063d4a5982d6df538a78089e7be4fce84da94ebe2eaad1317f3b89eb93240a99

Resubmissions

19/04/2024, 05:15

240419-fxljqaag5t 1

19/04/2024, 05:11

240419-fvb79shf95 6

Analysis

max time kernel
7s
max time network
7s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9XAiwCpS.html
Size

2KB
MD5

75feb61fc44e926a03e3bc2d571de570
SHA1

dbfd9d6dd8aca06134ed344c28a508bb530c0944
SHA256

063d4a5982d6df538a78089e7be4fce84da94ebe2eaad1317f3b89eb93240a99
SHA512

69ba3e1f703f08b15015a006b4eb502801c6cedec2b91976894d246fdd48f984589728979ef8b6f9d5a3dd57dcd93fba0fe148e0aa72badcda94f7d185952425

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D09EBF41-FE0B-11EE-8A7C-66DD11CD6629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2492	1908	iexplore.exe	28
PID 1908 wrote to memory of 2492	1908	iexplore.exe	28
PID 1908 wrote to memory of 2492	1908	iexplore.exe	28
PID 1908 wrote to memory of 2492	1908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9XAiwCpS.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b6d47e5a8db9685436d8aea9665887

SHA1
359ae09125f0ae777dc7fdc98ed9f27ecbc69927

SHA256
8173ed00a5cde411dcd75985664269939fc0774fb7da3bb59b236d5073672cb6

SHA512
075da99ada2d8f8e012b6702ea9865855ee820d4a91266d36c36ee1a198c00119e7793c2b2448c6abd338cb7f8eff23c5b34850323f8c7b00a982ec6f0e2c7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1614832893b85e6870a4bc46e5556c68

SHA1
12f3ab10c271627502572d7cb210f2ca61f4e1c8

SHA256
4601465f15f6261fe47218273dd3994dd26f671b99d2e1755d887d2a55554a59

SHA512
f83cac2eea3c214f54282dffcb76f907a1416b1ea0f7a7ca58a334079f11556ff4fcda595a8eb135f202fc3caffd746c9e6150b38c5c1b99c3f77b1a1effe3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f68e02bf6071a37943043d9479271483

SHA1
48144eabd445080f3c6630c1e9ec2acf352e8f36

SHA256
fd3c63c51c732b3dab25963ee0a23e3fdb1c86229bf27e14657b877fdbd678a5

SHA512
7c17ab6d6ab6b3046eb9a83a4737e7e725693b474ae7cede9716566bc42034108450a43eb5bc11cc28b04e1447d501d3cc11ab088b2d05dceeb665e5a177412d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3026ea98e242414e1b64d5ef6f6a40d

SHA1
d63446b0846c398e0e40e32bab8fd90fac755e47

SHA256
f50b9952a43fec2ea97ccbf69644870c060c03e8fa84a0cca6baab6f3b634ba4

SHA512
f44291977ea300c3793570300a54365786f4e2419fffffab90c8f7fc9838b10a8d965add53474b4eb9f738776cb1ff237330c43183cf36cb8b8b4bea8892699c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ade4bf6854bd91bd322aa247063a95

SHA1
45708ce8e8a2a03bae21716d1b69404775a27d3f

SHA256
e427e415d75b079d13cd5673d5e113294534ecddb71a8cc6601c1100d0c4826b

SHA512
32d36a586553f444b26bec5bb5d9718c330c69d6195cb768f29510cdb2dc9e5b550ff336121667385aef7cdef715801d73c8a7246d042661297970cffe16ff06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
615fcf658fccb4980e31d2a2576f8805

SHA1
eb5619b2bfdd92370ba2151ed510b9f5a83d9485

SHA256
4971ddffdb8aaa6190e5257177fdb556587e3787524fda8825b4c88b0cfa0775

SHA512
bd11689ebd640107a12c30a54d665ac9d462b25d0b6254c999ec28b70db6b6aa750d8546012d6e77af9d5f39359e41253cdd48c6208019cf39e821dc556335e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bcdaeeda74f74403b63d3d1ee829f2e

SHA1
05d42deb0b3a47bed33cd4075ec0b437ed47307a

SHA256
ab89b38181df320281671c26f6c3477a7e0dd7c201df9aa1f3054273d9473b67

SHA512
2ec70977e91ba079c70508cf33107a1ca106c7cdcc96adf8d9080cb23ffb5747a6b149760c5d8c8fdeedb37caf8d3a04eae092401a466beb0261a137ceb32492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2746b23653fe2eb3435ca40ea63774b0

SHA1
09ee5c3912f527366eeabca2bcdd5290ef600636

SHA256
4c746fc6c51855e47049b20f15628190aa5b55d846642ff410b60abb6eb4c243

SHA512
488b02e2bb6364e1f4d70fa02a31df82fd2dddfb8682db1847a62a01fbd33eec7b51c0cd0b015839c170b135c975b141bd6fd1a21a38e1701e19b80e1d0c9485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
676b7907cf1763f9f9e3d6741fa40cef

SHA1
05377497527995185899ba70801c9e8f7df61af3

SHA256
98e828cd30b2625f53faede9536d28fc0867cf417b3e53a5eca2c7cec820422d

SHA512
461f18729c3cc9ef0dc24ac58a222ac9e1017b5c0f3eb6cd836bcd861abee7aff4e88b671f620d3598684f90b57ac5a7e1e330a94c2818a4571c914165af03ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2214.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22E6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit