79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

combine_lang_model.1.html
Size

20KB
MD5

b804155fc0a59df670bf43086b31c71d
SHA1

d8e3c57eed81675ff5c8b26fac53159203b70a3a
SHA256

db54952e34d79727b4723a8c72a2fccf6b0cd3cfb24d392993de962c441b5d18
SHA512

8c5361a19c7a69f5025d19543c396655ea1e8a1971f8cb4df340cd5c4d2b64ec25ad9184ea7ee27d4c3888757a9adc7a59835c2e407ad75ae00413784e9df9bc
SSDEEP

384:iic/7NlHRV3nP73SXoFn1EppMkm9iyo1eU/+8ybwA:hc/7/HRRD3nippMif28/A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8F4D111-E0BE-11EE-A7EB-E60682B688C9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416444007"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006a1855a872f1766a0d8be01c5fd8059166d711734a5b3d00c3f2fe487d9e11f0000000000e8000000002000020000000de87bd1144a5b3b6ff5b558fea0f40e3587f037dfc4f363fe32638b599b364a0200000004389b08cad47d7958ddf1a5b11e61608d9c288a847030d36f40a572eaf83ea1d4000000062fc3c30a028e2553ef256218793ffcee9e7431466bd981c8ff24edc7a04952182c14325154bd53a5f9c73c8a31e4d971822e26ea7e256e4fe2dca4832b014f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b149cecb74da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000015a493b0bb9fd8a592039c3b6b4055f2f45c7476b789479c54c6a0ae262d7c51000000000e8000000002000020000000376e57eb3800ae62af6906717718ce2b845fda687be69e76de74e68858e8fb2c90000000a72a93f26dc25c51bfafd7146a895f98fcc762d59b5e7f728b29213ae74f6a295f8ab21c076c85467d49b08acea61c9afe98cdf79d759c0de2bf874f54f56756695d79381564853da4cf6f9a3eff609fea0ee1f1f3c031aecb3138c23e3e3cbef56e022a77f25f7e54b7f695639f6e5336c97fcc5bf86e903f7dcde3b1dcac1dc56a0d046038cc84e854bd1e2d74307c4000000021446405d8cfb775a068dc585314dfad2b1d52e00a300fa0a8b8b3b3a35ac43f309795a2185daac4f19e0740eeb2efb0c57dbabe2e40eeab10d1612a578444a8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2968	2180	iexplore.exe	28
PID 2180 wrote to memory of 2968	2180	iexplore.exe	28
PID 2180 wrote to memory of 2968	2180	iexplore.exe	28
PID 2180 wrote to memory of 2968	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\combine_lang_model.1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c56941dcd3986add955798c9aa6997aa

SHA1
b0b4448383a51546e28a21f806806868bf5cbd23

SHA256
a8d4d8a164a90dc9e902229988bf3e50e4a5b016176993d244573e6cf51c0bde

SHA512
6bb575c2506e12288e05c2f22e913c06a16e144c5ecec018b2daafa73917fd6f951fd154d3bcd8071efd22b5a02b7fde80e2ea9dc7693ed5f6603fab91043b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b68af743a3fb27b6bdd678fef674ab26

SHA1
e165b46bb4f58fdbdee5f4e81cf19b0439a805a1

SHA256
7cead9232d78845b6b17cf5528581285935280c2522f7200e8014f5f9ae19cb5

SHA512
16ffd2ef28318e46ecf50e68c3eceee992707faf8be431cdbd52213ac0f72a0149b8aae15b0d4afea9de29309236fe217f2821be89a6010443ce0b7bd3e45a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32073de06698275dd30ceba7846bfc2d

SHA1
05b2b815c3f9dfcbdf699761b56c8f290137a5b8

SHA256
9e12e699fd7ff3cbb562cddc5b632a0c154bce26e56113ae59ae28446dee11e2

SHA512
e28a7379ef5d087dd14d22bb353e73c3ba090544c14f5f04c6ed7f9b700042b6dbfc4ae6f120dbdad372b349ce14008aa934d134c225c0272c51f388d0326840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63e4fc52b7b0e9aefc9fb7a0a13635a6

SHA1
12b20adcf3e17cb47358c3c4d87e93d74eaa6a43

SHA256
3e46ac9e40b83e49694011f0177b29fa45978f03b9cc278d32474aaa07ff1672

SHA512
79031aae9b75c31549621532cbdc1fca9a465bafbbb36e09a581fea6cf429f04de22c7b5fa3e552c5467e0aa984033367990712966ce39a190a6b5fc7f7c2914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33c71c0358a50180a8af590699f74b32

SHA1
b05664273f9800fded66a8e05d93d2a8e4e9d84c

SHA256
605fdb84371da4f3caff55d0d92c8ad6bf3e31fe2acee4b536f19f5513c73533

SHA512
f88e60f15bea8133a4c0af9ddefe94efdb7aafed15088003162556d4a3202716522c4fb79e96a49118dfef18bce861c6408da9a1707d639b5d25980742f088dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254eea58d67900a1e2409c838b1bb8b8

SHA1
10a7ceb6982a1e018fe03928dc4d616f7b125d0a

SHA256
226fecbf85321cf95e902d022ae496f1e8a8eb7c9bf0ce1f4b4590783bd6c802

SHA512
d21bdeb4001462f918230a9a0d8c07cbae9e60285e6bfc2d77fb0afbbd34d38e8c4c429477227242474e8fcf094f20eab84aab3fdccd708a0daf7d056fb604cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7ba101e1c753b4552f2923be8e23bf9

SHA1
be68dd0e8d33a5c65d539fa803a24fca2434b543

SHA256
60bb869a699e640758c6664c572ae78bc334aec0d775c8dda3da6403c4c70119

SHA512
148ea2caacd1c7019b5f75551961f0c5fb67ca9a015386fb310d9c6830f805cb5b4d8668e4ab2e0016417ebadd7a085c6beaef1ee64efaaa3555ffbbe4de900c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd67df41b3f8df555cdda00e0de4853

SHA1
0f74206f4e7834d25080dda3a4c2246b700ad156

SHA256
d57a6c044e172f6c020c0a7f5060da9fad5033e0bb877775caedf7a27df23e86

SHA512
95ea1f02f7fa181374f298598f552c2fd88bc090e48ad43106794999f2e8042fc4c266c6ea81f6450e3cd84db61b243a2cddabe82401fc0793f7dd03e31ad09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
038cc31e68f7c4029b624513ddc78547

SHA1
256695cd9118ce895bf9b3b5a25c941724f98275

SHA256
e206a1b039ed3b1a5fb077ca9120a4340c32216bb9bc7c936c21e0f8e7ee676e

SHA512
b5317af3a1dc6b028b4e3415047a2742a270c5b5bfaf3f60a4983b057ab4fe0800a5738433334138ed69b5f0e15ad130589bf1f00becf8c0cf6486cde9751461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf3228b75e43905eca7f7f59a831fd06

SHA1
bb2de66ca931965fa4156928e8bc7635b3b77a4e

SHA256
45db4a5304c4a9cc8dc0f074d8bad5c831a8b6f30b75ef08f1d1a5f6e0130e3a

SHA512
f773a714d04e3174f0e18481c68acfef4f907ec720a362ca0f036977fe6e7eb659f30816315993029b452dbccd6325a701c35a4b8331691759eeed94d277eb18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dea27037b7873f36894386b8f1bf4bc1

SHA1
d0ecb6237c7a6ebc278e88ed3b047cf587ca4f30

SHA256
f64d4dcb487d9a58a297d6816394817f4cb6518d91b060379861b9a56df0681e

SHA512
b24b57faffcbec96ff9ce6121c81b83e94209fe4c5ca98dbd22b38d09b9042015247293613e5dac0cf18da1f4a4957544af18e85404f6ce0967071662111e436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c27a54ebce6fd7e9e049bba585e2dd

SHA1
fdea39fef16ebb4929863da02c2f98beb01f9fc1

SHA256
2d91304387c27b4e610bc10744e98979d2f426ade80640b71218460a8c56432b

SHA512
a689a8bcf7a220147acf3ab3c0e2676a4e2119c58d22b88a81df6edd2142d5e5e36ee5fec9b4e85a2a9b17eb47cc1d4b64d9728c42d96050a5ab90b31d340c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e346f0d0868fd71b6d150ffba3ed06f

SHA1
f4d58337fedbbf7793a5d1e651a87191f53abf2e

SHA256
b62e8819e0891f70863da389566fc1f6802269e9ccdb00f9522df4cd2f4bd2a6

SHA512
84a089bd54fdc78eded316a418ff25681c4f7979b0aae657e567fd350972056839b99db75ee15da88dd00a49f015bec2f60186cfa3bc72d324255e2f5e48c53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6EE.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit