f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a.htm
Size

1KB
MD5

752a1a8e638938f8e466e838b330f7b1
SHA1

5a66c6f7dc710496af18360253677a62a5bc260b
SHA256

f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d
SHA512

e6f1333f3303b5c30e59e13baba529279fadb5a83b3984f0f83bffd69978146e062ab82a01e04fd7af2bed8a85aa6512acaebf24604c02a317ed8b633d736c43

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000035e32c2e4350f3231f8e456ec7686bfc9ac62dae739d6e82fbbc4fc94d72e613000000000e80000000020000200000009d4fcf992b8c439d586c60799d2e0d95a3a57bc93818f736e7d7c43fd4424532900000002031b1d189fe9e7518de87188df3c2a7c3217efc8fbdd3fcc879c66376504d469e0024774fda2ceeeea6c8453cd356ea17657aaa1f38ee7bad9fec773b89901bcca4e4010bcdf825457978c31e4858eb09fd4b36d249bc84c978ff805ff4705c1b778ca5e84de78317129bfcfed2b0bfd6d4b4df902d21b92ae8bec30460ab77cfcebc44a6c3568cb25e7bb803e124cf40000000df02940a9788b325fde0ea1511e8d98b71ded85c609c60c88a6d89d5f9d6c61a5f7b98bb86f4b2257a375d8f88f9e20df4f9575c967921ac8983a24541a9d113	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415853471"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08A207E1-DB60-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000e9b84b03d00987afeab9178eed5dbc86ac3a531944ba6e84456e133066b11d02000000000e80000000020000200000002e69ef28faac349423996c911d7b56ea779ab1aab3eabb8ec09164b066ca8ca8200000000ffe0dee51c1eb038af17d4d68eb7e4305eff8dfbfe48fe8191723a9a8de998f4000000012bc25c3f3d805f201f2f1e1025e361af66e90c1a41d568b9c8ddbea033b9b4d9ce95910cbdfee3164c1c4ace1566ac8568f88ba16ce8ebed96b861cb5cf9724	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9044aacd6c6fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8070f5891a23b1ca487557b7aff9d27

SHA1
15590923ca24b5a2d25f2083bbbc501ad4907d1a

SHA256
f6cead76e91aef7dbe4cc133169a6cd46954786978c21256a098e0c59184572c

SHA512
45ca17b19f845b0b9863cc9f86465a5b5537ca5ea0c6d302fc464fbf764a50d7dc6d4e7fa8bc42a93fef1089192940cf11ea5df608e261e1afaf977cc8e5e84b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd7c14bb19652c8e9ea23c769e678779

SHA1
534403ee1891cf3016bb35d2d6eedec187da18be

SHA256
1ec40da1e26278fd00ef4434b20ac0dbcf17c3d1aad24bc7df3fff84778f13b6

SHA512
4c2250e04f442308495712faa6684645d541b2b84749d4fdd3fd529a06b500b28e4aa841eed20da0d42de3562ee00b5b5adcf544be98437d3ec9e3463753d759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8904c847ecc53e61c28b8248838a6791

SHA1
3d100ee2fcae82ddc78624f2d7eb82ea7f7f9380

SHA256
aaf089754858eba6cd685c97ac28b34aaa5b8ba1132e9e1c7a6e4cf16e9e6158

SHA512
cf5ca7ac0acca95fcfad563eb7a168364ee7ded6c03af77c3fbf7fe4ac88d33d0f6b73cbe2f9a1ee370afa022fd1e352c5c0160f9dfe4baf192b0db9cd46ebc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60ef2f4fef9b027748306b0b9e11f489

SHA1
62e4d90ee194458aa1f67e10fda5bc362c047620

SHA256
839dfc962a850333697ede903243c155d72129cda13cc5f398e9699e02f2bed0

SHA512
9013ed178a709efad798d2a596290bc515a99dc2c828a979ede10647d6d9f866885bdfa1d1e312c2577134bc8a8dec743a23acab018b59840c8e6e98c359b1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4111da696b3e448f131bceccfc8cd0ae

SHA1
b8d87542fa9b9278dde48f882147c201751ddf3e

SHA256
4133714e9bfbb1f947216a3092d857e2487e5d4b803cde2e071e8f8c268c7b26

SHA512
dce472bf07781161d885dff16c67bde5b8f78f372e6d4512bdef37f80b98fd72f280e0c6d65fc31fe918248032bf2d169151670ec9ed0643896c05d181ba28e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06371a94562c41f5d57470eeffc4d8d6

SHA1
af05480cc3c19ccc75beb4993ef5bdbcf339ef2e

SHA256
efd7e6431696902fe6458fb27a81b7da0e2cd3cbc5df3a8208c5e50f647f61e2

SHA512
40f35db6ae7ab826848cd3a55c3bec91eb74b7e32fe73ed2dc7aefda6d7c5075eb27d64232a6de40c064b4352c50b09a169c6ab93d36ec15cb4a6f12a755011b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b581191f25d9b9410e64a670ff2bfe81

SHA1
fc4abf9b7a6ac5492d0d06e3630ea0d072148f88

SHA256
e331bd84015070e14b196ffd9b08c9b9a705eadac19436d5f35a852dd165f8bd

SHA512
668d26e5aef8876a5cd2a9db0115b9ff1faca326a9b0e19ecd41e7d37f654f4a4059f9185d2a697def33c1ce861cf58c4151f9098900544c1da47e1e6304eabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04970d87a30c757750a541756be3e56

SHA1
3306db765ac8b6274955dd8d5c5f653b568ec1d7

SHA256
2c935b1ef35288f432459d0301aadd357662a3b0b595eb2feb75bbcb14402e97

SHA512
be5f51a28222fde42e27dc89bb96b0074eff902f3a65c4d3a3236f668a1bb812699b7a6af6a27586df4771e82ac768765ade16d4b55f6b390ec29b00c35acc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9639311ffe0919e9bf881feac0d5e6

SHA1
4018af132acf5a16b40271e74dab379f3d00c2d3

SHA256
73fdcbe19aa7cbc801526654fa879c7ea3a5b8ccc8f0a7e8ca2342706f5f3420

SHA512
e25750b3c7df450e442838eed6e4f56629185d73d8e5df4741d357ae900aa3b6f40b13bfd7d7b67ddbddbd67c6587e57709c68e7f63b0885c6fc7b5525740272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d9c9c709ff42e55417f9f9a3135e03

SHA1
0a71a6bdce8dd1a6abde82b7ec1ca9c6f0fc35e6

SHA256
3df13621db0365c7d30dd1e3b6d431e47afc6351945b188120beb73213ead598

SHA512
3bc91d498d3c0140bade8d124ee1da18c7fe347993c854682b3fefdc1adeff725db83cdf4bcb32b72244886e6dc5cb37c006d87a2334dc06ab982a8f43e5567f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c94ce3a71ded4ac7b04c5261110fe0bb

SHA1
835fbac2367f369dbcc6d20d0341b9f795ba08b9

SHA256
22230f2da5cd2f364649a05bcd70a2511a4cb055eda9ff11f2d7561fefcb311c

SHA512
c856199a709716f227929d8c26e4988eea148afd89c7d81aaa5bb8be7ba7d5cdc5ed5036433655364ef93b42fbabca491bae2401e2e98ad8694c3c6c495cebb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
333b8f45ac6bae912ee724b68db49808

SHA1
0d592c16f6219e1afa5685cabed413135e4cf5ed

SHA256
cfffef8f6fe0dc9b3584570f6b981cd0a29fe31d02ebb00e3eb9c44faa1be6d8

SHA512
b4a2fe76fc28029704a9a44db3afeead33eb00d94727db22707e1f18888fea24d2789196b226d7ff6b9fe5943b8afbb3038f54953a4d9c51482df54fffcdfe22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8e13ccce8ea95146d5977c952c37a9

SHA1
4acd44afbd2284757f659c32ff37027e177f84b4

SHA256
0d48b5fcff6b113dbe83caa832e54c2dd742beb19b730d3fdf51c7fc4c7f4ff7

SHA512
8a3628f1567080d374e162fe42b64198d134f2877728f314db95225d5d84570647b2e295fc28ce42f1af6bf4bbff680c52d1daee7e43bfdfe89b5a533e0a6f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caabc4ffae62d4969656474ff107446b

SHA1
af207e4f8edfd3cb365964eb063fc226be2a9863

SHA256
a708f63aa68d26e462712c3d1e7fccb744a32e3fe4995faefb809df6b91726f1

SHA512
a7c2514b29019ac8e3ae24c8e0207ce2e65d0695431d1b873559b6d55ad5141ee110dcff254a413915b3981d08c8f6d4775c48364a69ad07ad87a336fbdc2868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\re26ad0\imagestore.dat

Filesize
1KB

MD5
9a60d9018a6983e57debb4e701c2e279

SHA1
53eacf6ac64a2522ff1f5c0830f47deaa67c0f7a

SHA256
61d0d271c5df6d1223b279835c97657140d9d833f7c0bcf6b81886e9818b06a5

SHA512
fc4d0f23ef86fa724a702610b208b3e7ea1789a685e9c3064223c067fce813bc6c0b95e589ac9812327d81c8e98e4245fb56822bdc235163f0e5640b135e45f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\VsNE-OHk_8a[1].png

Filesize
1KB

MD5
5fddd61c351f6618b787afaea041831b

SHA1
388ddf3c6954dee2dd245aec7bccedf035918b69

SHA256
fdc2ac0085453fedb24be138132b4858add40ec998259ae94fafb9decd459e69

SHA512
16518b4f247f60d58bd6992257f86353f54c70a6256879f42d035f689bed013c2bba59d6ce176ae3565f9585301185bf3889fb46c9ed86050fe3e526252a3e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D04.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E53.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit