511045b2c12e5a36b894845641f40c637e3f28ad0f6920a3b4405dde0dec778f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HMacSha1.html
Size

4KB
MD5

e39a48344a342e23229ebdff21c9b28c
SHA1

805d9ab7ac938ca73d96448ad94363a49ae15fe6
SHA256

511045b2c12e5a36b894845641f40c637e3f28ad0f6920a3b4405dde0dec778f
SHA512

ad5a5c20987d02706e06a8ddd6e907652ddba471a7fb9ca7bea044838a4815e0dbf95e782b21c53865d5d1d8851dc1c9e168a04216ccbac1b7378f034af756f4
SSDEEP

96:ovTJBHBJDJgJLJpcJhCJz+aCJzkvJd1JzUJcJzLJgMN4GGwDHyZCFREyRUswWL:ovFNVM9OAOUdDs4J3NOonx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FFDFCF1-1A96-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064a509bb8b39c34b8b5c9db91a37160b0000000002000000000010660000000100002000000065c89247374b350bc43699bf7f0213088844afaab657f50b1b0e702de70a32a1000000000e800000000200002000000052a6c8cf1d515b95568d7095d0c2889355920311cdd93409b688005ae35e4e5f20000000c0523c6ce00b029271208ad241921e88a39cd0cad879573a0cccea0a1ebd88bf40000000be0b551c595eb386cfa86b4b031dfc3f17bb73979de56ecffc9c0f29ffb665f2aaa3976f5596b21726a71204ae38b9b1bcbcf648a84a1d3eb5ad880ddc1a8f2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01b0a75a3aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064a509bb8b39c34b8b5c9db91a37160b000000000200000000001066000000010000200000009728bf0b40a0dd9560d9ec29460e478f88a96fafb2ecc0cbc62d0a7c2b454689000000000e80000000020000200000008b3084eb7eebefa6607261363e309c7d1c93af0ec0687c356212532a9d4fdede90000000964885ff7696e57f4c6eff225f3d1614731ac507b9c3c33464f828fca61694aae62a0868312397e0679674109d3e93a8bbf4c4317a3b12c585828cdd99c1508366d77e6071b0a2c8acdf513dd9dd4653527c67bc473b3425e0b678c841978453b9451a61d66422669cc334b5dc7b2b2dc8f921f7591c967945943bc87f39b7a447bc6ca6f4f907fc37023beed155720340000000baf34ad815b6f72905b9800b61cfdc85e6761140450f6af30ec93836c8560f5d299ac362bf099146bcd80c071ecc2a02caa04fe33959bd33971aec53fc46d3ac	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422803853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	iexplore.exe
1336	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2632	1336	iexplore.exe	28
PID 1336 wrote to memory of 2632	1336	iexplore.exe	28
PID 1336 wrote to memory of 2632	1336	iexplore.exe	28
PID 1336 wrote to memory of 2632	1336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\HMacSha1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccabcc7c8f8d2601b601931cc8eb8dae

SHA1
f42829ee3ef254df20892ccabb2caf100b462210

SHA256
829c627a0e61101cc760905d2b895250b8688f06712ce12dee37008d2c5135c4

SHA512
dc7803b7f32be1a1e9f4222ccd0278528c5dfb1b37723a8273b2bc3806fc1291f1301474eae922708382b6022ccea0e2e3b2d4d92fbe9725de124ffe000fb415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d523a7b532a0dd01c7d9f0bce9b098d

SHA1
6ea54eeaec9b3375c56b28703ae17f018de764c6

SHA256
9d93dce5efbd6c0034321b78d233b52ba58f425b6c898058ee26c86c2eb15f1a

SHA512
1e6730457f3560c60ac31ed8aed79b3e3ada6bc01a763277d0a5303a181dd3cd20aca364fc5a8c920b990d845c83f3aa5299b3c5462ca7e51e7083939326a3cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f57c445ae053632168f3b1f89f7f367b

SHA1
2ac988b968edc3867f935fbce1cd08a502eeb721

SHA256
3ef05e5dd8526b435447af365bcf81a3990f1673c2c87d9b820ec2900abae269

SHA512
a736bd69becc5ff691e0b1deb49373fe1f64445b5478531b8e9de43573b152aad5599ad415702fb8a035e7c6c79e553e48826edb44658b020637b3d6f95f3006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2bc8a0388be2784ff5bad1668fbd39b

SHA1
f5e4edf3eecfe670a360653d7e194e3c59b5ad7b

SHA256
fc50a58f85e61926e87b2c90072d2ef639d3bcb0e495aa6fe618ef6fb8805b6c

SHA512
d68bfcdb1f2a739b02468bd25cbc9288cc909b278eb7c7f4ba1922e16eb37ceb84aaaa8264a6b06a01eb2cd80ecdeb27380fd2cefd5db1388f96c013f8a49d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ad8ed082e66a7ab84f0e00d75589bd

SHA1
54c8cc485d339cd07b85f813b5b75ae49cd068b6

SHA256
02e0fd858f530321f224f239698945fa4e6c0cb54390e3c496f279a74141f2fc

SHA512
6cf1e4d840c569a9c4d7bcd0947e0ffccf78087686bcd60cf0c9803be3fe3b578cc8997524710434c316fd9efc70c2b2db045365651e83495827657ab5412264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe52a6ed375b2a2c282f2fa06d4e44c

SHA1
a1c92645fe18db90ceb488d1bd780fb3ebf60876

SHA256
c6b78d43a37d4bb5a3170126fe74708e2f0630627a6037d4ec6831a522b3ad35

SHA512
f79d7bb8af681cb00d03afb71a2c8e6d5225607dc62f5d59fa200c436501719ba8707a922226266cc887262ee63fbd32fbefa008d8126e12da4801e309c469f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5e62e7cf9a888b33b170e7ac9ad84ef

SHA1
b09d7575ade57b18c5063e772e72a27f5ff0bd64

SHA256
c5ed0a4bf92605edf5a5a995015c27be26d8f39e7415ec46ca4b5149cc166d51

SHA512
e3c94fcb1b9b0c6e4ac14c7824897a5507ae033a659d6e094c0af676e05201af7dfb05a6f7860cd86538dae2dc029186c95fbc9eb39d21f5f7311b2563704c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d576df6c1b7038d7b0da525c2441500b

SHA1
4bb6e6f88d03188d3d055cdad7c0eb1c923ec363

SHA256
e9b5f1201aa28fc4f3369c618d802f70a7f2861c96b205bf5aa2c17af59a04e0

SHA512
945eabac7d409d8bb1b5690a2fb44fff2aaa2c92bce5193c35fb6a3510fb7eab3bb2425122269d0fade736d53471d26c4332f85ac4e9a940bbd8e9aadbb03334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30ed6931fef32b4bb098805e21edeb2

SHA1
b3b552af086615e9075cbc775a4525cb9efeaa18

SHA256
2c7902fc1785b92aced25d7cb7a7ecbcff3777fbfb7fec0fd866772d54a912ee

SHA512
ea02a06711b91fd06d8021a6e32b61841287320ca6e406bd54f24969ce8bd1cd8bf23ca47373d95c8182413e500350274ed71aa37cdd08756b3f69c59635e83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f64c2a15f2420bccecc75ba62588dc

SHA1
41905ba1d0f1258b659f879f5f9e3c9b8a8b4e57

SHA256
0c9df67b3bba920eb8bf61e9bb4174e0a2b8236d014270ddaf98bac4817c1d0e

SHA512
76ce611a712e433cf76d8d65589f54a13d6564af245791faf2fe6945a5a783a27bd0851e69d2ed3fd5ada728f7687d70f6630965da657c120bda7375dfce3be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54f52f0ad578f5b33a4f45db6235d170

SHA1
c5837fc9ba687f97ff4938075bf422b860eb1e66

SHA256
20694e132b9525d2fd5065fd003aae812c7ae468aee711f5853094d0a9e9d0be

SHA512
ae09a1681f379a88c3eb616781a66476916c090018a75059ed775b40f97a156eebba7d1d4dad45eed035197720796f460e9264334eae21f94e8517d5882a1b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132258b3dac1e823d1821d217b30508d

SHA1
272eb77b324ccda54bc2ea9a86301d1f5c15f5c0

SHA256
8b8ea1f81fb4a8a88cd28aecc7cd9c397e23d2cd8b9cf1a6020572939d0e5209

SHA512
7d80fe171ca977454b783b96004da430be541e9d3508da82d805a2fedd1d60053c1f80b1074d6701c97e9a0ddef0b317b6194240a038cc56705f0561b9edee26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f56c9a7f63975004d34770286a6ae32

SHA1
fdc9a9ef79df8c0d3bca834c2d594f58ab6dfe47

SHA256
d550d7a597700bd189ff1198e11df3cd72482e57d4cd8985eb0851bc9d22508f

SHA512
e4b4dec1211f53a57d205d5cae9b83e9d97c1dfec4710caa787144da994dd4b6832fec18181edd20e85ac4d1c4c0c848b06cce3cb522b4a8d4db1ec2aaf1248c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB11A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB22A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit