798a2889cd8dbb7d95dbc9da5d67d518d27dd797f93563ca1e2656e16bf7c2e1

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be084d413e4ca2019752809ea83ae8b8.html
Size

19KB
MD5

be084d413e4ca2019752809ea83ae8b8
SHA1

8a1ff3613d987cc3c9b16873658368e4738e964d
SHA256

798a2889cd8dbb7d95dbc9da5d67d518d27dd797f93563ca1e2656e16bf7c2e1
SHA512

79a7bca433e286c61803e52b29bb41322eac993d26edc33041027328d31096dc11ee87eac54af678a0a964bb6ad253e8651d295e9575b8bc457e8bba8911734d
SSDEEP

384:F2iPik3QzyGvLcWirzUc1K+ef/HAoxFJvIDZIlzipfjkC7mYY4FeLGWsjTDL:F2iPik3QzyGvLcWUzUcc+ef/HxxFJvWZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ac244b7f58d265de0417685bc407971def78e22549fa523c5e08ae211a9d2972000000000e8000000002000020000000b00871e96b970e0f6a91a1d70a0841abbeed0e12c98d8c2b71171fb978c1b6f790000000969e99f640f05a933eea498dc660de272092711149cb98aa9f458364e0ac752668ec6e17d3f34294d48fc36068c7ef29a280c7a08de713c809390f1375dd6a09565d5689b1986f41c1bfe4629385a556864b88170e592cc33332216fb0079178f9baccd292f1455c8c2e004069e890a716c96c934fe7bad23e5efc37321129ae8baf679922136839ce050438f3105045400000003d66e917dfb17b0f8cb65a47b4502603ad5dc1fc7f1fef6de1f4e0ed9de1b224e69e556bb77de6c283ff1fe1d54f276ce8a4aed14bc4f246aefa0039888af520	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416217755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00065809bd72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000088941087d62f05e20d2872a10967b7bf3cfb719283c6ff35a88b7dc27b7ed507000000000e8000000002000020000000de8330b98613e1245a1814995ec9dff2143b6a2050dce8ea01342ac1093adfdd200000008493796a3f07b06e24df0e8ea7daa81d94fe48eae48ecffcf6c0257b4ae365f7400000002ea8e8d5192d1d0d4b7fe4d91c3bebcdec70b0fdebc1d745c20e5db0b44836b77fd3bc53a7ba759c05b8131d565d92b428364de705c6d6f09755b524a0549afb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{340F4B61-DEB0-11EE-B85E-52C7B7C5B073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2328	2012	iexplore.exe	28
PID 2012 wrote to memory of 2328	2012	iexplore.exe	28
PID 2012 wrote to memory of 2328	2012	iexplore.exe	28
PID 2012 wrote to memory of 2328	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be084d413e4ca2019752809ea83ae8b8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0e0c407c3c7ceaa77d750c6c9590e92

SHA1
fb9a320c20a48c401fca9037bc7b4a4b2ca868e3

SHA256
2a204e3eb6855d0366c7478a764878cd082a15ab80e4aa677c38d6668f8eb396

SHA512
f9a3566893cda9ff7f41156749832e911482cff3fc81181c736a5fb905ee491186be6caa04d99b68d7e8e1feaa81a625a5ce0ff970cdc1ef0c527463a8e860b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5844e1ccd8cf37d140ee190c879d842c

SHA1
8097451da502a9c4ca9b9143bca60025b35b7496

SHA256
af339ef0a365b5ed71fc4413bbcc89498e1c4a6e1b327e44d4d77a8a65d39fa5

SHA512
c791df43c8ce6faa80aa9b6c2d45f3f5e803b769c5cda0ffd1f355f5c8d9d0192ea6aa31b99b2f3b68854a370013a01015270b4499e22f22482bd294eced32bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f9cfbfa54583c2a4bb30c50f069a9fb

SHA1
e67c6710ac8902fdf549ad7d50588139a54b97da

SHA256
e684eb3bdb457c5800ebaa88579d3ffaddfcb210de0965bda6b92050efed02fb

SHA512
d6f177e0de80d263a87aa1777bac070cd9c0aa5fa5b7ae792f7990c738503f02f5fc0121871f0c7bbc9c8af36f3d5e6f52332d13aa699e2c803b0dcb3f340d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04f8eeec40b508b46503243b01e9cd3

SHA1
91ee9f5443ab49758109e05e7b7aad469a988cd2

SHA256
6c92e7c213df3c5d8f3764da20422f24c22bc548364eab9f882b299948b41f7e

SHA512
593d76835b6dee7a3dff76f6692ffcbc14c13d282ad660c9afa63fc451ad5d9d4b4e88c34e9938f8df4c616287956b746e3304a88b0b5801de17e0c75d77f821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af3a1cfadbfd0e78e39bf37362c1cb1

SHA1
b3b47637e13b5952fe850a68283f59153ad2d25a

SHA256
50aab3714f90b35ab8dedeaeb7320236dc71a71ce5f18996034185a1e5940dfc

SHA512
830d31a34a391b0990d3e8ae7897d77e439a74446d05908236c745ca59b3a892ba3efe22f05debf293aa7d95ef6b436bf6fc3dc5ebd1ebf681b5934a0b41e856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4284b08015e502a65f1750e864473eff

SHA1
a692d045214afd8c51a8c638e8b676c965b80867

SHA256
f3dc988c550208ff9f799f142b339b850d6c4aeb58a658abbab5d6a8d6301f5d

SHA512
4285094f833621a3ef5726260f19b98c97ea9fbf97f2edc7d107d90966fc6c0e6f8254f3b686d75325500425501cbcda2d3e5d02cec31ad2985c2158a9380b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d81cf473b2198a7e77177386e897ec2d

SHA1
e4139534e8329c88dc81f5743eecb65ab8027ce0

SHA256
c83aed73b10a5118cb91db29592d05cfe4a71f66f794d4a703f92ff3e4fd6b28

SHA512
0351f94977ab45b11088d8b6f83eca71a529c5b5bf8503a97eceb47d11bfafd68ad64f03fbfcc4b7349a1f7ef5adc7fe45ed1b012b4f102d1058f1988ef01d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118f71a5f24133e69df6d3ffe9a82abc

SHA1
53ceea979db66e4eaf36882521c709715e6e54cf

SHA256
77a1ac54329b34f66de1c4f0b8fc232ea6d192ad7e467ecc83badb8ce9bd2ed1

SHA512
1d9396ca6b26d3df64f12088eb76d824ca046b74497707e889afb40aae34f87651701a94650687f658a563a49b3c4cac131f90495bd49ccf7d7e8f775b7f8113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d6f9351f49d745255f260db026512c

SHA1
04d1c16c05d6227995f1351951835968afd35241

SHA256
38728a4b51292c3791c9b54090137adb7af9a2d95b63dcddbdb61178fee12458

SHA512
e1031048ac4e3f3e09dde6f42946ef4b3231cb0710899c0b7d002ed2740a5e68a7e4eeae107c229a8bba5b451b9f183e4033c13c8f817e6bb7273d4cdc79881c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
937ccdde28a2f11f1e7e491ac2f3207e

SHA1
da492bda1af83cc18e5f9daf48f95771d41be260

SHA256
e302faeb282b4cc0431bc109818c86d13148ac758b711827931c9e3ae54ac660

SHA512
7d1587de987131411c59e3fce9dcb5473e6543161da65c46210410cedf4022ae4ad381ac0c748b3d5be6442111177110eb54e117b8235bdb5dae7d687eb15ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e8ac55e5da55f0d581dda428dd65d59

SHA1
7aaa10518213209ecb3ee9de686ca154427413c5

SHA256
140a9a92fdf6e167bc6759f1620112cc3e4d84b2fa9a1c3afc4ba22de81dd64d

SHA512
90c1433e9c20b0d306b8c28cdc40f6fe7a5c4f998af02155413dff8383a083ecdf4e7cef0e4d92e621ab60b8648d6ad8eb2e59c0f7ce66db005945d7e51890e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6d28dcd875e78363abd3b10b51ccc3f

SHA1
f393788a112b9ca2e1fea7af4a9008f770f18306

SHA256
c1463c6ba3789eef39a91aff3dce9c481d3c383fa2c67cd75a37ecfd51b51067

SHA512
506ef5be4a6092b6c2773aab0c4965b2c0d561ba416b771ee004bbc5baf14aa20c31daef21d4357259c3905b87efca316c703293c2cd6b0f5d2970e87315fddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AB7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D8C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit