43f9d5df21bf809a4189b1aa8919983a67ce4a4a9733ec5146ff5214624d8332

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c195f0e9e4fa143d403e8b87afc7213a.html
Size

33KB
MD5

c195f0e9e4fa143d403e8b87afc7213a
SHA1

25269a7e3a87a278f1145a0c573ef0ede9c05cdc
SHA256

43f9d5df21bf809a4189b1aa8919983a67ce4a4a9733ec5146ff5214624d8332
SHA512

733bb28033ab96360fefb11b3912e7fd2cc4f8b97b4fe4dbed94195a9a7a8cebcc2de22b21e4f3bec4ddb6cc37367f8ae68a953949236d4b3af0999ff460e79e
SSDEEP

384:AzRer7J06yqa7shjCxfuWLOi3eCja8v2wLK5L0R6nmhtliSSSUBSqVUQL2dv7O6/:AD48TjZbtWFUOToAQAeiaqbQCl2z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B069101-DFEA-11EE-A49B-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000b06c93140b5c70069a69d14107da8a44d516c66cbfc177c74fc967963151468b000000000e8000000002000020000000c08269f9362ccd1dbf94f1ddb23bc9d4b7879af0e0f7cefae40ee2aa1784136c90000000bcb8e0786028ec321733df5a6f4241a1610fa83caccb5c31d7ee75453fb07c29f28c1e147a377954edfc9c1c88f54175719c924e741f14809b18fe8729551f0b6fb95954222ec3518eca5329647684921418058f94dddf1a0664391ab84483ac70ecf304b41e57ce930edf892303a3158cc80288d3a1e2faa4f96d5fdb6847cb05a9601bea1f2f63a79a05e1b78f1aa54000000097bdea0af5e3aec94f5d133b387d152b67f2a6e46deef8847c628d1275d2a3017d2e23a5081ffaefc3345650d90354a368c97275334303e78a35ec50c9208ea3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416352605"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000dbcc38edc7e75a6f14eac91083df015ace9f178df9b1075260e2f56a0e61054d000000000e8000000002000020000000ffd9e44ee66b23e8a7b62853dc3684ad26b44b22fe633e22ce35bce3b2e6a47e200000006b027659981f9a75c96308b19245013f767f33672cf868f4a645c2510512c06c400000007e7f2915fc12a58f7f61595e2a639a891c348a99288201fd18985bd0c4c1e1917a4edfbf81435238240a02424685769a8ba8aa0d45f4e136dbcaf3d8e7315813	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10651303f773da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2612	2932	iexplore.exe	28
PID 2932 wrote to memory of 2612	2932	iexplore.exe	28
PID 2932 wrote to memory of 2612	2932	iexplore.exe	28
PID 2932 wrote to memory of 2612	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c195f0e9e4fa143d403e8b87afc7213a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb115c5fa502d40cf099719b2a9d8329

SHA1
057ab3d57920cc491eb210a37dc5a533de3cd9c2

SHA256
1cb7dc2c6ae110ea1f8d5f70f945c65f13a448cc0123838cf3350ae72a360651

SHA512
46aaafb1833eefafc4c791908f606022f92987a8c29f33c4f96f812243fcfdd017b15dea0f91e0776f401e9f6004c81d1db099dc7525baf3afcb31d0cc6a2b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41859e55a98e5788227944ed1cf16b67

SHA1
8f468bad4ef236462b19bd60b30eed1af214e81c

SHA256
ef072a7a21c886e8cbcd1dd4238dbbab50300649e08d504d211971d78b7ca065

SHA512
d703632213981e3dab6af5b886227561a9be181d10fd0f7e643b7774234a8645dda1c17392c56501f24295535d5a5052fcb0b4b592ebd7f6e8e9ab2c8bec4a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67563eab6b6d328620fffecbde6bfa35

SHA1
e6514ce492586eef897c6ccb0bccf69b2126d126

SHA256
efa65e22670b62d71a0ed576884c9fe6900cae55b8b1e412d9fdc64ae6d8ec62

SHA512
9c112ca520e5dcf353e8c8c29b902ae8dd3f75b678ecd1fd6e0df44a26e4e74969386666e20b65b0cec8408993681c638d8fa85ead1d45b826fc95f5db4628b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3dda80ecb7cf13e981dcd0eabc86f7d

SHA1
6bcb0c66fd05a8c49a106f7c38c1acc034af7f8f

SHA256
8ee7dcd704946cc55270f2a27fc0d24c09ee7c4fe84e595ea7e302032c5cbf31

SHA512
2fe249e7a29c3fcc4c3972f475718de7439205cd257ba9b4dfa2634aa01881179a78329183fc0613ffa30f4f8a91dee11c582b6f7e411ca2f35214e7e1e6c4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ac8e4b2c2a79b60e6a2ec31cfb9755

SHA1
df5e4343d3f7fdeab8b13aa012062b9c545d1611

SHA256
564baa8efb71f227f7e416bea5d93c3a891340879c20857e92f31afdb04813e3

SHA512
b2e0f7b1906f87a254c942a054df323e5082b8eee4db2ba58e98588fd7af308384a24686d8c32ef165e1e734a59cdc3f405257bfb99a44b07e8aca3ad0aa41c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f350497f66323aaa2e5931dce0d6d8

SHA1
b2bf5ab770e6593e0da2fb3b63171c80740e14fe

SHA256
bba813677b8d85b65bc570e273c50ec2267c595726b5f74fc32a9ad27a46f3b8

SHA512
0cc2377ae539dece41344e741c043eb9a41ff943d54ba916d6235dd8ec887afe97297a3652311095e464a9ca7606d732d06073ec35669d6eb0acf10b20c03a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AD4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D0D.tmp

Filesize
129KB

MD5
e2856d05fa47e8dbb798e3d6b8c5cbbd

SHA1
4a7b0a74e5a02d79e8059f3eef5962810be077bf

SHA256
e77505598e26d39219433ebb2514a3e64514a7f493b9c0cb9b79d951af587555

SHA512
831238d98d4990c9fa25633e9124dd48e8547900059bc948d6cc69f29f458018974c6714ec2704759751104f7fd51fccdea1ba10f1065c91b4a4406273d1fbee

Download Submit