c614b8e596c98d57dc4507e2a5373a00af865100a4435cfdef577b3879dc8664

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

13KB
MD5

c1a2dd48cc1364c771be7062593088c7
SHA1

494ebfc1f138176099e2699345d111fbb6f02b8e
SHA256

05da1e0eb4b3f8739046a840d45c6a273470eafdeb9c7bead66556a6a0ff5eaa
SHA512

303835306f99b3bb159734d9a7310b5cf7fd654853061766c2fc9e6b89feb41f0b0a7742ff2df1f09849a31d38780f1685f94c58db3d8009f2045b03b7a989cf
SSDEEP

384:grNZVgTD9B+PwxKg5KEkLKiIND6rVxLKiINDcn:grNZEDP+aKg5KECKXNDIVBKXNDcn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{928E1DE1-F76C-11EE-9782-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60237f67798bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000008fe10c102a358d58376aeef1fffb8b2e3a2c61d3392b7d164e5e1c4eb9586356000000000e800000000200002000000089361b7d14a0901a619ea6d9eca597d2c26c110ceba8b174ff1c8fe5acef5fcb900000003e7107b110584c0bdfe932a4febd79dfbb9c063f0f9002a7ec69e59202360f4a6c1ec03c7ecf82190a60db1c76348d2cd9a99fbc1283a0165eab5f33ad16988de16f8af740560e37562691ce743d6e7db430afe2dfeebadbcad94b281acce06314c57a80dabf4072dc7b96a2c025278b674ad605ef6b190afaf5a6fd78a2c9e2fd26f45e22fa2cea113a096351770047400000003505731448dfe543bd58c0c305482e909e27c5f4bd5c6a96784e63e847bcdf9483b3c6ea395e87343c6dd7d8bb1fb90d07de926fc69cb864209e6639b341d39c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000004b154c35e94853ab6c15987802e637642c01a56140eae5fd4f0becc995570c23000000000e800000000200002000000057744d2d5ea3510329f3575f30f79d9d570b0840b15f83ffbbba38fabc9cbad820000000c8f2559b2e57fbf554922c989f834febb09161ee9590a5130d76becc2ad2529640000000acfbc5a0410826e682ae61bcbe8fa55617f90c93da41aa3009dc0b36673b5c70cad7e681c47fc2872b4856143a650c4237946731b5ed6b2bece338f0431f5533	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418937490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3048	840	iexplore.exe	28
PID 840 wrote to memory of 3048	840	iexplore.exe	28
PID 840 wrote to memory of 3048	840	iexplore.exe	28
PID 840 wrote to memory of 3048	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df425f82d83dee63b8a893e773d3287a

SHA1
12417da1aa97f6725e50603b3a9b57fcc2a20af7

SHA256
140abb048daadfbbdd814ebfe5473bf0c9d6e756a5693142992b08fd31337358

SHA512
adbc388872c810cac1c1626c953a55ac89b2a54a7351c9cddbf7a9ad1392762d5565878d3159f5be2bc60f4585602863525cdd2a7febd867f5f54d1847b08ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cce944f8bedeeddeb95db32069f52b3

SHA1
addb3727cf28997e6e322ce01b326fe68ef7d31b

SHA256
8eaa2dee6ae40fa47b25e4ba6be2d0db398532d6dbeda6bbfa116889b0ee49b1

SHA512
a113bcfa6d49896793bba6edad2195de4ebbe4cd51089463f458bb3ba7fac0d477e7915fab680544d246150afe1e9fd4c7d407ac58e3ac9c092a8852389ad6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5addca90d5824a0ab714716a61ee72

SHA1
96e8d26ab167022332c320403149c9897d26b771

SHA256
411f94517c134680d7df50bdccaf101b24cc9665da285cdd376284e90ba9a07d

SHA512
2acfbe10255bce437dfaa50c8f85adc5d11cff48f29634c8441e3e91ddc6c99a4b2f8e2b4219541b3b8753a33e009d424afa654f3c5df8b68bce53ce8d19659c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d6458f3ea140c696613ae310da3e8ce

SHA1
75873e9ef468eb890aa45194ba4860e312f8eb20

SHA256
33d5be0a8164b3ddba746f597a34ea2c2bc434342d95d9fe6a0dad75320f4fde

SHA512
b605a9361a1ded7b64846f5b2fb735415b0cd60f10994b0ff224430c0de1da53db3d314642f29fd89cbc5d9018dafda1b4514d02079202587a16a560a0c16ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a51441ed42f34508d1639f745b77a13

SHA1
75c25b8c9a9db5f1ad61d3eb246d116a010b49fd

SHA256
289e9f64d9705a86b9e8345def0b76bebcb6432e9a3ae07e9689d8339b41806a

SHA512
ae88ce361e8612c7d89ad40a5d308ebefbd7f3f2f20eff361a5f9f40f9d83690f2fb1eb24fafeec33e65af667a0d4eb4fd4f629c10208c855a4145dbe7e6c777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c01acd773a43f75b2e64238c0f3d7863

SHA1
bc33fdb54b9f1f26d17b1bb01652cfa5596446ea

SHA256
08548bd1ee39b5731102d2341cb487642a3b0a36b95a42c14955a042759e269b

SHA512
60d35ab83f2c93690e5307988f13a316a3e8f6e6c9c407cd2803d74ca6dd47c8a62c5171c8432307fa4e818db31bf30a729eaf9e4f4dc7b9528f3a617bec3ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5645fda9274acc5b544ae12db6b51b29

SHA1
b2df36dd094034136ba8bd81c22ad9a9594587a2

SHA256
adbc2d910d4be5d1c0f1aa82b4ee5273d178d64d6a0e2a4efc394ba424aa7ee1

SHA512
0a3da575326641b612435847d15ad0636db6954960a62a11edf0d2305ff775c3880b1a7ef952439e9949a9cfd1191f630572d09a03cddbc746f5695c1e03f380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99f11d9b7224e5102d08bbfabc4a709

SHA1
654378aa4852b09b26fbe0c2df48cc0d08cd63e4

SHA256
41cb8734d69065b72c487f474554fa97c2cf39564c7c35529b69a02f0398e61b

SHA512
cd0861c57be57e864a891818bf833a17dbcb9170259ecbeaee20c8a9132c0e562bddd1dae01b3a808eb018539a1a3fc021f2dbf87166f71bea9d757d1bd0a5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d44beb1e3df515868dbca2c61235a1c

SHA1
9958a479439fec221b98efa01f0db810c7d0a494

SHA256
61c1c5ae8c3d384672ac2f7cced7a9397760cfa28e64e6981281adba7f7c9d25

SHA512
55b7396c512c60385ba4a055ebc852a3620c21927d3c16a4f199f1a98a196ad2fde1a68598d958d9e4b4f381493b68d8e0b017378169c6a04eefe8ed4dbe3a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49fe8c77350d32887c83d7d0016f867

SHA1
52ad734373e916797f9256f40a72b1d1007563ef

SHA256
e388620176aba982a970e311fbd3176b7d9febd764c610b998bbeb0049bae03c

SHA512
a9a5495603f27b7f216587019a0571389d1349a72063cf1643a7678a6a6496ab0c056a6334f1309d8d7a1ee73c29856b6dd037fd75c10928aea36e2dc5eca797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b969f9c72eb0fc14d3fe3867534042

SHA1
1aa5474b24e55cf22757d61af0428aacc63a4586

SHA256
af9832610fdfcf80dba8af931044532b5f8a2b2a7d4438e195e29bdc543af0c6

SHA512
12fe93de6afcb6f8cc9bcd09f306b9499620525c4e3dbe3d27f3c9fd36a1abef034c55fecf99e45594e173b289935ab48cd5f5ed48759d3dfad82af510f9570b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7945d40094a80a1ea06c310acfe8352

SHA1
c4e3ce5a36c21b83c794f3cb4f1a4d59c1d9a5a7

SHA256
268978a1dafbf908c4fd0810d15b7ca4ede15e54c720af532f9c4a36aee40e11

SHA512
d4e2898bf1f736bf97ab122bb580a122f0e90c5132c4164357a3ec0a9b347fbc1949a1ec6917e9bc64212aba59ae5f42ddd4f710574ab4470e3158ade698879a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b0a22a519e6a1650a8f43b9654b07b

SHA1
303737da14bef41a9f0f62c699f80b2938a655b5

SHA256
65d90eecd9adc29d69a31f64c0cb02497c669e34ce14e42b3cd3c35aac559f63

SHA512
2d742700d2c2f3c7390daad693f959a0ddf585ba4a53647d3d2870d63edc4e40b7c2a2ed1b46007dbb5c2235bcf5766f15b5af47382bebaa067584115d3b5b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47c5206c5f6f1c617a6a5dd33bc64145

SHA1
54bc6050ed0e3f30aae6dc9164b48bfdd4e72def

SHA256
e34d2e008cb7c709c7c49804902a5e23482d46aa61beeec3f8baa5bac39c0c90

SHA512
3616cbc40e849ff87488aa637957641640ba0a4922959a1b8f97d01b765df4f788b46da8ff2ff07c412a7ffe94a0882379705fd6a0d52a73832186c1574a5c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9992050c9e5c60c8f6f2b959112ecd0d

SHA1
5a7c0ecd465fdd5972e9b611ee1e55f65ad0d9f6

SHA256
37470e214d1f3e5b055a586dbc1a88effae0f96cfa3687b3c44f16af427c3f85

SHA512
3348d9eba106801adb60a57d29063fa7575ced92e2b2d3a220a6c4c945b821a39ae7b0f8cb1d2eab2f9e963ea20881679d8e178aceb68cd8d7819d5be24c8e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc13c1251c09d5d9b8fda3064c0e1bb

SHA1
7ee5261be673a9614878e4446c7bd671a8c01931

SHA256
1cf4b83d8f5e258300db854810aff40659c043fd8ff28e0ddd1b2eb34dcf194f

SHA512
159182423b7f635a326c51e6a44236db0a82dd5ff27ebad1060e5218b061eab82c5776392ffbf04657a262119a856f6ac31d13da46c9895e59c8909843a45ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit