4a12d2d2897cb486c1103ae032dbc1f72582b685db72cb76c23847fbff23cbf3

Analysis

max time kernel
842s
max time network
847s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d46qRZxkpW2.html
Size

4KB
MD5

eae2145c95a1da128ce9f58f72e56ad8
SHA1

bf018116ce09d7406ab88e651ad5c5ed655ed700
SHA256

4a12d2d2897cb486c1103ae032dbc1f72582b685db72cb76c23847fbff23cbf3
SHA512

cbd560da0d11860977f25e2128a2a711b89dbeb0698aafd12f349daafed915eabba79d4bb4979bb3cdab45bf910bbc667f6590e61068190ec893a2e709a53081
SSDEEP

96:3EAEwbtDOsauy9U+BuakJE2MQTJ0WsQhLiTyW8:3EV8tDOsauVVpMQTJ0B0LiTyW8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf0e76582ba58d4d91a4572a8d44be9b00000000020000000000106600000001000020000000a839871dcb80cf49c711845526a4438edca23b06d9d94380e8abf14381da9ff7000000000e8000000002000020000000bcd25af268c8c35289b96ea6c94bb80d71ae89158a4480e5d2307db29fd8c20420000000ced1a4b4bf1696efa7ef2ac0471d38d84bbeebd035f5c2996f8f6328211bc98d400000004cc48fc989621f5ba9716dfd7a5b52232d035aa4509e18550071f2b7335bd27fee43ed263f1f148379d7df474439839515e30ff7e8cf50293149e05db3c042b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422718299"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf0e76582ba58d4d91a4572a8d44be9b000000000200000000001066000000010000200000005bf6890157638790fd30ebe2a2396098710f37740f06488ae6944a621d17a4ac000000000e800000000200002000000012fc0d2d8bebb9c788857686d3e1e2d881551d4fa365da696dd6cae4a0267a2f9000000000e2684f6fc9543670737a15c230689f9033bc859a95eabcf98c402a9578c9cb6531c631458996e5e32081dbd8bd3bb1c39a8462ad6dc6a4ab110b9a60dc6a35bdab893761158aab2f64a7c48f32878593056400aad71b6ae8624275e724fe276a0d9f109a028a6356bb617f3f2366b5237047b84d9bfb75f5b1fe0990395d8c165a45f955c4a466292b56b8bd686b4240000000c80e10854568c0e1249013ac7748cbcc0a27378f3472ac44ec0ccc82c9fd5ef903479977a6b089c8e0ed06761a32d7f9ba10588727cd710b50818a5501c4fc12	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7588F7D1-19CF-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4029814adcadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2768	iexplore.exe
2768	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28
PID 2768 wrote to memory of 2892	2768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d46qRZxkpW2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a69f425cb41f912090d5ad4e0d24700c

SHA1
b56242b1e6c57ee0c8d6f8ec4aa6d788805d7bb7

SHA256
64da9af5dad58d71abb42f57d241c47d52cfb91722fa3c5cf08924d61904b796

SHA512
9924808106b6a046cd3ca72bac6209b597330fccc59b4dc72f7cab4a0701b1f9e5da4be0a6df6342dde60495271cbdbd210decae89b0b5753b86779caeb395c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd6b71eb8386fb58b78db9b79614c6af

SHA1
1aeddb2b0906e1979dac12418d1f458948e78f6d

SHA256
acf801d6d32367fb728d34c3664ad265071a6f8af80f3a9ba2ea95ef4b76093c

SHA512
fdeb2df57052871cb147270fd4959080985f1abfe4cedb0d24f47022ecf87e1ac53b2d99a1a44ab0d9471c104c60d1f30d693a2832cda799b31fc893491079f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ed387b177b6f6af24eb509f435bb71

SHA1
e75cf3a315c53b2a913db1953178b41ab38671d2

SHA256
967fdf5dbd0a49b4260a57cb1d4cea333c085ff21223d6afe1c7f89cea6559cb

SHA512
65e6e621ed4454d76a5976f17bcab60a60ce7412476e49b2bd4385b8c90b9a5a610c52e349050a092023bd2053efd8e586fa205a5ff1fa3e2ef6d373f09d45d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc816e7c0016936d112c731f6562a21

SHA1
a0261275fff6bbbd5006465939d9796fec32e7b0

SHA256
4656ffb04149f231b2f552406cc55ba63edd241214129696da1addf4f6deb820

SHA512
4e197c05ae6052c8f138dae65dccf139468b3ccf738d7225a43b238ae02d9b8807894a270a74f3053ef122520d2b17e32f55342c4e21229d96f87595eeb350eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
151e11451f3eb94a5c482d612ab8056b

SHA1
6d21a5992c39a61aeec5d5d1c15a7bb37361e95e

SHA256
4f07acd7d76b34794eeb2e90bea5acb91f38de30e5713a96ab6b1bbb3824cb5a

SHA512
016d31996abf1da73e017cceb4cef0fa3a459010146ddb288fdc5dd843d6e8da139380b9a8f229bfef152c90cc9502c787eaa918610282a6e8c217ef5b46ad39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96cf547a2ecda917aa04d3536ad0c97

SHA1
eebef432d9c7bb68dc32c54f97403e9c1f1a084f

SHA256
2c3961b171d3275b91f06decd9cb99413f4ff3dd2479d688dbdc79f314f50b06

SHA512
e85cb3054298bbc4d7cf3c61a09705007fa774b1089a2a3e907af3550208e845de24859560af467181f904a5ad4cb74a6c93b7a3afcd1896be8907759867f1b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5196fae4d2635b344f378bed53af0f

SHA1
09f8fedaa409d5d22b6f08533ed326536215b053

SHA256
360c05948e73bc61f535359e62e90b96e1a4493fab70e6eaf201b53aa8ead325

SHA512
8e506910a6b27f4c639efde9d9c76711ba560697d35cc64f27e13d9e88c1401c44f794d1de4ad3a8116af89303312a6f6b3820afd4d1e48a819909fa93ea3a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac7a1443007b698f94e34c12c9d4ea4

SHA1
309e6160d4248382f68de8ecf64b758417ac8c50

SHA256
c212cb823f527e1fe7dbd10968d729c24434c0835ce3b8413aa861efbcb5d277

SHA512
c00632bb5bf9f3f2f3edcb01cbed63b692e69e71ba986a528a993ae664ea691ff880a43688bec3ec80c1b096af21f4e8039960668bd4ec840fc39548044f250a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a074dbbcfe0abe36175e8711b20d596

SHA1
1a07923e7b26f341fdb8adcb031aee14a3b2b921

SHA256
236b1a41cf0441841fa2cb407ca8e053ebea192fe835ea2be55a4f65e322bfa2

SHA512
102bbfae0636ea380e65a8ac5b976004f93d445378e6ad93f9ad08d7db457d4fdf155c818b39d0fe4aea17907dae0503f3bb128fc2a9657830da16ea1f021d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb67d0e6fcb404eb5648100da64e4f80

SHA1
cc6b269c171e4ef74137c185bd8ed5352f3cbcd8

SHA256
43d0e3850f5e55cd688577c8fe9300793eb20d985c5260979d160c9f6e5d84a6

SHA512
936c1e67cb799236d3a23750a0a14b7081de725a5383d28f6d76c3aa03c7b57e0544870affc8814700d5134cc846b4926ac675e000c2d9a21e5fa35e5da88226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d703c03f80d48117ae4cde3e7110124

SHA1
fb22a4c7a272e46bcd70ed5333fb39fd6ad20f34

SHA256
d135d8d294ced39e21f488f7d1c92ee80a029a850602050b03809735f889d76d

SHA512
ba583ce311b4972be08b7f4552e6e453f252d29887d7f5974e56feee74f5bf213820306a5e5985388e37617b11ab26ab1bac2fca10770b26c05a4a3f73a04559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e766b0cb9aafe7e8b716c0587f907d3

SHA1
f363447f96e3741e1a66e726e09fdefb80aafbb1

SHA256
38def08a92feacdb4c672416eede64c171b245d48446cbcd3a841740a26a8d43

SHA512
c5dc77a9691245e1b8ba75f316d2ccff1a0697c8c98e91569d0f45ada34a71ebdca24834f54f06c793500fbb1158ce9b9fd37fb36041d9a2d0962baadfa9f748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2f5328e35a9efe8f5579fa517e68afe

SHA1
3d173726770a291f4b2796dd895b2ca25b563d2a

SHA256
46ef7139f367ccaef19a795bf0e77e96446bb11bbbff385977f0470ea283b33d

SHA512
ac09aa04d043d27d5a40dd8d9b399cc63e86ad623c1b83d82c48772b09e8fd88d1bd0cac2ab289c252264a09902fad4607446fbc4011b580ae6b15d007956147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc249435539addcf82bb24ac7e8a9bf5

SHA1
dc9cee9b29ef2e207882a85fa35a4edf22ca5519

SHA256
3cd9414e05073ac60919c17abfffd9ae63f024d635560a4e77afbfafe7548726

SHA512
e6e23cbaccd43856019cfb775ce011d90978e39c9a677ffcc71554fe05860fab4620cb3c4567cbed66f2363c817faf1004c1f4bada68bb1f1bc850185ee70196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68ed43331145e626fd04697e7cfa6da

SHA1
06920bec117ea7fc74a8605865936f9370388e94

SHA256
e4f15dcc5a743d729541e166df56cef8c470718415a216babd1f4cad920067e2

SHA512
5d3783f0c9a39f0244ef0ec85cc0d08d81fc88e3078c16d7053fcb9cfb78709818b0a89977ddf1f5e6b986ae0422a848dc11e96bbf2ee1765f6482ca07fae9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5dbd76c74ea35ad9e5d490d01beffd9

SHA1
c1d931901c14bd419d3ba45c677f4fd930d8494d

SHA256
495657b4ddd32e295aff7490df679834dcc97dd0869e9349e5a235d85c1b766b

SHA512
3a0c4de9fd5d111e99ecea7601e195d7a3e5fc60affe97c5707fc8f3257bbda715f340dc9bbc8f58ab73eef7fc01de784a96359b4fd3c3aad244c2fb8a979803

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB206.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB249.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit