1278fce7d3446e34bc6c46b7262ddb63c34c848696d428a24c896b9c700c1203

Analysis

max time kernel
132s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403-18.htm
Size

1KB
MD5

56dc72e6d4312b109ec4862c045d00d6
SHA1

35cb8a074b875326de6d4206feb631479c47e782
SHA256

0246ad30d0589512453a988e290c7c0a3d3a74dfaa7213f3716ef3ebf7c0b4d3
SHA512

7c7a1b996fec2e28b30533b297517bd5d621f0b7beac69b87c08742146028c6dfc9e34f3e391226d72f7723e54a3833877dca09b820299497ea7167395f1869b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422305323"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b236e04dcb08a384f547792666c68ed02a7e8d83ac00b34cc7ca8bdb3635a6d6000000000e800000000200002000000020f6604e2f8752929bfb62c2ae4aaed3b56a52ec2865b2b7d072ffbb2c76ab0b90000000b3ad1b0e1a1c4e431088c91e5d575d69141513fc3045393ec6c17d002b27dc31772feb103030039b273a29fbc3c3d35faedbe9b027c8163a0a26c93f663563d7414f52db61c6f6563eb47cf589090f534e242f07fca643873b1f566286c271b5973257980317fbc290d7bd9e3f0787b3f7ddf639d622d82503330f83bff40d7a792bbba31ee3b140259392c9c237c2b440000000c199015adbd517b2d052a83fdca0e4bdec4d719d8ef63a6960f7fa070fcac472b877eded92e759ba5fca9235d6b0286b1b996f3e7af91d499bad19fd5ccec0cf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDF689F1-160D-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000047068dd7360ec181b8695524fea5d31a8c4fb8d4c69e48c69c4eb879b7c5f6000000000e800000000200002000000055e3c6e0f972fc1506ac6775a0afe81a030b8f0f785077ef7cb0685e5bf5efe620000000af4071b074f603986ccc114c991733519edf7f1c25e5d7e7f21aaa08664570554000000022b7faa0239be200db0703c63e3de3ba38a80cbc4546586c783fdebfde55e0f919cb29a4f6c4a70008e85a939bc6d9cfba847d10c90df5e5dc8431f68778e3ce	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b286c21aaada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1328	3000	iexplore.exe	28
PID 3000 wrote to memory of 1328	3000	iexplore.exe	28
PID 3000 wrote to memory of 1328	3000	iexplore.exe	28
PID 3000 wrote to memory of 1328	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\403-18.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62854ed92d6cd281018608c47431cb61

SHA1
a9d819de5b585f7228d338a57df2b2f94d08b09e

SHA256
240102d8f716c94c0f4c239af1201f13abe1f4726526c483ad1545258ea0cbf5

SHA512
fad28b153d77af29fdfc1ecbe80171c25f3732a310d54ecf81786a1a81e6e1665b3201ac5bb0711d4d9e48db1663ed0dd2b52bfbb48123daa1b232a4f8ea3816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af994429a73256c26496db31fe5f80f1

SHA1
8ae4e7d1b7804804dc494d4d1798ec82fa15046d

SHA256
57395f4845231c1981e0054a1117c45ecd7855baaafe9fde5cf69e57ee9126b7

SHA512
03aaff03a192f73c489194a569c68cc5ba72d5bb3e0b690149db11dc10b090a06717596c7eeb1fd256c35b9f25a3316cf553c555a2fe6f8267c16e18f96d54cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18c68e606caccd8ae4e68bb3837998b3

SHA1
91d7767be8fdd7104d927664d329074d03b8588c

SHA256
d239ac242943df7e9a9b7e17dbd88447c66bba286a8ef42c4d66432b82d61b42

SHA512
75e41c56104eeab364c9d28d27719377a88805b5bee85c70ac77b6ece18831fd81142df6df2eb0d5bafc02c40e6fef4708caf39fe57a8fb6cbe4d20613737a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6897f011d173369fb1ad2709396a4b7a

SHA1
774a18bbf7cb604f42e10db66084faa567543562

SHA256
e768c02a5af85ec67d8d02b627ea66bb3b47564db8cb16491e0aa14d792130b5

SHA512
5241e2facfaaccfdea18b8e29c171d97b05f336250159845c81dc11a677e20397559fcbcaa38bc92f957a48aba5126cb17baf378a6d036cc6fd04d4f99fe5115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fde34d9add8c9e975871e7e3330a86

SHA1
a150ae903caf1e6f4b3d4dcce7f5bcedf362746d

SHA256
ac17f5faa8dcc2a71d3a1bacd15b1fe0866e41f061269b099c3241a73a0f1e73

SHA512
84b5e2c8f1e121aa165540c5821fa597e936a9e23f1b987781fb6d8094b1f53c89e199c524a8b5b32118118635bdb68591473ff4fbe0ab0faea528e738abbf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9399d8e802d9d184d118a3261c5744bd

SHA1
e7f927755d2311f1784b594127b9418b7485d8f3

SHA256
fec8cdc8e1533f050093c4fdf2620e3a03928ee1f574c3a4c05b8b71b8f44a16

SHA512
4989fb4ba3601c10e0fd25924b8eea5d6a75c271eac6c18c629047cb8508b300617b464d1f45ea6042fedcb33c0c11b60586efdafcb967ccfaa498e30a56aff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32806844562375c93eeb065999bca3bf

SHA1
e063755460fb4464ea2c91e74eb1a131a28c8685

SHA256
78ef88c4983be23f1abe2c2ef6ec597c10c5c5fbdb94ed780c4756f0d5ed505d

SHA512
148104190f7a0c81152ae9e93dc50f1cefbcc30382d301b35ce03f05dbe571a0fc0d44fe1d8e921005ebf35b1a08375652824bba8327f39eced5d0b0dc3b1518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7844f2d8b2dce8dc9657fb99f81f0a

SHA1
d38219498acefaef678ab3e5f0abb2f4915d6b96

SHA256
e472bddd8e1c5d0cab6dd9202a422fe2db92e07138e906860d7be58b4ef4ce99

SHA512
5ac910a9f49a42c9cca2708e06ae5916d9558054e86b30e1173fbe0758c925d99a4574293868726e23e01865f27950b0b192b631c80f0e0651cc465316d56d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dedbc0f4b576bdd946dd309fb51f1229

SHA1
a1c7fc0ef08adfd8e5b7b92f3286e39a5084fb61

SHA256
8bd0dd5425d450727a56df65bb73c4dd9e3a0abdb497c88e554e043ad23237a1

SHA512
16d3ee70bab7164ebcd240f74f00a5950a3f9ff6c31847b4493e08faa963edac35c43a53517c4028a385d7960d2250cdc7d12f27b38c29f9eb56014bae6873fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dee297d5bc92c79e82baa691aa4931d

SHA1
aba2ce163a0ff119d94acc46ce3557e3e31aaf03

SHA256
4d4b9b5a6b624d21e3d3a931d63c56326a38496d10dc9b498bd0d069dfda6136

SHA512
797adbaac9e847b86f4ce65f43f93d1713b75c8c98245480651287c623ac3ceda6d005fc1e0c82d0938632dc4b288af71b5111fd2b037fbf68a448313aa04601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f71e7f4ffc71080ada964b3a96c811c

SHA1
f4c656bf8b666d44460255a9988f2945931de163

SHA256
6e69f8cf9782cf2ef1c1577449ac12ae0e3989577fda92035197ee247967374a

SHA512
bdf6e63f5f40373398657977cf3000e2af3f2fb529714387ea398ca4389abcd688a3c6bbc4ead34b1dc89069438b732cafb6eadd4f5f93d1377d825fc0435918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecd8ec90a316c82e48d66454ca03e262

SHA1
b163578e2c535980dd84d5d3762a67c160ad47e9

SHA256
283e6ea0d199ac51f1a80ddc97c2363fba5f9b87c2818792ba59bc29b7ddb0be

SHA512
a7378bf14a29460331d3dd851ef2c7e31e53af0049e26a6095ce78856ba6ba11af3f0aa9d847f54f60cfe752c5ac1547933c0942fcff4a372972c59aef6626d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c62ddc1456dcf14cf08dd08bfa9c7f

SHA1
7ca4744751d83d03fbadfe865778af536f8c6025

SHA256
dce1a53fbf656a0fd0e51a9d3ee63e5a3d2949f6f69811d04efcf837a34c812d

SHA512
d568cf0b6a3f26c1cc59a90340e0c9acfdc54d0ab19dcf7fee3b66a8f59a6e0f496dc532ea74fad72f4269c17181e9a614567dae76a9ecafbd0b71b9330dcf31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7b83ce4ea83ff67ddddf2166b94d5e

SHA1
f46b528e7eb976d95dca465056d37ef5b6f2d3e7

SHA256
748f349ee7afbd618c319147c916246231a73cdfb503444c4109d11e9c92ac76

SHA512
49bd97857e7b8c7a47a4d90e9526229f8b7facb76e6424abf5d4d38501192e100cdbe1820eaed75de299229d3ffb3553a969715ccf950822a6a89b14d8cfd853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26cf74b0d90607633d9d8a62d8bdf835

SHA1
a06bfdc1e7836490d3e435b514950c159621c897

SHA256
8bf5e889ecb18945dc53bf7eb04c841e7c134e1ee74d0ad1bc9d23b3e35f82cb

SHA512
aa1f10c9ccf06e001a8fd327148d5b58a3cdd5249a9ea55e8a8134d99d1e51a5fa483c73154ed44d9f29d0233296e90b1e6478c1cc5ec5a753a28b9a458ac03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a12f17d853084e1edd4b05dddedb752

SHA1
18c4d89982f574e4e271976b021bbb068b23b6ca

SHA256
46110949e1ea3fa4912ca7bf65a5ef5a7a14dd8da2770e2e74731c88c60c5433

SHA512
e3474c7fc0fcdab9e6791a93585d317b0703b53c46ff241f7e41e5728ec4946ac3afe834f3250a2e84ed756809a3348fe0281c29820aaf62346ad0b88b7ae210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400462d03e17287ece3715bbcd85890a

SHA1
b1f78c9696d5c682f5e2511eca55800f7c1b299f

SHA256
e674cc37fefc98e89df183e9af328579b904a7497a13958ea21f738e60158b5d

SHA512
36b7b12aa77e3e3e5c349b1e7ec22804d46f0fbe587b046b296cff17db1f249238d03ebb743fa92b499f8dde928a741cb2178519b394f019dda74897d18f37bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab453D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45AE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit