4d4f819f8409386c7d6137090bfd43c7cf31f95762dbc5708e7ee492f088de44

Analysis

max time kernel
140s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9be1ed5e03839ade5c31ce3271e5871.html
Size

24KB
MD5

b9be1ed5e03839ade5c31ce3271e5871
SHA1

af1c90877ccfa0c925f248e9f66918aa6b3271fd
SHA256

4d4f819f8409386c7d6137090bfd43c7cf31f95762dbc5708e7ee492f088de44
SHA512

38dbf3beee97fa766ee55d4985f6b94e3a92d24e8678f2cfe7a8e388fc72b87fbd70834f2a90b0d05cf221477efd19c8f8f522dab1eb5e4397f842203c33c99c
SSDEEP

384:/X6qUVkczFiX4pmOdOiuoNo9oD0Vpt2D58tAYsNNJ4eo8BYU1ke2D:/lUpzFiX2XAt26thReofL7D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AED9B371-DCCC-11EE-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f80784d970da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ba9f52025bacc6b20ea7be490448c2d7dfe44329b25a5fcfe409555d0314ea13000000000e8000000002000020000000a647346043f19789a109f3f25e4ef6c01a9b39e477f59781dd228290f55bc9cb2000000080953e6b6953692ebaf5353fb919c69f44143cb409c0ad1e02c05366a9f50d1c40000000439e3133fd8da025e8e8fc6c2e5763db5de96af3d66a06db3e8bdc47b4c0cfcdc6a7476107e5cf680490b024b9abc08126593292dc8cf6cd4306b0b01e7ad193	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000070289df3c8e8811e05122ca7a540e540aa5ab297c34d97db05cb29d230dabf69000000000e80000000020000200000005ceb10404db8b75139b8a7a8f940343e46bd81d7c80bce8085d0fa2a3546127f90000000ea0be2a29a452f5fa07ee561d43ebebeef8e2f82cca37fa26008927fb029fd96c24517c776d4f03399cd0ccf39b350b0f939361d3dd627a435271be6268437d3e824ad0d13d0aa37f4a14eb45912cebceeb7798567b84118bd5c9ad77a2a02203df4a12348c58b9e9fb42f42beace3fd6460baea8e3664d2ad326d797c76540b63b7ff77108355b80b811fc5219a59254000000076be9e2ed8534026607738b0635b5e69c6632529ace6cc2c2ba180e7509bdf6f0dfe05642e29b54fc6ff7d9df2c23b5fc0c6799c4ee6437b84c80db862c065bf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416010089"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2856	1664	iexplore.exe	28
PID 1664 wrote to memory of 2856	1664	iexplore.exe	28
PID 1664 wrote to memory of 2856	1664	iexplore.exe	28
PID 1664 wrote to memory of 2856	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9be1ed5e03839ade5c31ce3271e5871.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a9523a64a938db0cdc574a5b27651ae

SHA1
a6c9debe1d80c172dbbe56215f2f0c5b97d14019

SHA256
776f1caef8682123c801af43d50cfc3622c7c358c1b03ab1e084b130e89587ac

SHA512
9488b5cda80aa51d26fea7a7a1eac4e1d8b69c936c3f524c8a5f871d539c1a435257351e7f89b4bc22ebde6ea1c4517e04e29cfd74c8fd0c72ebff7317a6404b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a6e2c349a65a33cb15ac316cf2bd83

SHA1
7a15bed1fc1c11e69be49118e694df963b8e68c2

SHA256
15e6ccdbe1373b9d1231008f4dc7e0dbeca131c14d38d2c9c9b78f775ed9c725

SHA512
718cabfdf167daf8d853f2b965ec985c245c9bb949c7b0f16fb0ad1806738ccca4bcb02e7dca28c4655a8adeeb46bf7378cba5692a8d3bc9c766142cbb4093d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ca883e4ad56866326af4199832d171

SHA1
0e74a83fde400ee3df8292dbd52d07de51f32246

SHA256
18654b510abc6aef84eec0d3a1ce61c7fae4d6f96fe0d57f10d3c2dcd7bdba6f

SHA512
a470f4512200a40ff2c158557dc35013b71a2c4d3aae8f5ea456e8244be8ec2672b995ea307a31cd6fd8dba0154116da013f34b88137606e55a24d8598391499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aac44f2e72e33d1f2568578d535a9fc

SHA1
3b77dfd3f1506503fe2dad20f314838f684f66a5

SHA256
bb31909032293cd47b96b302683bc0a8dd4b7e0e2a037d75da98842ea347f2f4

SHA512
3b1cceb7a03fff4c52ec111003ed9b338fc5b122e9a8970792ca8c3b850ee51da7608cb11eb66a7469757ed5a861831790b5dfaf4613741fc796a54fdfc3c917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0cbfca2b1be8c4239f8663cda939ada

SHA1
1baabdd80e11ea70ed36d2dd08b54c53e49a7e6d

SHA256
c54cfbf4c7ccbf38990d507e6dd0b45485271b09fb19611b8778f2d40b7ea1f6

SHA512
aa65e060c2ab9e91f410e7e6e34df836668f554564b129276b9bcace10800715ce86dae20634b459cbbae0481d9755a181b27dacba7aaf9b32931a334ef0066b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ef926a31f127d40ea6089005d509a9

SHA1
16ad6762df6b256e7d8c3349a22d27bfacceb92e

SHA256
0f46323274472250a3a98ecc34c294205e372546ad57476c2363cd091c1c139c

SHA512
7972d532ec101eba42da70a1cd99a64c23ad08e246bafe4edd547a9349c6f3d13f466099302851f5feb0f010a823007f0ebc50926fda9b33a212327807b11c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a15bded4f65f55e195038420145a088f

SHA1
0675b83feb848ff6e1ad104fd120b16394660ecc

SHA256
e97bb973b60599a8a9d0d9ed766d1d21b99cbd37cbd2d38a767050268380d3bc

SHA512
c389540343ff2599f76ef34d7cceb1317e3ae0a26f53769190051808ed9b0815786d6c5ec7671131cdf1645e8806f777777546042f820033194c2aa7f345e219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ac5c4368f96537e3e789cd4afaec648

SHA1
fe114632c31e31e2f1090820447e483a562c625a

SHA256
d267f2bfb893d5edb17f9a57a93febeab10b3a2cae4b71e87d3e22b3c32ab2af

SHA512
c6269bac86c3c8034e0bd27c693a5b3a54cdf614dbaa086ee188983819253dd2e8786f56bf6a2e6ea802682aa1a18f9630e1eb30de48e2cfe0062572f2ff1b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e527a8ecadec4190601e090fd3073df

SHA1
2ad009d2ea1cedc4b666aae08e54d4abdb235c94

SHA256
8430cdb7384ec7d69fd3c29b7a92adb54884abb4555363c279f252612c43ddcf

SHA512
9892ef148f73458b9c458f56096b12f9b5ae91d44a2398503fced526272a931379bd03ce549933a61e2ee662f9a8489ffa00848d3fc48b0ef4494e87b9ca4bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3eb2e1e2ffb3bfaf618b34beed7754

SHA1
1a2a57e66e5b2b1cc362e6d3129c882e90aa0cc8

SHA256
fc70cfb6214580140c4b684c12daeac9a71e15abcbb71d8291076ecf6d4f1d08

SHA512
b2ea2fa9dbe692bde4a54c847708a9477f0d50bd800f22adf6810eed1c80b68bcdcf066370678680357f2fdd0cf71a0e7baef3ec8a497eaa31f5fe282a740d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0abc68a9fe6679be5c85a73663cf690e

SHA1
98062fe12a7d208a67bd80b23d39350e0afd4ceb

SHA256
37d9387c5016aeec4877692056f8fbb13b2e35e95cc570f85be531997f3d58af

SHA512
871015d3a6926c4c48deda497870f9642559f7083e3357353d894591d52b8e8d862aa8125c42864d54153f8c846c079cebf9d829f38bf46c6a2462484d011ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abb3c1698ff0e4718fc5f670f2587c4d

SHA1
fbc54660d58a624b0a743497a99e5ac0c1456f2d

SHA256
2dd7f2deb062940d7a16eafe0fd4a7b73e7a49bb7b74255b5265602ff5395da0

SHA512
831920b6fec8571f833ba75e1b63241b4aa704d5ee8b037b60ea861487aea5184be04e2fa07d42f258c6fd61bdcc27132c87d70644c1ba6d32e9ca3369221fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d62d2de2440a9430552821d2cd2b756

SHA1
eef4cb611e888254facaee8a0874ac0400a87b79

SHA256
9218a1564bfce0d085600a111c87abce697b095b7a84f0d2b6bc27077150effe

SHA512
6ba39c763ac36fd2794272d3af6ce286e9abd6aa52fd51a9a72d1415283c8ac129b7bb0a46fca9dd607fa24dc5c93cae21a3c55e9fd80715f073ac645fdae737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b207485787b3b1b3c975ae0e5d2fdf3

SHA1
64406845c7ec522741ad716ce3988d83a3530b98

SHA256
f6680971150d9147927ef5345f609bc6050cfc89f3c6f74d06061451ee27d0a6

SHA512
7932cc74d86e7e8d6d9bbcfd51b050fe2d1540b902c82826583b342ff4f274bcf2ca6c13ee8ee913ce52d24cf8fe99bc57583d2389a11ce8b50e633221a6dcc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7481436b59a23d34c1ec5e775dc3f8c

SHA1
6bc67c27ac965714ac266f725f7aee47e138a9a0

SHA256
139c103faf9a003b11b3b6496fbb38631e907ebdb88b91e06c5180ae9fe77e77

SHA512
6432d0d99e83ce205954292ca0b85ce814cb9d4d24bd6d674717c5257bfe7b5ab9573ffa4c9f926e52af6ac406943d65b5a6043ea981d5766406e79fc5aa02f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6E4.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit