f27568a879caead76767488ced2c880fb037ff4e22b16ea05b7dcb0e6a43df7f

Analysis

max time kernel
138s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a22c4934451cf37ccbeadaac157311.html
Size

52KB
MD5

b4a22c4934451cf37ccbeadaac157311
SHA1

d1af67581ad3710442ebb249da680e2476966be2
SHA256

f27568a879caead76767488ced2c880fb037ff4e22b16ea05b7dcb0e6a43df7f
SHA512

83a3040723a5ed9628a9c5f47d62669edca3a69ecbe9a720405608b1acedc790231502edf57d800ae53cca8808ef55cda809a457a7cc1cf88de7f339e3e92f41
SSDEEP

1536:JIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZKS0:sKSR0gcvvUy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C38D80E1-DAE6-11EE-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e60599f36eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000caf39b2869b3eef41a79e86e0ed70594c14e30a0a5462359191ef668b6273a8000000000e8000000002000020000000cc0250f62f3a1225f88877313fff111e62d2dc2a5d55011f09923a82eba23535200000004a58de4853bf11af2c0c9dcd7145d1a430225af45430b571e62a5bfa11baf9cb4000000068c791ce2896bbdc9688fad021c900270e6571f0e57ff25cff71f8db837f433a8c19d510f2fdee2fdd784737ef7db2023f611145f0d0a7e9a9db27e937f75b5e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e2493814b52fc6dcb6e6f9063e507185b4b2e4e97e83dc49e9db507169509ae0000000000e800000000200002000000030b2391187b24f2cf88bcbe2fc6ef27e2380b5e4994b6751ea3d6ceec8090e93900000006f0310c2385670220662f387db67b9240ebe6fb566353822a5d3393e6b1c5b1d366392c5c752f9cf6f5446fbc5e075a4dae029b2b23f3e88334f1e5465ee284f45c197580e4c1b98dd5e1ba9626b2a58ba8472793359946b77f9daa34b0ab989c62dd07aa24afa8efd11fb6900d1eabcf8e9880e627fc0d80ddcefb9998f7627bb1eb51cca46548e6bd5f397eeee213c4000000036b7c3e5ae3d97263d5e81f9909037f8b2783cd933d8c4fc52b6b4bc13805758586e59b8d4347d87fdbcd2cc7c917d2c94bc524d511330cc99fdde0eae07c893	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415801387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4a22c4934451cf37ccbeadaac157311.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b75d0795f3178dac6c641d9eb0dbdc39

SHA1
6bf5a7c6ec7d7587d89272768ed186a081591ecd

SHA256
c2267a445b380541a06f888efb9b49e6f318c74f6d457ae13a39fcf738033c0f

SHA512
b76969635d7d88ed9ae77726b770607b30f0fa0c61f20bfd24c04bf38c44729d749a7036caf75866dd8497a4afe79575565010ff0cb74b0e9ab6783e3bf37819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
996fef8528dd17f1b924ae70665d41c6

SHA1
d2213958dd6b77e359770def1d2f942f9a3bd6ff

SHA256
4d02ae70912f501593729642f375d31151c2493fc7b161ba59da9137be403665

SHA512
68e69ceea620fb9ea24860aae37ebeee0d333382a2f1984b096b5a1ce3b906966a3d58e57f721d6e32e9b8eb6ff2109002e2f0fc794176833694daf4d552f7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d3c881b471f8b229011f3e13818aa33

SHA1
a4c500472aecf4dc7c44b878f60a072c3d653b63

SHA256
1a3f3b8f1120bf451e7f1061661920c42e1db458ce79cc2e9578ebf21aaa4a13

SHA512
490611aa285ade6b688ff6356390d6b0f0a0a30450770f6c4402ffea8e9ec15bc61dff1aad6500606b9f75fe169e0ca8a40122ce3734a2b5255932801b3854bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6501a79bee9011129529cfb8e6c5754

SHA1
8595d317852c7d667b7c33145b306607e9879e6f

SHA256
39440afaa43d6216dab96b0d617fe3b0a2065c3a3923085beacf1127804127e3

SHA512
3d19361750fae489d61f8922431bf8c30f8d3d5d6ed7fdd8b97a67d73990c116f8b8a6e648660034890d4df0adcd15763a375195957a38b64aa9f686cefe3b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c06e91681e41b358fe71ecca7b11dd

SHA1
6da9db1704b7e2baa8f5830215d7bf137705bfd3

SHA256
232ca9e0af189d9159f2a5ee1b60100bf27119a7b6265a26e4178274eea371f4

SHA512
08a5cf518eade651797ed83ca80f799f08d88c71c231f0a5e50745b2d3800c939224df23b8307d5c9c3b12c8c43962b2b45459ae964560bc9e9b09f9101acace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e65de2b52ad4bc745ac0d10ef38fa8

SHA1
9ab7a2757b7afd57d3ee4341e88991e2e46d1d8f

SHA256
df1faeec867c1876a195ebe3d3752820932bfbcc99ba3e8deb4366be31dc9ea4

SHA512
e26deb02c56314bfed4b6c018f3774244366f8274c12d0fc975115ce9368d8bbc4dafe80dd21057a8a8994243788bd269d89ff4a301cbddb9f9631dcaeb677f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab669dd6a5f9c6094a3af38f066c7ad

SHA1
07de6c29525ab8d11f17b3e1d4edce93a57e731b

SHA256
02daf8308443e0becfbe0247dc5d642bb963ea56c92e2fb9087441aaa7cddfc1

SHA512
39573bba28ef4412957b7c0a3cb51e61ad5a8ae6a1835d7b347d41d7abdeab912b8c74b3bb8fe1eaa400cb35e4691daefb7cac49177cae4bcafc07c67478bb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968079fe45b591cf03d4f99751a5d795

SHA1
bd6372687dbfbae9970c9b48a14aeddad46a8ff3

SHA256
ca778e5efb3a7aec9486ec95304b1c60f625ce75e9ef493c63a4f3b16690ecf8

SHA512
947f8a91386d12c843453fce02f9e11fe2c1b7df2f2ace89275d36320619b119f16239285c534d44d5048e793cf43ea722ff2a39287000261b74c8e0814550f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da0806b8da1d731c0f9dcdd43f3946a6

SHA1
a51e43cda786b34c7ce6ef0b140445a79079afc6

SHA256
1f8e3a94ab0f688814c9937539e508d8cdec3db1008e8ef3a2f9338a2b72751f

SHA512
3620cb999ee32d98775b6b669b43bae1f5d58dbe416d09a6e2a76e7183da13e3339ffd80604cf2125f95c9c5d08156443104daa0319bbb7cad3a66102f6cbac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09cfc52b478b38712e7b0eba168dd37c

SHA1
7bd82b9b02b6c76fa006b034f02bf7fdaeca36de

SHA256
5a40ea9b528db8431b239634c02f2573517e635d5d500ef41517c477218346ba

SHA512
7281cbde02c211d535acee357169a72359953e41c0b766f9beb84260ff2f23e0d321949ba6745b2fc95b570194534d68e1080a7f219aaaddb73abb87501d1f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76f5fe1a20967fe5b2b852c2ff3ee9e

SHA1
3c473d5900cd74d5b2606fb93d7dd9931133ff4c

SHA256
4114679e0d16c35709301b541388650ea5fde3365e6abd2a15a9b093527f010b

SHA512
c68c701cf6a4e0a9bde231a9f213dbce6fbabc1f7de0556972a567f667d91ce18659d1b125ca114af28b3c9860a1b7ee686a75d9365512f3201bdbc7c8f3f140

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E8E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit