5984ada1a0274aa79e32058995a7984a6451aa51a8529aa575fdddca8c40e5a5

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c3fb5468388b4e27d0daf8445c5627.html
Size

24KB
MD5

b4c3fb5468388b4e27d0daf8445c5627
SHA1

7e320dd9fc0f4a023403d3e1b07b9466bb9d1e6b
SHA256

5984ada1a0274aa79e32058995a7984a6451aa51a8529aa575fdddca8c40e5a5
SHA512

f104f37989d7c3c93ff8cb6e8cb2e6edc9d12aa6534098076538fd24e447c34c5401b8d10c8a16bd638673670d665c488c6d43e2892b4ee08825ec957d8fc7a8
SSDEEP

192:SIps8X6u0bL/lsYv9D96A5+zDyzzDVpy5B4QRrz5oqgVOtYw9eFJ1as8bNmCasis:SIH4yyXD3y5BvRsw9eFq6OZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415805871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{355E3CF1-DAF1-11EE-B66C-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507caf12fe6eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000006bcd0c51013f1313716ca913e5c389833c70e8be042744265f9610e2531b953e000000000e80000000020000200000007bca582885eeee878daee16225aff38d53d983134a52f96bda2caed7cc5bbc5290000000832994a38a8e7d3d3308b3ed9da6db1b14d594e2465728cb9a93d4ab6dc68fdbeca1618e2aa5c22ba6588c012ce96b81da51d70fc6b6b9332cf54f7dfd4e5a9b980a4e3a0c32dde518ba0fe916f09fa55e53b705367f2eb912e2ae74d8c14b51a3ad9c3d8756c875dbb6eb8b7fcc6912c53fd08d5c99cdbd076013174087cc6f5bf275dc5fc71253a3afe65665fd67824000000096b05ac2f9f7beb21b5ccd6f05642ea9f6a86369286b526704072fc4d5bcca56f13b4dd878746e0d3283d2d4f5e3b6da9e28148d43efc934ce7040cc8f9468e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000000a64fa32d0bdc091f0ed0fb00425e7f69a07f08078e301e0d3c793c123bb3baf000000000e80000000020000200000009a421fa77bb3e97392daed68f63b92afcf74c6bcb8e9e1cdb6e71f1bb3dd378020000000714877a17b30055f9f45b3c7164fdcb0f5139e3743f488d8389e8f967de4518f40000000239f4b71e053653506fb6ba0555eb0cb0a5fb0d938cfba5104cf98e88fd2b5d92decd43712ae9fb3557b84423143dc03073cf8585a780e59736d458cc44b9fc1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2708	1736	iexplore.exe	28
PID 1736 wrote to memory of 2708	1736	iexplore.exe	28
PID 1736 wrote to memory of 2708	1736	iexplore.exe	28
PID 1736 wrote to memory of 2708	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4c3fb5468388b4e27d0daf8445c5627.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2de7de44d1bedf656da816add6b3e18

SHA1
71f02c17051cb065d7a1a0a58c7aa504fa85b6cf

SHA256
562036c75ca21524bce6e58329f791af8f8f6ec670cf696834dd840adfa88103

SHA512
da192ced937f5d8f352810d39a6aecf54117b02dce0832fe3b95b5e33c0b083bf2101423ab67252f459998d3dc4d53c966a8e7cb52b7f888911c1099b0a6b6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e69ddf201e4d3cc6c46eaee154ce8d9

SHA1
655dfa7e4bd09c5a37e64dac04c9c2fe29ef7c40

SHA256
8f886c1854e1d5d13c5d7f8ccecc3efb58c04b08991d46ce3771036e7fa2b6bc

SHA512
6600dcc636e3e3b95411bc75575e056b95001b2fed814fddfa11dc10cfe518fe087ae9247096da460fca76c4b615050744d9261f2892ccdf9fc974ebf5cf3737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8d97c34b3f5340482168fe857f4325

SHA1
d1fa97a34a503feeb0b3df31b44d64a4f77b3fc7

SHA256
0e43ff122a36b04f4c9299be5a4d256d94cd836d55a44b5e64ec3c82fac81a83

SHA512
bdfa7f64c1a324a79ec81cfad45e38a9f71334258ad642d677821fc834a08363fc711ceb822da17f42bbd356e65dab252624011cb059184fc699fe2d735b305f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa6f150f38ade8ec2ab6da99aff18782

SHA1
244ccf45330df79647544a12a26d6cce7fb120d8

SHA256
d1806bf3afc188446265ff56c35e3a0923a45d9c5e756cfa03b994bd2efeaa39

SHA512
63fdb32f0d35cf16b356bca726314943bd59890ea2fc8709ed127eab0090f9bd67a298496dd74b6aec0bdeb369cd21d4fdd945eba2771744f48ecedc660a42f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
302caebdf04f860b0f9c9edb87d89997

SHA1
8ac6de49fdcb1d76034b1df8b96bb03a34aac308

SHA256
81bc19c3394b11b98646593a2a81df2a555dc1251836cc027a496474eea8df2b

SHA512
96707f6ee7830015a97dc8b134637df7f18131fdd0fc5e855d955d35910a8cd6cf3965922faebbab0f9ef61e7d2872f06fbd7516f49220c7efac137a71f294e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7316029c28bc0bb94327579ac70ec333

SHA1
b9242d452f92b18c51a0092b763a76b9d796f360

SHA256
a24472bfb0ce2e8b20afba8032ec37d1926543c4d03ee6832c5c2bcc6909a0c3

SHA512
78afb66c4a700cf9870db8767326160cf959ed8726a61811f4d5fe73008c7c715b6295ff36d84d44f2960f8f629469b5f34ed49e9f977f0f85cd2147a85866ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a6cd7b629980411740a36239eecb9e

SHA1
05fa36d1b58600d29b4b5735a8ca9d330e2dd7f6

SHA256
de6d86eb20c17df07c4c8c6efbc43092a18dabd0c6681bca2588e23c2d398150

SHA512
78373caaa77a2c3aa83d45cc088eaf4993a78d6b35e579bac69d331e403dc08552fbcc93a25d8e18d7f4b7f57239178d34e7368b478f7480830d3a67887d8a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a8d6e3475bae7ca15c1d27b719e9a6

SHA1
3f362150d3994dd80ccdbba3dab548d28690b8ae

SHA256
6c37eaf3edad5de3abe806754f55a64d4ca7aaaaaf9eda879f98e329961851b7

SHA512
aefa1ea1fd2ffc24d55e60b0f7bbfef29451f2a857144c4e92e2772fe15315fc3687ca68b3c03f7d706014fc1ff91fbc70092d51066f6ab8c284cfc2d3db670d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
956a178604f2427e7f163578b31b214f

SHA1
115523359e5694e78c9d1f2955ff5448a3c9f7ce

SHA256
99503f662633a360e198ec5b55b6601950e78e192e469f18e1e6ec49e5e60a4d

SHA512
c32678dd7294aa7269d90486126e5822f4156ac1e8ea1baea685bec258c8f28ba1d10a9bbccaf78c41bb1471b60ae0bf5d5fee08a0a57fc622125609ea5c7f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
486603daefa791b32606d1b0ab2c9a8c

SHA1
d3fa8759d69aa9a3a043b81fcb609b7f2ecf123a

SHA256
d7ae3b2d5a272f570825a4535e8ac68361d3f03157c43ce153a3843067be49d9

SHA512
ec0c56a576a927f177fd2b25bcf996d9ef1b60dec6b8fa2e37a094096869291662a402dc8de63302727f845677a1cc3dc16b3339e7e33e94df144335a89741de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29b5249db4a851586c57958c95170f34

SHA1
7f84fe457b236c7c6e88248da3455e87c75d193b

SHA256
401ad49538605c4d87cd0bf71aba67c650610fdd79c782adb1173d8ccaacefcb

SHA512
8648b17c24910fb5a4d9924f1b18e726af6779e11467d4c21c0fd130dc1f5af7a478a44e296d6de6c9149267136f14d5d5b0c9485e618f8e4b72e15856c85a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6B81.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7063.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7401.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit