ab8cb6b8c71aa7e98b790e9eb47897330000ea84336f260b42c9499c5b2383e9

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bead0a447953c5ed7b1e458350f52559.html
Size

32KB
MD5

bead0a447953c5ed7b1e458350f52559
SHA1

004eb573bea85895b9c65385b53143f966c8205d
SHA256

ab8cb6b8c71aa7e98b790e9eb47897330000ea84336f260b42c9499c5b2383e9
SHA512

31ba3ce8e850bdb8aade495a2feffc8c9d513ae0dbbaf9a1f246cbb01d424110f1e077c908fa3114db41fc79a7fd278a0d8f9bebf5ee367a7747ec9533e97357
SSDEEP

192:uW7qlb5nB/rsnQjxn5Q/tnQiegNncnQOkEntvLnQTbnhnQolXCFAXWDszKP6Xz6b:8Q/BMGnj6yRyrsXa+nOl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000000074a42b0b3fa917a67509a05085aca4317a7456aeb8073b66607b4210cc8ebb000000000e8000000002000020000000a59368657b88639f1549b99cf71986e5b292944b77fb3c25e308213562ffd4c6200000004eeff29bd04f0f124d3d9aff49a015974c870ad6a8d88a1c801d22a060e844c840000000954e6b89edc31ab4b8929202bc3385c96fd00f44756bce890c44659acea9f70ea2fe4fc260b6d8bc454a3ae8e46a7f44e4409f979acaf224cd52647fb2bfa12d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416238347"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{224584F1-DEE0-11EE-BF21-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000e397f0862d8849fd750edd6766905ee179292132735a49ea436c89551f9f598d000000000e80000000020000200000000c441ce31d844ccc81b34e000b6c4a8eb28ac1fc3b0ff53781efd8a08678608d9000000020c7f834987a72b64dad3e1a647ca5750bf86e9e7fc1f5be497eee2c29cab90623cdb5454ab95f1d7d87ee0b49b299f03ce8da529579f75eaaf81b66f6d6dfc7c3e41f8e5b327db9b2383c654059b0f10f6f4370d356b51d55858cfd61ff70689c4932c4e0e18f167ed0c9c4fd3baa7e106917a1ea395be2bb51fd9c2381288985d6fc6feb46ad4cb01b5953304bdbe340000000640a79b73b99303b35fb801317da5593f14c7ded8869689af12884e2ba5ba47ad39f42c15d04a72d8c80a17ff2a8077a89cf07b17e6536f067271b9d4321401b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9012d4f7ec72da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2056	2184	iexplore.exe	28
PID 2184 wrote to memory of 2056	2184	iexplore.exe	28
PID 2184 wrote to memory of 2056	2184	iexplore.exe	28
PID 2184 wrote to memory of 2056	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bead0a447953c5ed7b1e458350f52559.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfaf9945b4d759b2dc501326588825dc

SHA1
ce51afe2cecba006cff648c17803242266f2c8ab

SHA256
343c915852e9abd47ecf681abd39c6129e92fb495d69ec6913d026fae847c9dd

SHA512
62674c1f2621cccaa23aacf45bdbed6576ea34df50a247d81d2df6e445b938368ef20a852a208061fdda214c6851219d72b41522e03b7ae162582ea5a5bdf745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0050ec8cea064b497e2f6d4f46871897

SHA1
485f3a12784280cbec5581a90e08aa804fca6ac1

SHA256
1d2dfbf661460c54005f6dad3a825875dcedf815575ebc32f2f4a0415b86419f

SHA512
297f7245872d94244c2dfaa1c42aa210790b5d159851a883c6b734ae45a6026a6616d825e2fc69ab116293d426da8d596e9a2cc64bb223e8ec9dc9db0f94c635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3246ec1761dd287219a93faddf335af3

SHA1
9168ff439116496141344f674d1377a1cf71eb37

SHA256
3f97fc91e72d2cb406c3d6091126188cbc4898cc9b0b333b9191aade941fd581

SHA512
76b6f41419aabd0b84c3b13b6ad5cd655efb1cf2cae395168c8555387bbc8ac4cc648e6d86b1ae13dfa86c89187494ee9c4d27ea46bf22b120cda2a2d9ed1649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b3417f6036334884fdd9a005ffda26

SHA1
ccbb6d215167e81ca6c5727704a152de644c5d69

SHA256
dd0b1e35c99087c1c89be6fa212aa72163b73f787fce7175084565deba30c0b2

SHA512
5f98061e00188bbd8215ebca95702602368654c84cfac1e69e6b90c2670a43aa8a827686e15297c1e0f9af869a49baa20b757a4942401c29ce7593bfb5f5c459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a6d147b6d78ac9015092f507765f3a

SHA1
8bf88ae0906d9ebf06ce8a238f4452741527f1e3

SHA256
4114ade7a31bfedcd1afbdbcd4f327eb04c025c0d5492ba09f4757a23045c33b

SHA512
fdea99dee28544be7e2ebba6bb2d86c2d037c1e5fb8457a4d1a9052d5a7442c7e66edffc862841767ade00fcf1ca8472208f9a9a4eaaf45fe43652483035e450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ca6da8b557b88adb48f3e9786acb73b

SHA1
8667fb3f3e0dd1e1bca2e3d1f72da0e503c103c4

SHA256
2d800be3d2895a3afbaa62b109041c91ed58630dc83ac01b0073047b86ed87a1

SHA512
8da722d14aef4b3a92927810e54037f2f48d59b9f226d123599feef3efa75de91adda767e7475d931f18bfc3cd0117e80080c2db66a7637518d8fd0ef83f2f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E9E.tmp

Filesize
41KB

MD5
23bb808fa5f51dccad249fb0d1278f54

SHA1
91138289e4cfa8e1ace23158e40f8f7473d83f06

SHA256
977c1f4b938cc7060e2f82815aeb24f25f796ae9a030bfa94af7920defda1e8c

SHA512
d803befcc411f719ea43191939ce8ac8eaa818eb5ea351ab5a2c7bf004e9bfe46e8f9eab6c2f71d563725e4e2cd0a47cec748f3b0e1d019f35da06f672f9556a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5823.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5848.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit