b01f8e5b0fa7aa250b7fbdc5502658f5eab8c58d13a1f3adf09c65d44f88e74d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9aa3c46c9552cac0a51dde724c54965.html
Size

17KB
MD5

b9aa3c46c9552cac0a51dde724c54965
SHA1

34873dd9b747853b646d4be13889d708c8680dca
SHA256

b01f8e5b0fa7aa250b7fbdc5502658f5eab8c58d13a1f3adf09c65d44f88e74d
SHA512

e48ac0495f114c60354e83fc9ac8328397c64757eca5bcf319805462182929e278790f62e12187616864672ccc11b3826610b87f4e0a4092e160da2228d9d140
SSDEEP

384:xsbB9Hv5RVUCLBxqyZQg2eGivpinNBinNRinNxinNJinNhinupPzIu6O/CZ:xsbB3YCtxqyZQgeivpqBqRqxqJqhzpPq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04DEC131-DCC7-11EE-BE0C-E2E647A5CFB6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416007654"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3048	2912	iexplore.exe	28
PID 2912 wrote to memory of 3048	2912	iexplore.exe	28
PID 2912 wrote to memory of 3048	2912	iexplore.exe	28
PID 2912 wrote to memory of 3048	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9aa3c46c9552cac0a51dde724c54965.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a0475746032d5e2ce626b8daa2e7b57

SHA1
13c7b037fb09d8803d9e5b0db393f6fc0f7df7a3

SHA256
75b37df9b7992c4ddfe2964ffb37c525786aa2260ee8778f5a594ba7f96a93e5

SHA512
2523aeca0105d6fa7dc40425f7b68f2cf2f82cec9893fd7b2a494e43e1771613a6f7a08d72e11ccd12d074dea316367156c94011b428fa916acacd17e9d105f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80866617f0f9dc09161a6390e6651ce

SHA1
d5633f075c155748e96244f4d56d190ffebd746a

SHA256
f91387d26a41566ce67269ac57e4f4bdc5de9f78ed1b7ef2f54c62c93bfce7a7

SHA512
689a94be880e0eab8b6f839f56169f5648970e4e2646acf65a936da16a3563d31d87cc511467f0539b3e641fc573b33df783818d73c423c66b1c45561f777b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
750165f5aff96efece80f22410ee3f6e

SHA1
26db45b56a8359a9e347ea9332d32f8b3d20fc5e

SHA256
b77f0945033f1fad2e1a48c5271505b84fe63532a3349dd0db6e4d6c76686c69

SHA512
438b84209918a9caa4b81649bd8a488c1d035882d2007d630848a706a5ec34534babeaa3d9a409eb1d20477afb3197f34239ab22419da317726765717416047b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39ffbe3a74a0c72fe954519d8feac2f

SHA1
d89e95238ec89280ccfc6412ad530eb27515c076

SHA256
29ea81fce14f5ff400cff354ee5f349e7d9fcdf905a67224a0f7f45bc723b027

SHA512
085cc73bd90e2678054b63c8c2f1c42c2b78c9cc7ee0beff345f2444adf94e49ab5bf037e6c4ff689c58965c4dfb219ebb1a132377b6bdeeb2b9c8bd62b89252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
714a1cd59be955bba367e16b4f9ebebe

SHA1
2ea943e7a026ddd4e49e8f87653236f3b41876d1

SHA256
c53a49ff1534a3f16e3f1a1ac0abefb186f9801f5e87d1f422c2a325b4fe51a5

SHA512
c5a10a20f780b0b91967b5a20b48ed3bbe1814240356d55d0ac9b735f804218903cf64d76fed908bbf42fcc45bb3b67626cec818a1e3c1a6ca13df549dd62d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e97a908c4cbcaec961983868386fae

SHA1
073eef0e117d330a54ca21f18ef57127d88adaef

SHA256
8b9a9c72dcd643145fb6f8ce4a110793be3f62b81b22ab16af3351a6fee2ed43

SHA512
da4fab6043271fa427901ba2dd116471c47c3a50f562379c5cdc9e65cc1c2d3d1379c3f3e88b2ab11ff7e2a2bd80e9fd8af67c1f4787563bcc1785352c40ec16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6ab57641d104a4fa5af73d3de5a2737

SHA1
e4cbc021afcff0d8896c40511b6b0d58c428bfab

SHA256
3fb54cf988fc8f746a3944075a8dad9aeb630fb8df66369441bc43c20cfa1975

SHA512
90520f87d9b89c20baba65a4f19bbb11c75f83e06a1762068d6cc25d7e514a18cc43357fbe7104d58c9513c71be6c2a04662c7485e8309aa42037f3fd24e72f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c8092037c8fd79fa7926daebc34e107

SHA1
2d5145b3ba20f34e29ee9498bb0d2004eb624f5d

SHA256
4fa802e4aa62a211c399b190480a958b7e0aace7519fed9211dd365d8a45fba1

SHA512
82c9bb71d10e02ec3eac76edbfdeedc647c48d14fd6c162ac8de231a2c36c4c026ef63b41cff6d00e20b64086c3f07c4b5aa55334c966d8f71ddd5bb641b9a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE84.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar107E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit