196d2761e6a81d10338ddd5536a8dac55768a3fe0df236ba00e6f746cf9873e27e33c7ed9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7917cfcd3a862ff101d06ff3cbe0a326

SHA1
652fe7a0b4eec424f7c07e95610d9ee78338470c

SHA256
788a18a8945d359ecabe02f0378a9f37f3e005f71fa897483dce79190acfd422

SHA512
84d424ca9873c783e511d9fd6a0984ffe61ad6da579e38cf2c10769501a442b611d411a02a7a3366f42e04457c67e6e4afe28a7c94f8ed019ac944bd6822e764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc006fb948532095b83010fd84b3c185

SHA1
40423187a4a97129abeade41b2a611971a3bb21b

SHA256
7694c6f8717fd8fb84854f1c275e0c480e9dbb51f7a97a88fc4cb7ad6f8a6924

SHA512
d7a366995f719e223874300a015efff2c75eac869a4e1073c9778e222d3c1f4288d8c819460c0ffe89fc898a533cd8a4548b11c7f6d66222dec0333bec951bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0595d8aea9c61b0924623cf1e208b2d5

SHA1
77ddbe0c70b44e4eb5d626f106fe31b64b95aeb3

SHA256
3b98093f668d5d4161662b113aebd1fa16fa3c64182007a25c2d2da90ad7f2d5

SHA512
209e909475e8aff83128def917ee681939fde968a7b892b70fdea878e9e2b29f294786cc6152d652c06f31ad46f15aaf47f700f6bde790bac3e9cff872b2e6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31CD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3389.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit