8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IH92TO.html
Size

1KB
MD5

0961eb13ef799b1c1f2a335965f343bd
SHA1

5d7ce0e0c0137d85da4d7ced88bff2bdba80ed20
SHA256

8ef0aa04db9fe87fe3e9d92103882dde1531a55f8c7fcbceda55f8ae4f501435
SHA512

554458650ceec6f091e6451ed3eb46141d98deba5cab9fc54c0b956b90939caf5d846edc6ae4d368d88a964c2259f5cf9fcadc8f7e610b30928ea65af9b5c777

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a0085dc5a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000072073d10cb314a6e707ba65747ecd745b59dffe4f89b580c5464eee1a10b83a1000000000e8000000002000020000000700c36ba850ccfd0027cf4ad6cf3585f7540be90abc8bc1189961aa549855e3a900000005084331feb8c8c87873909b61160a5766d580baef69e2763f16bc28309293ae6297451e1754d5bc90c127fb4868de431bb0f9872a0e2a2f90304ab88e1be14fa420bc246c4a4f87778ff02ef6bc7c6a98f29f96bcdf08fac43e9a36191db78c1c01a23991b1857aff281fa32f37844edd11a7b7ee5932f25278fd03e44c35f1eb023a428f92ebdfb8664df62b58b4565400000002dc5a4aeb90a7a79ce7fbd83f053d402eab2dc88c756161d74e54710c3643cb8ea1c3f2683540dc26b13bddd5418894dd53e60e561d72282a1dcdd65ae95295a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421718889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000685bac684f4d6f9a98cac42ef6a5a2942148e28a7b4042e96041a6366a94bc6a000000000e800000000200002000000026c6d47fa7c0bc7fba0f4043f500cd32a86e9c840fe24fc0d147eafc9c79b6cc20000000e44841894afd8a1c4762e701c8f26621502085dfbac449c96ab807b7244b6f1840000000ab10c3832d3955e348e43414b4d74d9f6f986683782ad917134fff6fba2bfd285851cc4a30807761085528d15ba6f1cb4941d88e249cf70d9378253dfd8c5d73	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88968F11-10B8-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\IH92TO.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12169c0755658ab7f2022f129e7719d4

SHA1
b22d0ef4ab6a25dd9b84d12568bd658c4a609df3

SHA256
378170a99d1566615cefcdd0ff1d8ecfc5a5deaf56d9d71435fea3d71458092b

SHA512
f2f2f6be695f9591f9449fc5d06e8da5cef2260a83d1999b06893a5bf71cfddc26136448169370dde7d65fb18818da164d3cb6bbad1b6395e25d75819ef552ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72ea0f9d5143650252a9942ca9b5c407

SHA1
5b905ada13f5470ea51e45eaaa98a78895120038

SHA256
1d3ef4136c95f60a9bb9438d87159c8c3a7eff46d662c448d8c2d2ec2dee6383

SHA512
0549623c512de211ac3d29fc0cb155680fa037bb5b3d74f5842ca3f5ace847bc8b98aeff46dcc17c35e81a404669dfd5b3070484586e03046e7acaa37b5494ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7af792407e6c1dec67f298ebc86ffb0d

SHA1
9e7450578a272c384fd46e9286510597770e6e70

SHA256
359c3cb02752754f6decfbf0d7c5366ed61b989b5f437e407bff7cb1c70922a0

SHA512
7261d8336e592e220e7209b08845283e5ca45a313f95f0769fc1870c095b31ac20f4201ece228947fa9313255eef50983789357a2b33b2386ced817e26b10910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eefb2f63309475337d0ca7140c83546

SHA1
5fe0e1fc4b7e69d8e3ff6cd7d8ccad43d537a72a

SHA256
989f36e2adff8dca00b00b8fc747ea7d7d07c30e5f42b547400418dd674a3def

SHA512
60c9c32c7982f50e8c24dc05195785aac3fa39cd3961cc1011dd6a6bb29fa5831039d38e83323feca26b2d7af7ad375c53f38d620d9697142f389d7a4f51947c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1daabec256b2ebbcde542e3e85eb619d

SHA1
9961883d59e52b39c779f1314cdc24dc1f8a9f0d

SHA256
2835f5de653b996394de58f191ae25718243a8dfb62c5461f5744e911e81b8dd

SHA512
47a1267fcf86218db83aa1e6a931c6e68055aa35225d365b500f511aae40df1786ae636db8fb0edf595b4254948f9d3c31d481417464bfe6e987fde2f291b2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40efac50b46c1f5c27bcd392d5cb9d80

SHA1
660e5a5e4208359321048f7ee16fd614b6e9a573

SHA256
84e28e22c86cf8976b52562c25df55e4f33eaddc3f994e8168e3e15da78787d4

SHA512
451c8081e64d3c8c357a194ac71f1d5d3a9eafc47bccb3db3beb6e90dba6c5fd6116576685a03af82fd7ec9492b04a2d83717e930b8e88b9b583215e7e9bfb62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8006c5f93192d237474f52c4ab7e614

SHA1
b5408c41baec8ff83301a01bbde1ce7090376015

SHA256
5eac13594c4e6f75f26b5677ea6ff196eb7aa19a185581ca823b6eb0a71a9ed2

SHA512
10d7738ffdb791d455173cab46925aef5ade4497ab5ef2e730e9709d509a2f9ca5819e4abc81ead7a8550c9c2a692e99191ae5a52483a550ca2fdaee56d261f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0ed814e18a83ecc0b198146b0566df

SHA1
1d2343e293fe60fa7cc918bffe6d9daa3c2fa7ff

SHA256
783e1d7e3b9edfbed9d9220959f62ebf23ad5aa8b22c17067d7ddac46edde4af

SHA512
193720306fae5718d30a07eb02e7b200745c9b64b44088719c234953c4225a5492c3224f0c76a7a874da7a6ab960a29adac080abbb4e92187bd2c317c68da361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b121e257486164f17c4bab01501907ce

SHA1
02fc3c53716540e421d946d12b599c95b978cc37

SHA256
823d3232b218f5af61286b7cbce8b0a1e533f2afb02cd9e48ff8c5fc052db4c4

SHA512
24b455dcf114a95f6f4ddfe55ed02bc71911820a8157c2abc6d98e4dc72fdb3fdf3fd76a8973f9d0a06377952d9ea927e35ba920afcfbc54a7d214d45413342f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cb3c6a8cc8b3984a79d4aecf883402

SHA1
51f101ed00afddd549036eeb4d1598c69af8b4b4

SHA256
90bec904ec9c53fc0d10fbf3958fe552ff2839859fd9b4c885ddf36b05a1709a

SHA512
0190c72ce03dcafc868feb708c8f393cda40ce8b8f12f4536d4055b40b6592397050811d000781db04ba1fcf5133a178d2db6d8686bf931636489f66bc788380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab29ab10240594600d78ed4d83b40be

SHA1
a839c111502e3b2c3c0f96991d82a5106188d47b

SHA256
18c3cd76fd1d5018e7ea957855bf3023dfb56ba71072791471d6592062b62502

SHA512
95462c6ca63350ec59033d62a4a6a598caf43f35a793ae0ef6a2976fdaead78aa72b7aee7c2787caddf2d6653e72fab580f3bfdad492dd415cfd46dfa80b2292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3601.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3652.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit