91933211b717ce96d3d28d94c700e8fc6f90c9eeaf4a36498d15ce352d3a7f34

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4757412f5d03ebbed70183eb2665c09.html
Size

22KB
MD5

c4757412f5d03ebbed70183eb2665c09
SHA1

30c9804ed5cc72c52d6731bf4f06a403b1f94d9c
SHA256

91933211b717ce96d3d28d94c700e8fc6f90c9eeaf4a36498d15ce352d3a7f34
SHA512

6104846d21b21343429c814db79f6eb4f70603f9db5bda39c6c84a73de8551768fe5bb547ed5a22733aefcdec6552e33b369ab3a96957e2b3db22356d11f3418
SSDEEP

384:F4TgJi1HQubxLxYxzxx3L2HlaQkMQ4wJ8MJ7L1v2GkBK2FqMbLqffUqWvmZ:en1HQgxLxYxFx72HQMQE0N2bbs+LY1Z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416450397"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000b8f423aa16f6943d788a271fbd675e1fd1d8a12265934c9c1f8e87caf4594018000000000e80000000020000200000000588b8ca87a3a9eff44d58eba4f0f5eae6127b09ab9de386361a3eaba8e1a7be200000004f81959c074f92590fb9233fa68f4a93e73d312ac7ff093ef7b86a6ded0e87df40000000eb77e8dd4fad13304abe9098354d010a47fbb70379c5c33cfe52471fe35bd276a821b6a210a0e64a9d34cd0e720beb03feaf2241520446f27b327b538deace29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCCFA001-E0CD-11EE-8C39-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000e311a08a8472d614d2e3104db42496922d81818a2f9e9ee324108349a1aa3b20000000000e800000000200002000000073c82d786773f5654c05fbeb02e5db5eb00d05c720455fdb54285af25b82542f900000004ba0bc62f52078e7194d8f572bfc7e1a24ca79231fe5b0030fc79d0d12fc4d8e6e5d8511c24669e0163100e3613d18d10fb322f3c7f31841ce1e46c0bdb04cd0cb69c87eda250e71cf1804da9db515f1e397f27e494400bb7dfdc5f6902ef7b120a37a75b3158a26d31ac09a98e5763415fb0463575107c33c3d98db898a694282e7e276f072b3c6a620b1d0ffc5021340000000e06f740e219d129891edef1fb5c0f929f822ef10bd0e8025243574f5bd0a31addc29cc768c647b59136eb7c3ffe86bf1406fa8ee51327ce1de715417472cd06a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409d4eb2da74da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1692	2264	iexplore.exe	28
PID 2264 wrote to memory of 1692	2264	iexplore.exe	28
PID 2264 wrote to memory of 1692	2264	iexplore.exe	28
PID 2264 wrote to memory of 1692	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4757412f5d03ebbed70183eb2665c09.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d74b2e05a5ec054941cd23e0204c87e7

SHA1
25768ab6d027d70b5321eb2567f3c85b8006d729

SHA256
22aa539438b4b3c8a75e867534742e422eebdf470845ea4150de8d982df2fafc

SHA512
0c23b70a5eb94225e8ffa8d1da6dad20a3d7e022cf38a07d495285180f4b06f784fc4a3d82a9c44ed797ad9603a800daf7353e7fdda0e31c4daeb0bb1e14e2cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b138b3543de42250b49279598bd736

SHA1
0900fd3b8be9e649e815498031fa2494cf40a63c

SHA256
f7d5f340f32f1605c2887bb0244f8242ac33ad45bcf9ac5252ebf9cb8fce5966

SHA512
ebc7aabb5bafd5018e87cb42601d77eb60570c3ce5cad21fe94655d90da74ee9d357bb64679d30b7f3de3989c221e8e459a9611b1b4532990c9537af0fce7ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e16812269d5ccab0312fbe3cecd8545f

SHA1
ab4deeadda62ab384033a2c100e3524a1e0fc94d

SHA256
471548b8bcf8fc69f8233bc0d88b948138b52516d6e18abff41138c1742bf99b

SHA512
e497741ddce87df1b706763cdfebc1d2998b6ba1148e9117b9cca41ccf78a06c7b6ca29e11d78c7aacb74852c93f0197841db01d5c572655304fe09faac5cf12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d02ba05a77ad05a66c288a47fe9fe89

SHA1
fdd1aa6e63269103647762233f6ff3091dc7985b

SHA256
6fc1d5bf1f607262296edb985195cc8d8f0eda06e151d112cc7c375c800eee16

SHA512
dd2525dd122ca68c7d740647b4d28efceb83420a1b2f6e4c9dda16254e8e2f9313a0410ce941f0f8bcecac209299dcf4e4240fb6ee092365421b73f64e6dc6f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a51f08f55025990de6afdbd60f5b90

SHA1
d2fab3c3085f9b5a2a2424264204d8f85892aa5f

SHA256
a21ecf4667dd13cf71c3228381c5abd8a51677ce0e70a4a5e50327b7d9e53f7f

SHA512
599cbc670f522601316dd76c162ab2c7d42af3cb88150581331d90f7c177a7a9d40f05541851d449fc97ff6dcd8a538d8e8cd7632c59c925c2cf3a4fd7b28951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c5dd62330e8039f7ddab7a51d299193

SHA1
f809777a2ad528f2068cbf2a7708ed7605fdd127

SHA256
2b13494b3616ae04a109b988c515e4c488fae57b1f3465637ae06279b1400128

SHA512
548fe9d8a7a548ccec36de7025b632169d487c9f3365104c76eb163c035f311c2fad7c71b98fd8813481646cf421ed25a55c317b5e73c6bc5056ab50eced344e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
860943c12f957b6ce53a695863930f24

SHA1
0019fa75d5491fc7efe9613327ed89ba4892089b

SHA256
0c3b784966896a2a85fc6769682277084303a4d406a8c98b3a114d30bc3af30b

SHA512
736e718d07664e399f08b07ba82947409213c6ca06ea9d2623618bf76d72394b67ab430cfc38d8696655441d7f7f9464669459c38d10fc64e7cac30b4f24b49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ac849b5e3c1b3be59f3c5d76ab95f3a

SHA1
b4c54b2f56c30719893a72a5b7af2a74c7d2c664

SHA256
bb6c52d4cfaae8caec39c4d1e5685f4d035b12bb51a3bb564de7a897adb35620

SHA512
ce1320195cfd9ca717eedd349ccc53ddabe09bd618469f32eb79ff427ad13a758b908794f11cae7644ac5f6d285ca8c89cb03f45156880f73f27fa4c1be7f497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6e9024d0f9c10f9be8589e0e930578

SHA1
def38078584acd161e8b868256cbf74fa5ba844f

SHA256
9295cb027ef981182cc7794f36263594db82e236e0f7bd06a9f439dad1b37c56

SHA512
372b98ef1d43bd9d8cfbd053f39d04f0564f7f5d32250a751a08885b7e112e19ae1ac6be296d859d3d3282b1fb7fec9d0e327b385d6e947d0caa13cae997eea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba0b82d26692962ed8be2f1da1c6c412

SHA1
a5a2dfa2de43426d2e9e450d03d0f53a39999602

SHA256
0eef1620c37d2a235fe5543a205f977c05fb8c5c624f61cb650e89231c19dba5

SHA512
7353688af85abaa6c3bb8672d987c0acb7d1a9df5490f7586d0957bfb47b84ef2ed471c79442ef0ffbd4ccb0684dc35ab2a1b33a58c0d76c7afb8b0bfc9ae124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62756d7a7c2e40669720e4919ea8894d

SHA1
5da65fcd1c9452176c665104ed1b517062fb288a

SHA256
fb34f0f91f514b86dd303ec59b9eb3e2073b37e5bd84516047550d4d65c662db

SHA512
fb2a06506a1f20874149bfda76fc2d1134ec635fa0b6b00e8d9962f1f677f5fac95e5d799d263dbb6fad65133da95ae7d96384033ea0bbee25cf2ad5219af9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab932E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D14.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit