3864a67f34a0fed2437b64a7a73bd27e52d4c452fa3b6403f00ea8d0ef36ce40

Analysis

max time kernel
117s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c39621c5ddf2381ec488c5950febbd.html
Size

166KB
MD5

b4c39621c5ddf2381ec488c5950febbd
SHA1

5d0905257feb74f673cfe052e0ddf827ea4b170c
SHA256

3864a67f34a0fed2437b64a7a73bd27e52d4c452fa3b6403f00ea8d0ef36ce40
SHA512

6b3f721182b3fcc3d98c80854f0ed9232fd3a33f92ee44c8a0073889e63e9a20979d4b9669ef75371837655591d1cbd2f9f1bc0b0c5d863b766aebd38f523448
SSDEEP

3072:n35RcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSx99aKR7ISMLmJ:rcjJ/jXmNRP9RkR8S

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415805831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007973edfd6eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000fc1c704ad8e197c06e023e4764d51a3aca653dd5ee41461ea35621a8b648ec2f000000000e8000000002000020000000030c8bf8665066a75f749dcda0640c7d896ef75fa2cabedcc3c13aaf613adbfd200000000dc9672f8035732c041193e07ea3316540e98b6636349f8e2a1d1abbcb92604e400000002a37335af4a77f6c84ebde7beb6c5693a2d930b856a737a3015a270b93763a485f9e5ade2d5bf525bdb8efa8956b6331636510716958938c5881843abfad2792	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000a401a5c0b8b5037a39f0dfd6a6d052eb3302090d44ad10452a076d479c31f54000000000e8000000002000020000000fc83feb2b18d656c3edcc684c051869f24a0c3edafa459cc823d5599a646404590000000377a4c8f435a4960b43b360498b517525bfa6c602ced4bed6e66070a166256b5d4f92f27ed1ef1542088da0b8624f1ee91eac4c176044e344d54bb612f8bc5aa68714ef1edc9b37ba7eb48965cf6e66f3fec7e1f8e149e59d59d3c2d8dcf6ab8ede3b248bfa079ee91eba156b26a14ac190f7201a379831d0999abb971cb64d6cc6ea13a1193c89d9c4627292afffbe4400000007de4f9993be3e2804c627cee33005f927b698b0f5b05aece67ae020d95f1b09867f5fe735b1d9ffed0059bd771e83bfe13ea6e57aab930a48dd1575eb270c6a2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15CFA7C1-DAF1-11EE-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4c39621c5ddf2381ec488c5950febbd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
78d4456c0e41fa3fed2f664bdcc51251

SHA1
761b3682c4e4b2354c9204c195a6e98e6c896263

SHA256
7b39ee48fab93f9f48ddb11ffd0ffed62e4c7da07c93e88a56fb2c8c978e231e

SHA512
726d7bcf21fc0b8bdd8f95d99f017835bcfb45d2ff88b6e4980b822cc5c04542e1c8a124e7b4ede423c5bd8eb3cc4e07b698398cfe23dfe0ee9083a9142d5e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_C62530F37AD5C5022195EB4B959CB082

Filesize
472B

MD5
055ad5e5162ffc5ff1e4173c8967a26a

SHA1
438b1054de88b204eda0a27f9b5be6ef636ea068

SHA256
2e192fa16be69986e235a52a059500a6726ff54639b456194964c5285c4ec790

SHA512
cd93122ac6d857b0ee890395ab25c2f5f9f527f809a625835c14c7791106824a99d8d5249f600e550969e63c0f3349143840a2373e83b59703608ca644bc6df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_FA49E055122F4CD07E54AE9E838D66D1

Filesize
471B

MD5
834aa3f03be24732aa5ff42f72401c86

SHA1
515ea93b3c3a72076eab7438890e8ab3cf21c315

SHA256
f11878fd14a04637d150027ab41c1e4fff81b39455484697dc1c4274e5c97a3e

SHA512
6d14c404a940a90ad31d2397d49ef439720b607e4a32a2a0f52193b4de1dc4f7ed12688b4c162e406d9cc5d33ae0fd83a3e049c82e6ca6d8e2f3db0d6dfb3b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
61987e3cc8b027aa530aa21c18fd7224

SHA1
8c4ec519b34fe3b66e39261f4013b9441c02617c

SHA256
3dc985f7ccd72f838b6489d23d077b17fb896fe1b5c4c8c9ea020f42cc0df7b9

SHA512
e1415c8ebedc4e3787656acd23935f3733ca3ddc047374f634a6f0c85269cfa1765b94570d244752c6e2cfe8b6fca5ce710b8281b049381f5f416d0d4cc58d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa7f2ef9b9646a2ceaec61a5547aa0e

SHA1
4dca21283e4347a1bfe9a4a5cad4a7e9c45a1d4b

SHA256
f185be0e35efd6e98a03beb586d062669ea62b434b3a5615eb54673d66822a53

SHA512
bb826eabd052ad141b46b7d32f8632c5cd6ff7484c8ee1ff6dfbcb726ba7c5de2bcdcf0199718b5211601ba3eddcab2b74b34f0e39cddd5e4bc008da0060befd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89ab2496a5a886ca57c07a8d1f0f70a0

SHA1
7441ccc7ad593a6c054484b95e59b384a683b95e

SHA256
6c28853c975dbd3fb024c7f19168d1fbb0bc58083a069a67588efd09ad1d9464

SHA512
0fa86c6fadb225222c2aa52f6a7b6d7f8a03383197a8a8cfce2e5e778557f5dc3cfd5cfa89e904927bbdf986952b6c116d0543ce3af1698b7abd759510db0bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84de84b4bfb3a9ab641ddc3277dc4273

SHA1
7a1928302a9d7d74c7f8516d7493c195c8f1d11d

SHA256
f384ab20d60e9d0dc59b8d446f97a34636064a6e4acdf110319e4fea581a2a48

SHA512
78251066db85522ac4ad0bef506662e20611c9e0fc9fbb044628766eb7b0a62e7d5c3b6bf373ec05b30ebe71d5005cdad765a460924b65b416b958d09e94450f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3d0c9043f992b7985ddff2506655be2

SHA1
0793ea79eb8e20cc8ff8bceddc910521c120deb2

SHA256
54fba0cb5a6a3c34697612dd487837a493927e8806e78bac4a4adba80795ac42

SHA512
9dfb92b23052ad7697f5465be80adeff57fdf7af4bb92535bc6a632d2eb558be75bddddcad8df9113cd8b24be703af873025a719649d6b7d7ec9ee333a5b07f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77635c277bc2a4d7241e2309b209b245

SHA1
eaed5deb143ae38a8c3c34d5d1a94939d4f03d2e

SHA256
35c207f4deac19cc4db6f09c31e242faa239766921c5f9c0cfe46746c69606fe

SHA512
f6a864dd4387fe125fe99d06d749aaa41d9a127130810ea80b5029094899d9cf91b0913becfa1fcce46b36c6b0fed3ebb11fb2a1a5b3bfcc8c0ed3e14e20207d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00446e459fda37e1094a0a333eb8074e

SHA1
776d90dbf0700cc430b450b6c43a793ca284666b

SHA256
41f507f6f8e861968ddb11f4f39496978feaa7d28d73289f6d8213fc8c7cb162

SHA512
9d78d8abd142ae834fd39b8d9119bc048c4a9b85e291747faa32336fbdf29bb3d916cdd8e53a80d44e73b30ff5c3e381b280d2b91dd7cc15ac8a74c6c70b7170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2600c5a40c1227c8c635e93bef035c48

SHA1
028a513bc1083a2ddb54164e69af4fd32833e696

SHA256
1e4eb866cc06025482204369c1c090f6e13470f0747d9d6c099f3a6074fa25d5

SHA512
56b9d2bcda79002f1b93dae17381f28f7de35be777bf81fd40306c05532395d660851aeb3eb27c1c0386f3853743c46f1f1a73aacc828889aca947aaacea9351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\cb=gapi[3].js

Filesize
133KB

MD5
c8be3350843695958a33474aeb3ea8f1

SHA1
ad92694d9b189ee479c1be438636e39247b216af

SHA256
22494eb4f5fc2ef8c229b9df2e171990687e4837282655145cca0fa302af1278

SHA512
54ba5d4076fe9fe4c4ac22f45cd7d2ebb4e8027d8b8f82580436dccbcd60fa2adbb948ff1234d9912c663bf1fb33ac834007850f5a3f2abfb96a7a4feb110bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\plusone[1].js

Filesize
56KB

MD5
b9dd4bc0c774f6e47fc7f6f84318d3bd

SHA1
71e659af69facf4538bde88422c6ac7574c3bb5c

SHA256
e0f79422a5e14ac8ca345540ab58da18651216e375c4fe02143496bd9dc046dd

SHA512
419b21dd145dab3ab4b543c87fad7fed6281c2300ac7f1cfef1119703e5ee97930f1c07353b2a1274d4879b481bb673ce3566306c9b0b91b1e573ee43486b342

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4461.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45BB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar465D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit