e452ab1da57db91b8a11da8ea3ff6bc967a04400ed2802ccff20e8fff8a68cd5

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4af3b5d0c76255dbeb69b5e62a4ead5.html
Size

53KB
MD5

b4af3b5d0c76255dbeb69b5e62a4ead5
SHA1

865f16d065b31d6cdd0065e94c30656b507cb255
SHA256

e452ab1da57db91b8a11da8ea3ff6bc967a04400ed2802ccff20e8fff8a68cd5
SHA512

f2c926b1edfde79a7d3f29f9c5ae40cf09ddb9978bc1f2804126790d81e7ff512851beb9954b68cdb115fff4277c977add5ac7e8ebfbb33fb4d5f872027217b3
SSDEEP

1536:CkgUiIakTqGivi+PyUWrunlYv63Nj+q5Vy0R0w2AzTICbbnoA/t9M/dNwIUTDmDi:CkgUiIakTqGivi+PyUWrunlYv63Nj+qx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF8EA711-DAEA-11EE-A099-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415803190"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000017395c6fb3ead84ede6a108c214b2502ee8dcd2536cb3d9315a67fd11651a5a0000000000e8000000002000020000000c385607ec76404f0da7c51a76d8d553dcdb44e96a16026dc2547d662021634ef200000000f80ef62aad32f5f35ee63a7f14a8fa18f3fb4008d44fb41c2b1c2854e7c6af840000000dbf7c8117453ac1597e8b73819f42eb37f189e50eec3c826766a4629a50b322bab04c8b63a71686957c4c22db1e2499f7b49ed613bb43c7b543463b85b2e9baa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01552ccf76eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000885dd1689bacf78dd27d34226dc7542d0ddccea5c19b20c6e628eb111b7a8266000000000e8000000002000020000000b43016db4146f31d4209a0f3f9a570b3cf2ca6262a4c63d34f3294a5a55cae1e90000000f6e8b1b070041db5a127aef5aa1d790e23524b0d266583c2cd758093f5952bb5d29f58cfab2e6d288f55c5ac15925bfecf7a161918c3ad251147b56baf4d109388416b43db9571da571122f9d69071acbe7babe266b03898aaef740332f4e658f0754b4e0fb141ed35e275c552afc1c18879c814b4d76cfd6caa3436a690691777c9586c127b46ed75b8eb15f015ec6640000000ada78b0b3631d6ab135db988462d5da47442345d2fd28d98ef4c428ab9f491f5cdef7afc5146f8e1457ff77c90df7945f14ba742d90c617b8e5ce894455d22d3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2128	2332	iexplore.exe	28
PID 2332 wrote to memory of 2128	2332	iexplore.exe	28
PID 2332 wrote to memory of 2128	2332	iexplore.exe	28
PID 2332 wrote to memory of 2128	2332	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4af3b5d0c76255dbeb69b5e62a4ead5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19b0860e68c8753c11868cd24a3afa9

SHA1
8aac32ada4c0bafde8378a4317593253881c934e

SHA256
ff105a71dbbd20b8af1fefa91020ddf09b149b9f3d7c9e6f1d1c3121ae989991

SHA512
40d52a4f507c7702a203c58dc10ebe095a02689de6d14a5077b640a8d3a67d1f537274db5a0b96410451d83e4aca06751e5f22321fc94ed32fd9addc3c21cecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7307caf48bb2b0be3003313009faa493

SHA1
bbd578484d700ee68383dba1bff0a8f15f3f288e

SHA256
eed9b23acc023b9f77646abe9766ac01130c82c70fd4e0c192185f139019641b

SHA512
5d78841f41ffb11ad4628e30c9c9c3661ac54e798f367cfae1272987476b0caa2bf3f7d7caf0e10b7966a7717eaa49dac8b0b7e1206705cd0c53584201c6a40b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e529a158311a1d4731b58fd0467458

SHA1
6894e60606f17df859d12462ee3e5a8bd29316ea

SHA256
a913f76b15c6fd791740ca6126b7af5fa7fa6f2e2a92b74095a0487f6f9766bc

SHA512
f14db9cbaff3860af1d8965c5a8c6e82fefbb0fc81039594189a0a35d4086c451d921327ed6aaf2dd30b65d1b748e95d7ece7dc3d626dffcdd762ea267e40092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc85ddb50a7a95f975728647fe58a225

SHA1
e2e2421cf7022208d8a21e19937d63d8b372329e

SHA256
2098094e8243103a8b5a104207a5038a7cac48c51b228450d6689d076c8bfc15

SHA512
24a263569005f1a50ae83358ef0d9b74e831fa52ef075720e780c832d4db7b2bd7602afa6d8b7d8e34c2677610574554989d848c18ad57fbb7c6eca9c880a748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f44acf154ea6d0c5da330fd32de0372

SHA1
6546a589cb4cd10e25d9882947c4cca851c1ec4d

SHA256
641192d1d0dde9dca848d10fd903c66cb6511b2e5b89846bc96a8bb59d06e61a

SHA512
eea79b7b11c2d48e30755a63893b0e1af437e43fc4de97ead0741f4c7571ae79303c733fc49fc841242956d91d83f7cbc7e8490994fca5621696386bbb963410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96d329086c52a196cead6ec3d27f7c0c

SHA1
69666ba0ae066fc12fe7b1ced0daedccd4306a8a

SHA256
6f1737e7f9aef4a9af1b9079a48952f91a6ce215aea3a8f33ab052b94c6df71e

SHA512
b4f4d05e2b62b24aec3760d9084a9af1ecb045bba052604976b47a45d1d96075a6675791265979d1765fe090adb05e2d8b91f14c4ca18d088443d645e1aefb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734d8eae3b447274d8d9e256ce54a06d

SHA1
8e267a522ecb979d33d6f630185abbdbacce8c24

SHA256
3b02982e3f34184520bc2c36eb766bdbb1958d2d53ac0eba1375ef88e7dbf35a

SHA512
7f6abae2b3e4e973871d0c82aab8d5a5cd845df724965e85470357d1269b28d4ffacc688c031d1a34f1814a2e1eb459d31832bec4bbe1a6409e695b8f74fd380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b72a6f4c97663d44a5e9ca504eb2ee9f

SHA1
b03cff02b06da4c1ff0b7e564bed0da8d5cc1df6

SHA256
9a12e33996a601b4a5c1edaafd5433e5875224cf0d366d0e869fd863d36c30fb

SHA512
79a39bf261e84f3917b5a9a2b99159865e14db96e95ad8fa13981fa564add97592c392184254cadab959b603ca58775824a7937086c467815d8a4ad5c07e29d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b402612f67f6e84875bc082aa6337d57

SHA1
0e81a0de81f7f37bf36abc7dbccc662c28ab5981

SHA256
19c5bcffdafbd042790302e798b17654ac2306b9163b90f88053e025a3caec7e

SHA512
46938a43511f51aa1718d5cacea5921c06d17b5096e625f9dcf976f0eae6669848d54b29e33820a50258ea7380e60a76b27727d47afd429d9b3011ca946523ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173961a70c694f5b125469bddc3e7998

SHA1
2048828f214f35b32d9fd6cbe2f0eeb9c4d6fc57

SHA256
5254335e0b448c307fa41b88c82e2eca1aee64bb275786532c6f86e7028b108c

SHA512
a94ad0d70833a84e67fe689702640873ba48cf328f45eabd3a0e978ac3acf974ffd8145f728b947cf81469d179c410f176c84879d8bdf75042f5b7b76d0b4f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a927f0077a804cc0338de17a997caf9f

SHA1
93c4e6cb38eabe175182defeba7f1c2bb7f250c6

SHA256
17e411d77ab6b9c621d50427379aeb2c5374d02f379519ed90b7a257a0adc5aa

SHA512
776f36ae61dd6dffd53a469562251b4d96abb217af0b84fe91acc808d36d41a013e0074f79fd7ee8528a41cc3cfa854e2e4cfef220497d58c92557d9acb1ff27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6133507b35bbe305d0e292b20ef76af7

SHA1
06fce45dcf93ba23c98174518c0184dcb823104a

SHA256
ab52dddaa9cc6b488f9e2ba54b69e06c06bf81bd4b2d4ee3342950a553688c40

SHA512
b67582a498fd0b6884dbcbe869e4710fa00d521301883dfbac16e17f6c35fc5fed415c14ff4cf15a49fc216b8a0e47fe06ff749b85b75b9742adec041d5f3c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06b9970aa9e9bf6d53125b2eea7e8f5

SHA1
8c0d4781bf19677a35ea058062258f02400b888b

SHA256
fb2da775388dd3a59c04f70ef4ec00d86d7ec566abbb8c5b0d54b75440567a52

SHA512
2800b53672a69028ced97fa877c4f49a1751e3a6c3dd7da53da8b57d4ebf1916efbf41febe7826402e821b4df953e30b1fd2d93c09eed6813ce88d29050ff9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a96804673604c871e7e12bee470b5fb7

SHA1
971ea22f5081b89f03c98e472856019496e025da

SHA256
887abcfe473370d68c77179cec5c3169b3fc0b5f07ab052e2d01f1ec237d7e02

SHA512
c03885b5d49499e922b7589d1139fbde63234ca86fb65673c3b28f1eb4f8a1b9cadcc5677f07565c3b5da4274c5566125abc545117068087eca8653969adb024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B4HDT8MX\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8EBA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FEC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit