49d9667c5a159ae257212c0569877c9587b4eae9a129e9bc1b24782ef9f13395

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VvkxEIrL.html
Size

2KB
MD5

d05dc37df608d21ed1251bd7e3f3da83
SHA1

1aea5d34c3c9c61e36bc3f559e0d6b76d20a1045
SHA256

49d9667c5a159ae257212c0569877c9587b4eae9a129e9bc1b24782ef9f13395
SHA512

72c2735f1215cb9033c2e00c8d886e8f3b99baf0b49a947490d6cd07c257b3f4da47dff451d0031b7bd1513991d92a5ed23a3a0e741adcc208ed59c53a746b9b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000013225ea461e202e09580c08161342c1936ee6f54c21b69670ed9a3219a9f095000000000e800000000200002000000046dce5132140f9877f8672ebbad156d9c5e8669c71a48fd769df4b7a7392587390000000c11551cf498292f93c7476119a170651952dd4d90535361262526a64611f3a28ec8aa5fae34431ca46fd721a00d06a1700457ff76b83e77dc37224707a375a3766b143d4b4ba2949fc62d801c411b22c8eb165801f834e45a4de3569454c13d3e35079e6edbd247d27b9ab0c6989f949666afd80e57bfc077ab5dbb842ff596ea496ed5be698006395fc6e94a083e73f40000000f29e4334cb771183a02afbc81c860998d7eda7ff02eabe6492f696100270c970db4ad67047ab40cf721b6b6b0215c9a82a2a0c5789f96d183deac2db461496b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000726942c337713e0f53bfc96790d78a1dcd0ca639aed895a94e53211a8bb12270000000000e80000000020000200000008091f3d7dee98d546dbf164eae7ff082850708abaf0bfb867ee5db302761f6c7200000003af4382b3c4b685ffd1a48c99a1429112a5902259686d384a55fb685afb4a832400000006cc7eb7d4fbfdbd4b6289392c55ba7bd377214f1906fb1e9815f19608cd918d6704c942f78cc51ff8a57989ead26ec3cfe6b7b19888cdc55aae62a87a78dc66d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419807503"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C003931-FF56-11EE-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704198106393da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2180	1652	iexplore.exe	28
PID 1652 wrote to memory of 2180	1652	iexplore.exe	28
PID 1652 wrote to memory of 2180	1652	iexplore.exe	28
PID 1652 wrote to memory of 2180	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\VvkxEIrL.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d990eba8e75c75565e0bf8f379be8d

SHA1
6b763a5a1cee9a79f18dfbb98d48807b345233a3

SHA256
615604976e0be5c869abf4dbe249d759deb5321f24b9b0f9ad984239c533dc67

SHA512
5022144021e4fb7d03458f67028685321fa2084075bf281eecc50fea33fd5aae15d257a6cffa80fb2acac1d3261bf2c2bcccbae55adacee9b89ac5293ca48751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7030f37b936373a7ef72ceb3b43df097

SHA1
221bf3f847079da92cf0350cc152a41eb212252d

SHA256
ed9fcfca7d5ce1fb5954005b07d3abc1d607d8f9356d84f5a7f14ee434d54a46

SHA512
17d1303822d7443cb6d205dbfe8001d3871bda081ac381d49ac62fc8ec8f5f1d222d5832e8963d57169fa16de61c6999069911ca32ef95723c292795a93599fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b183ced31b6e884f90c7c12b36df38a

SHA1
9638aae1cf0c2560b215097f5c4e64b6861ff5f9

SHA256
9c72da824e03912ff91541c2388bc501d681c93b9149fbce8d2790f1afe09838

SHA512
16742bb245a31e318649159844676c62c13ff2d121a88ee460234cd982c3cef12612bf26c3f866a63e3fe028272d69ca56486182995777995d3066fd0e5d9b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cc0e8f3af898d47c8c003a9fad79a42

SHA1
cb8bcf8836abe7ff0f7fc3ae854485d49178a02c

SHA256
de2fd0aea9cbde52f5be411e4ffb2c8c7f5eb03a3b819500003d91379b6141f2

SHA512
def78c95ddd00196df62f656c3a17100e00f3ae481afa31aa333a49a747bf1542c052f3e51987949e90c9813ca6feda64d96b6372d1881d4bda10913f0ad4499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc6d0da788de4feb43dd0bbe72c8854

SHA1
be25ba2fb0fadb215746f1547885360d2695dbf3

SHA256
a1e4dd5b2f31328d3c1abdb0a8f6327cf0054c80ce1de11224b5d5ef06908f15

SHA512
de14c19462257f2f8cf5a95dee2252a60baf6a02bb3c2785d1379b189f222e05d705e320e43f60c9887ce3ec0875a4ab2c425483de22d6981ca86af5b21b483d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d04f15f3ce3e11d1bc91000ee3120e5

SHA1
6147a1a04817ef1e86725ad331244040a6f89638

SHA256
754268c9ea752fa1ebd80188f65aa5059b4e3f4b2aa916451bb70bfa363f23ad

SHA512
249b07c13aee993829e699119b249136a9a906a0b6d73d5d29a973c351b725931704b833247383f87c20cc480c02b84314be05bcfb7b4d56ad022b55a07cc107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50511b4449cd9b50ca966993e66f81e2

SHA1
d0a11425fa3500d16086ea26d5861921885e8dcb

SHA256
7de9e20dbbdce23390434e85e76f7c04df89082c1305a69837fb96632075be15

SHA512
3ef8fe9769d278482f52db5af7993506f498deaaa6ffef63bf09b5b2d32d35bc56fc4a28f22d75b464821411260f7a209074acc5b619b02a0fcb40be6c24eb38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06a8e33f3bc0e0f570c1ba83e4247e9

SHA1
e23767cc2e57bb53ed85f3441c84fc1c7bcb2e6c

SHA256
e54a8f56ae6051398bb49be82fd61e988f61c70624be114a024a336ffe144230

SHA512
7d8e0da2447b223538f7919e72065b43c6d8a386f80fa9b2b97bf1f9f89b2a151b87431ba467b777e593a89c45b1af31f2d4350a6e854a2a1f355872d7f097b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99c83813a6f9dcc46e295b81a1069363

SHA1
eaad83c8b383781d72dabc9c3da693c635883e48

SHA256
3c00096422b40db2d815e66bc83e37f626f61e649104fac8f4d1c5558cc98aa8

SHA512
61ed30189df96f9891f8ac3889d78fac11b2ba1919a7758eb97fd3b63a71692303aeab2b93ea83a3b0f1b63fbb6f7220beabf3fd5270e55be9455ef68f055085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3ff5783046b5660e32cd0129ad6875

SHA1
8eadafc56bcb309d0ea87a3f4f8e3778a87f8c80

SHA256
ef53e3f403ea582fc8a3fce158f996ce9f626c779805a307654d558342f6f3cd

SHA512
29f9a1cc96dce5b06e2fcd81dc3b9e80969c17f066dcbef61067e2b60c1fba3638210fb4622ac382e779f520ec54da49e49ff85735c9340098f0326c8108765f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c297aaaae1889fcc265f9e0df6ab72

SHA1
6ece61aa26d6589e57a9ee9802f1d2e9eca07a3a

SHA256
069d966dbc618320c627383067ce5e0eb7534f4cafe73e15e7d89f474c418e16

SHA512
281b289944a1d022fb5bda4865ec1dc818d84694251157fce0620bc85c8228aefb28243a0c435a7de4fe0dda810ec87db4653306d595e0c8ec22312b755a0988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a410a78bf3e8e65f6d51c80ba1df95

SHA1
f73ee5734cb4a69e8052ba7cbcc8398b4f29eea0

SHA256
51d7a28fa78077ce3c6a025965abb54f5750659758ec6dc4901ba0de0e951f39

SHA512
a9d8428ed6bc341dc267836191564541f0ce6c2bccdde3901c223c89f71058e4afae15d9a7f2f13fd133c77ec4f03434a250af84f0045fe0520d08cb0bf17fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33509b4925224c48b0a8710f9c0c04ea

SHA1
5509bf0001e4d23b58866ed48ad1680c8cac2642

SHA256
d2a32db4b50bab142b16c3671956c676cb2cf025efbfe0d9bf4a43bb9524b73f

SHA512
485b4fbfb6fd8ce7b488d95bdfce30b2df9db3bc9162503aae0a9aba33e013e1e0c5ed36bb9b449f92267168bad744f5aaf5dd6214df1846b75c593a10ea90fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a85d0b3312ac6504c9c152a62d26e63

SHA1
63b64bfc3dce133413283a89d25d2ac34f0fb556

SHA256
eb78eaffea433982a299e039c8a2de956326312fe5de89ab2368be69c6d63fbc

SHA512
41b640aa8f48e3c0a8addb88a78f6fc8fca5067accc1386bce449cce9abdf35d66a687e3a64139cedc6c7d6cfb800289b87e8cd61215467a9b8baddc02159152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c93b85c05b293f1ec0203a306a1a97

SHA1
35ad520ee3062a5a6f8af41548731942673e551b

SHA256
93c3aa69ef1bfdb9d45e1a44edbc1a33fd3469a448447cc38f33161db01694f9

SHA512
577bc72092e72c855496d6c23b442dd9715e5fb565418f614527b592355e433d31ca3e89a152dedafec473f6fead84b877047773093267477881030fd449f619

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3951.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit