f3fae7b42dd57978162789e12fdce0cdb7cbff2fd5505630f0c064f50cccfcd5

Analysis

max time kernel
137s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6a1effb5414b9a0face7cc74196b1b9.html
Size

377KB
MD5

d6a1effb5414b9a0face7cc74196b1b9
SHA1

ea03a91cccb53356bcbf56f7a9f520f8a6c4128d
SHA256

f3fae7b42dd57978162789e12fdce0cdb7cbff2fd5505630f0c064f50cccfcd5
SHA512

b9318bf1244413bf8d0ebe143144ee062c5dc835287791da00e910c7053b2cc07602b135f7612539d1c94c3d5b2d7a0edb5a24f36bbcc3773b04da3d069e3e9d
SSDEEP

6144:yBI96aMVs758V2w2c4JXFk0dzEhIEhGwqLyZuE5n7+of7EFKN2moLY:bAy58Vl0FjEhIEhxuYDf7EFKUmZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417029052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{226A9191-E611-11EE-B0AE-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2932	2472	iexplore.exe	28
PID 2472 wrote to memory of 2932	2472	iexplore.exe	28
PID 2472 wrote to memory of 2932	2472	iexplore.exe	28
PID 2472 wrote to memory of 2932	2472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6a1effb5414b9a0face7cc74196b1b9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5366dca66d8e2437747c4dc8d6ddf42f

SHA1
413dc3dd3deb25c98331a0a81ac19a3357aa96c4

SHA256
88649f1f8f304c48483741dff933edf67f6a9a875e047226983eb5ea96d27f6c

SHA512
9174cf10ed9dbd09d36e9f6f4448c71e3e43f5362ebcab302c7cc90351e8cc53bcc4487601bbb788b3f791ee3c515be8c4d165845bc7d7792bd64d70551c949f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e51e908c67003843a034f3b362b4d6f1

SHA1
09587165e4a346a9c4bb44e108e3be153e17b3a7

SHA256
b8392913b80af9409b44cb2a5a40e2ed85fe3baddd64a694509d9f10dc839a4a

SHA512
cabb8e15d906e1ab0fb06f4c10aa2e62319b3c1d6f13c6c77698d0ea89096c8675272667d3e4be6a97d3d1aa57cd2e307773c8570c89af497c915b26ff3f7a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceeddbb0b637efb7ca4dad931264d591

SHA1
3472e545290b2ad5526f071c520cede2f1b1ca63

SHA256
982f442850a9df63df4a223ba68c458147e77d468bab3d26846da9ae22be97cd

SHA512
14dca22612258b3efe2b7d0f8b9d9b65cc5d05a9d65a2cd9bb60c0899425ac9a8a132c86266f40176bac7a8dd6203f8cdd86daaabbf2dd940d0d23a9c6b7dde1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58cf38321c8cee8bc6032c310733cc7

SHA1
c808b81b766b868f4284f0f695079bc11ab5c82f

SHA256
843fa75fe1d435816836a73775368be8244116de80fc7a34485971313eb92a1c

SHA512
930da28e66b538e36629b9615c7abe0d380abe189b3b447fa86e24feaff20e17447e1eaf45526b20928e30a94405ad4edfe289b820f3f1e25ed3074ecc89dbae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
164ba7460a2e113cdc0c9f1b6e79fd6a

SHA1
10500dfb01985499d3fd32d5fadffe78d286e84b

SHA256
d2c1f5e812000e578b569ea4e89c405e05eb867293168cd768a7e93ed9444b53

SHA512
8e2aee36ece428f606a5cb394c890222ff19cd585a73569bb05c834590679cbfa12edcbf2845a545d3d2ef61b3691e02ebec28621f006cf303f2cfc99494eedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace95d2f4cb088f7ebeeb73f74d67864

SHA1
c357bf9bbdd6bdf12f6dfb16c405dcf881f4a976

SHA256
5671368346381e40aa809cc74305a3711217b8a5e22566beb01cdbfc94df5cc3

SHA512
cff7621a47b139d6262f2edb0afeb089292efd867f12036aeb8e6ab92264272e351e298f1909b72c7f93f1db99ea19adce1aa18a421aeda5eb02914571cccea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dba59d1f99da8b18b9e3123d6566f6d4

SHA1
de5010e9b69e679c6b64fab9223bacead5832cc7

SHA256
4bb38726131791b3f157f55c1c9c7888baf746af106b3161edea5ce75935e914

SHA512
cb146fb5085a09a46306b02deb385225e954a43bbd874b01971ab9e8c203976cc8776bb1fa128981b21c810ec73a4c2c1d2a6d096dac4064bb133817773fd1e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA42C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA603.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA637.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit