3d37484d7ac385c0fc80723c3ccf1165519c4a8958d9192f91d054238f1ae2b7

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

open.html
Size

1KB
MD5

d2aba0afa25c23d5ea2f5bfecd331ef3
SHA1

098c9303f4ac562f5263bd8ea3842197b1ab361a
SHA256

3d37484d7ac385c0fc80723c3ccf1165519c4a8958d9192f91d054238f1ae2b7
SHA512

fdfe9639cb3cd47408e9157d09d14ca4c1b7ea37ccdae6533d353897a5d3fea4c2867ea1c2ee6addd4096f01df59f33e5857a2d53f40e69de8298851f01f1aba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000006a3eadc34d14e046de8093fb8e101fcae2fe7b03f69c1c32681cea40eeba995000000000e8000000002000020000000316e3253dcc31817cac6809cac9430b4ef6f35a1a97d8d4d598a48790cedca67200000000e5e918f25e24eeb0a6fa8e5cf42c2349c76dd902ea532e13681e3f2ccf593e040000000e04df8acb2bec4de630d852564aa61d9da711c217a4dcd88cc220211a4083f3f15ab29a3f02161f3d016321f97deab1190db6891bbf10ac5b8490793b012ef1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a024096765a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92B19061-0E58-11EF-AAE3-FED1941498E6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004f9c5852f9986c4fd50903a02eb9dffa408b0f02184129398f6146b2ba957451000000000e8000000002000020000000eeffc78b39cb15889d43485a430f37035c51ad6832abbdf912bb17782be659cf900000002ba094664f586b736f581428276ac740e3bc1d03e07e922b561f278016fc49cf339b6802415294460828335729d619766fd444a8a87cdee6155c5a647969a0cb2983b8f2bd051a6da2badbce0c2d719fc11416099d4bd5d9145f7d9f558278c8589e405946f91ab061d825b717c47d5022f91991149e89cd770327b92d645d9bc769209bf628cbfb08370aff444d8fb840000000691c529ee68312f6d212e044729a77dbebfbd81f7f0c5cc4572f195bcb32385231904be9d350462dae934ad10123ed74039d15afbe3d954c134f5754e037e758	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421457773"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2316	2256	iexplore.exe	28
PID 2256 wrote to memory of 2316	2256	iexplore.exe	28
PID 2256 wrote to memory of 2316	2256	iexplore.exe	28
PID 2256 wrote to memory of 2316	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\open.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88de2fcf4e11c73a52986842a6b3115f

SHA1
bc95613429f4509d3463d4b00def2026950edecd

SHA256
963f6d3a64b3f23462884827585e89dc93a0b094a7ccead8aa2f91ac03d162a1

SHA512
93a6461a801cc2ee33b5b247cc9a06d66d5ad6bac21897b65f1b1895029916eff0cf9dca5d2205e9bbf594879290d489dbf83816f901f76db3c1a9ddbdb3781a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e98298f13130bae48573070c3b878169

SHA1
962fafc6dbf3702cc59899749fc6973e27a81c2c

SHA256
02bc775a6178e41162c4c101de5a9822f4b37cad6bdb0cf18e9909d5542c4de6

SHA512
0cd87cf69d5fdb481667941012545a54821f7640df038a5f5b23acc4a9b0efc9eaa64839ec3b49d27cec5d7ce6213e00e0e39f72efac50c175e9f15819c09bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b8aa7bc4ed8a1d65ed4695bde465fd

SHA1
8404122ea2a8a799d6be6d664f168a739b5a87a1

SHA256
1ec02aa9447d51f7d76037f593cfc8f9af5b5e2f0b9046bb661fafd2115c96d9

SHA512
35bcc89855de195af6c11260b0b3f63f46186cd3395af01463e2700f470911c6db46966cd9617679efb57bb8cc3695cd713b9a91e54a69503f104c1f7166af59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ceb3a882e7c19abcd58e060ff39d02a

SHA1
e6f12c69340c8852affd3322b3f2e3efefbee1af

SHA256
2480b4f5dbfaa352cb40c2ae033f61186c82a692ef8754146bd9718a80b97b88

SHA512
4012b7a11f3bd0fce1a22d89a264ce196958282a862c8e97f89773e8c74baf5f50896d8d595757836ffe24bc59b0ee758bfa471c1fbaf5f48ffe602c6c5cd4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd59b475d659213b61131bac6b52da35

SHA1
2081610b136b675dc103ca4f4c867e456d88f512

SHA256
a97791d95618f32035c23c71bd0a6568db9384880fcc2de44f2d2487655f69b2

SHA512
de98bc3fd2525000cecb6f5c5a5df01772925958d1d23be6f1ab18392c6e2a41edfc826575651dff7eca1ff8ff8f6ef4736353c9b648b06f7e6f9f4a1cf4b70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bed6edf9d4cc55dac580cb24cd078b6

SHA1
11bda4213fa51e32ac31aefd6e8a63a54611ca70

SHA256
205c8754afaf93d97c9d93fee8cfaae40b821d3c4f8b368a2781556f25779bf1

SHA512
4740fbad579e927daaf59e0a7c8f4b74a501caae70522efde0dbcaacd606c44ad9730648bacc6ea76998bda6b248437d9b11ab550c622edebf1e7cf3c2ff4298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983d44c67825d50ff319f8d1e1f038f4

SHA1
2e091e771f6c2bb3501fbc6e9f52e521a75a6e4e

SHA256
65f314416c5582d8c4e480dabaafa50033731c90acad4ef0b0cbe5d3f95c544d

SHA512
9659b5ca7fe522f9dcbe3af893a8d8c404a1181a3234ddf687a46e771dfc38466d41474eb0d30aa27f0537e82a535cf90b01d0b288359c501bacc1b848ab53ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c0747acaf1f1592b81b67839466091

SHA1
e100add779feea2f121b46c2c11132892d69c32a

SHA256
8cd8b1333e2a828106c190eb409eb7e8bb2c839aa5a8943b73bbc67d5b1ef422

SHA512
ac5ea5ebe55bb844da49bc7f5ed7c0f49a6d0c8d9b4d2a22777e2c125edf957d55fb6566a853764c112230ceca6639e4da664addaf62d6d84172ca9315cffd64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0e96a6f0f78ecbab55617e18d7a6e9

SHA1
11535bf027fb20f8f39306d57dee422d89ff7d5e

SHA256
d3f51b9694d19920f598b8d8b0eaefbf9b1eedb19489eaa38015256ab697f4c3

SHA512
05caa147293b54d3068c88c0ec11313cdcf0ad221f696835375a4a19fcb0be0bbcbed92c96d33b323c99f53eeefdc4fa6db8cfd1121c33343077212de155ba40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7befc8e1a286e4d3d5323793e0cc27f9

SHA1
910f6be944034874a9ef6e0ed58bc13a9024f966

SHA256
055fb3953fb6ec79070f0772283b47fa42ea44a961bcf407be377d947fed1719

SHA512
2247035a2dc942fe4da785a5da5cd9c88bbe4cbec8885d7eb7481dd40ddff1245cfcd24727e4e5fcb4dfad3bc5c01d82c9d6eaf278a236c83365cfc0c4b4faf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CD5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit