8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435

Resubmissions

12/05/2024, 23:34

240512-3kexqsbf85 1

Analysis

max time kernel
30s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IH92TO.html
Size

1KB
MD5

0961eb13ef799b1c1f2a335965f343bd
SHA1

5d7ce0e0c0137d85da4d7ced88bff2bdba80ed20
SHA256

8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435
SHA512

554458650ceec6f091e6451ed3eb46141d98deba5cab9fc54c0b956b90939caf5d846edc6ae4d368d88a964c2259f5cf9fcadc8f7e610b30928ea65af9b5c777

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009c250d3471975d25a3dd6b27584bf45d7774e57867170bdb7aa0fa3763a181ce000000000e8000000002000020000000e5ee9aed6da0d75fd1575072a7ac869e9928e4ab3a2e29714a0f4e59ec673c8d900000009af4ba849a9221522cfbed30fe65ea969df28328dd07d9a8c93e8d630b7283afca08f38779ffb20a14ffe777847edd5b080166f7ad180ff108449d0f5d98fc9122952a87edc9c6c899fb2874426fd9863a554773c8b8347ebadd8c373d12ea7ef9ffa6e60123a58b0fb5f50c8b9d41c62a3b1f906e03878aea220f4c1cf07af1764762ccd2a699461d912e14e5e50d254000000033603114e3e7899de80e6880ac05bb594f06368a7a1d315d6dd840f732b92f0cc20204fac4b321dca709b61608196a456bf5e6b2c41f231118e3795a64cd15a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26D634B1-10B8-11EF-B390-D62CE60191A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000be42e9315e602dfce35ce3f2583a8ef37e45327d8441a0156c362c1cc93b3802000000000e8000000002000020000000f34489747d324c282d9ed36970124722e4d41fb7c7f52d711d92824bc45aeab12000000041d22cbdaa4512758742a3bb21def13718af52ed28bef0e0c2d851b110e88ecc400000004768c5d0d9d5362320b63c87e16065000e8f474c383ffb22e5ebace9c228ca0436107eab7bf73e04f8107700918310ba8496dcd885d2190118bf82553c651e2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a34cfbc4a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2492	2228	iexplore.exe	28
PID 2228 wrote to memory of 2492	2228	iexplore.exe	28
PID 2228 wrote to memory of 2492	2228	iexplore.exe	28
PID 2228 wrote to memory of 2492	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\IH92TO.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c7f7d78a4b6c9f946fc4d0bc5c8f1a5

SHA1
e77ce793cc7ddb4a5fccb1b47ad549c7e763d171

SHA256
9b1d538adb372367376df192fed0e25b539c2e5fbee54d4d55560449bb2a3f0a

SHA512
311e4fb3982da12afbb2e1c0022c0dd609fe3eb4bd5c2c77cf142ca58b3a4d31a29d16c78a2ba262338e666f0774a4d7f114b04c4ebeae4a191b7bd0dfa4744b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c4a25be81897e678e8b47a999b1b45

SHA1
f7a1c09381c1030ffa607210b8f38ca276335868

SHA256
a5b7ab022bf6243afe78c878f641da601e36d8e9d18ac170ac4f5fa10e3e61e3

SHA512
1fd3d16a26ed08b57e52577ecd0d39421f66d599d277b97cd16ac819df7e8c9baf5fe715ae616f248bb329f67f4c5c7d2b07b929bc940093d3e160fb4d664c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44c41934788efa44e5064a0a149112dc

SHA1
82d3525cb29f50f083628bdeca9e9de142aa1eeb

SHA256
31c761a1b9f3dfccb9b2905167c953f7a32c19e7cbafff91df6687cc670520c7

SHA512
bec0c694f3b804fe1c0ffc2b9d3292150e065175be8187f856400224720f208e4aa419407bc0624f32cfa1d1752bb252da7b4dfbbd9bcf0a13b9978820e640ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f695675fac64cc24d43ed70ca163aec3

SHA1
c79fb758d4fc667b6aa022d8b215e6f48b618cb2

SHA256
c888ee7f87b2a32f65785de26b9d83cf4b6167666a2a14b781506edd0d0687da

SHA512
7c63d80413bc705e7961c0e59c1028cf8e3dfdd7ed637ffcccbdb4b85c8e5a19a46a1b217df8d808ddb557b3198ba4032865882aeb26b7f65e58da8de2139154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb57a2440354a331479f12a5ccb39e3

SHA1
55acf2b4dd77d0d12dc0604072f0c68a7e1786ca

SHA256
0d4ee999ed2857be910123b7d3f9df8ea74e5e934865852de821e4f60e4da8a5

SHA512
9b1a6480e90f2aa4a79971d404cf718b3d48b536d736db350d3e6a181c60f35cec9d3d6a935b2d1ed41b883759a37a8dc5053f0a200c7e23e43c310e19dd5e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
037f8cd65c4afa22150ba8ab00f3a590

SHA1
c98148a715766db545397b2b1f49b70fb40f9c3c

SHA256
d21256b0c9601f5f91238b4a5303b6dfedd5ab09dd061bdb451024aad6591e93

SHA512
34c4f78831efc2aedcdd827748579c6eb5349817118657ad741f58f20d656ed4ebc658303233bce7efe08ac22ed6311e7234dd70ad5454ef57e67e704739cde2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35ec48c0d3b8b85fcf64f9a377f54a08

SHA1
9a69d267c76e0416a9743c3d97a66dd90686215a

SHA256
6c6137f5998d2f6f029db1fef81674f86196f468c80ab93506aece8b618bbbfc

SHA512
6dfd95e5f8a686e210a30dbdc6bbd6c388a6dbe5fa992aceddb58bae9d13bcaf58ca66d32925e35a343862fcee7c482cf90f61083020f341a4a0dfb45521c3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86664b564547366f804917d2b9a65397

SHA1
263a309e84b54baa57868a6b83ced0e3029ffae8

SHA256
5cd21995e7cd8cf34d13af817765a4a3be36fdad93f645779c2c88b7a78021c7

SHA512
a93616736de06ba871e11e718f827a1f8071d7f2989ad691ff0bd885fef1504bda4999399dd84b0a689626ac145f1de3c59ef83897c60bc92fc1837b36214c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
487b5fe14bd56c9e1d308d83e6336591

SHA1
d49cd4c0b46618d6a4e09943f69ecaecdfbbfaa2

SHA256
4bb109eace16538193cd2c1664f7bc2e1da071586bace0018b00bdf80cdb64e1

SHA512
d4fee20005ee4a17c544b84f8655c86bcf83393dd5314e1b6d102ec9bdd5b20f8faee3c7ab45f7ea24ceb77f9225f3285d24c9af8e5f06c08d3edd9897ab46dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34AA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34FB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit