9cbc1d70e5c48c84b419e60b41338a47bcdffc021bad92e596c16e134f90c71a

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

secure-email.html
Size

362KB
MD5

fd1fdd7f6ead73faf6466953e44b78e6
SHA1

f323cbe2cba8d2fff41b5c94dcec548d369478ba
SHA256

9cbc1d70e5c48c84b419e60b41338a47bcdffc021bad92e596c16e134f90c71a
SHA512

246a1c004898bae39f39e75d16a407c4e418dc207a0148774748dff1cd9dfdf98169fb6330cc1c4945cdef5e83d569838ea601cf5679dd02f69bb620f4ef3eaf
SSDEEP

6144:ppVmBiD3lP8BcBO+bOSYnbRxbKLI2k7BukUgcvb0Eol6r4sxIzIdoM:RfD3V8BEbOv10cZ7B1UJHMzq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004a44cd266ecaf3b5546852a05fe9cec97e10b5df0411af10d9faa692c5015743000000000e8000000002000020000000d535b49872551545b0ff8d4a64a5d5ad041d8e1909fb2957ed0545dcc7a8fb8a2000000049da16c63f546292dcf2cc510e80566d15b5f5b097e401515a9b52d74ede68d2400000001fb79d7d7debf3b8aa9706baacbb8a2d886570012a5867a040497ecf3a517f48ce5749bc3fcacedbb4e911726f1ef0b93c11ba7c9f44e8e74b884286b5523f70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004ef34c6c355ac6803c8579cea7022e49474abab336e4f92febb5d1bb1fcbd99a000000000e800000000200002000000073cf9162fcbe53b2d50f0962533ad4529be473d3b4c0294e318ef9c3985bb34c900000005c9e6250d68b0d060d1312cfbd3b857f56a7104774a2ba0f147593750d9e815bfd09edc4dd7d92b5fb8465449ab829594d911a00718f195584cb42951fcefb5d615f2bcf28b36c1500132167382724bcfe03dcc94b947c81dacd219abdd8014bd4fb2bae36328098746adab7d3b5e5bc0610d2fdeb01778b2fa54da78bf7f960decb46e1f409f86a82e4ceba07c97e9f400000008892598046f712065e2cd0907f7503e28f7da4e644412f89442ff663067a210a47adb557980102b086f07088c4c4b3c60837599be285075b50af74a17b6f42a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE426881-1CF3-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423063761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b041d5aa00b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1008	iexplore.exe
1008	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3000	1008	iexplore.exe	28
PID 1008 wrote to memory of 3000	1008	iexplore.exe	28
PID 1008 wrote to memory of 3000	1008	iexplore.exe	28
PID 1008 wrote to memory of 3000	1008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\secure-email.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45278675ff5e5390284b692c90a5b798

SHA1
674c5a842b61ab82bf49521aee7e68b802ba6da3

SHA256
7b972ade6e7e167936d4ebc702bf8a6a459b66920a17803a3ba7b44026faa316

SHA512
238dd15a8f017e52793df643b933a0432c1de0c756516925a0f2e84cb9258786e0a43bbc434a7b59267a1f99b5b234ced5ed7dfd95d52c20f739bf9eb01806c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40c93d24d2121e9a23d8c35ffe05bd8f

SHA1
233fc46f0c300428580e994939383b20d695576e

SHA256
03f514eae7f3a160f9127407bc436b3d13c3707c247d18062787fbaf9093e84e

SHA512
23bc3258230e7be7c82e1e3ec55a5929735d06dfe29bda5665b9b930d69f155b25480b5e69c2fd5f7d050f861864639ff84fea65ba3704c7026f4a78505d1c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb2ca6a178c5fe36cd5c41f51d7c56a8

SHA1
a30fa9a7064c1800630ce7a856768fc61164b5fe

SHA256
265da079070f83e4ee30752cdea1fc2491e5f5143c18eccf03f1d11a31d4cff8

SHA512
a5f8f8b738ea2a4d8d7fdee1bda354cd800ebb688f12f3e472986e65e857637f95f9aaf64a3d7002a66f57dad88e9aec9055a0a614348ae4de55f7737e89fd8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0cd35c24d8f93c1d7bd53aa8d9ea621

SHA1
70f62813975a2596ac1d786d3bbf8deac390c0b6

SHA256
8c217b912840b944e35fb4ac5cefa512392ac7fdbaf3beefc7975d6f47b0ce85

SHA512
f11bf69a56a40e53b476f76b1f36367835cb0d746b481daee1b6510ebca266e9ed9f87bbe08fc0426f8dcbc5eb39c2bbf5a7917d70891671d3ed32f830cd02a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7c57ab0a43d46b4ecc87ab596ec81e

SHA1
3f2020b9a518ad683b79d11ec288728fc64b0692

SHA256
38e19f4816ad9ad2a85d308278d7de71fe5d0c6c23cdd7f7b4e124581241be69

SHA512
c2bf36fdb7dc85391f59caf8ff7354001a113446700fd4d92b61d98e19f77651b4aa13ef35968759c7a7ac425df524712b8efc8be609e550bd07978a51641d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48026396a75eddd2a9fd745993c3d017

SHA1
8c1db7dc8bbab6a0f290bcd9673792fcc5cff9e3

SHA256
8708370f29442d9a5d5ed2b22d88c9d2d11a61105adcde13364b87da4fff4582

SHA512
5c8734c0177f105d277d991ea17e59c7a4928ae4e4b528206bba5e8067526364f3c654107c7e60b37b28ea939798a00ade0df85f3ad080627ebd55228b674c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9f9da51039a59e1eae4e62b37604277

SHA1
ffdeccee4b9f2b2bc8bc6e53b47c1b64f5320d21

SHA256
ddf69c8a9a051805e82d1014ea35e973be4d521683e6a5508c889e3d0ec16ac8

SHA512
227445838c423e54ed16b7b57157a3a969828982186459b7678e3ea5a7005f91796563bee050270aaf177bf7dbcef6f711f6b829dfaf822153a83a422da388ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71be38b7889733ca0d22206f074f86b

SHA1
9a2e24dbe7f12d6103f80c1b8846bfccb9baa5da

SHA256
492c1cd69dcef541ecbf6e678d0532179ecf2ef40a6fc0dd7f04c08293cbd123

SHA512
3fe0027fb1da3cd11b259c7d333b13b9b801307166630c99409596be8376d20b6f3c9c50260b8b6fa0955ab3251fc1bd3c138c836c334321e570ed5664220184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f55f8f756619caadbf4318ef02420c0f

SHA1
75858ff52a2a37e4860ccdf4a7a3c57a03f39117

SHA256
4c107dfc11e3461ad59622728c00a48479a5696717cf21ab590ef31c54a18ccd

SHA512
4fcf376580f6f47eb27294ebafb095b2a57f86dff321031d22698ae293ed2247e7b76a8c763e4ee47274f29b7900afd68a1a418d9324951e033ed39523f43d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f298488b8fbfde4f401bb0451e735b4

SHA1
619aa6934d5c6c93d1b0e9525383dd06a67d44c6

SHA256
42af5437ce27befb1f8fad1c3a448612076e3434631cf42d9d76c16328c6d422

SHA512
f67c1b99b1a4f9031632ab9a9efcd9326bf199aec1569fbb5267e70e75157d021dcf33918c535f7cfd58b238a43593482abfc68103d228e9984f096e7ac1a483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c023d34a89be1219507b30a14c8e241e

SHA1
82ee1048606d617b23db763d47e8e6437b2784d3

SHA256
0c0da530f0ccbf2e79985831948b1d882a88b7ef73491ea01bba2a80c1850872

SHA512
79bce4b4c86d681a26d15aebc9b6ecd8428b69b20a7ea40c0b7321bc2745a013a9896263ac84a2cfdbb7df6f38edb65a77b304c62a7dc33eb51123c7e9c8fc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef4b9cf7dd631d567671da25604f541

SHA1
244aaaaaa9dc283f6966b62d0987792a18bf636a

SHA256
3dd65aad7854b6e117e831b2a58c7c4506b5a6fe8f819090b20a0935904d9800

SHA512
02313e29ce136380c6d63e1160d904e8c171b9dca9f2a1274772ef611dc35056457a4170c87e2fb3050277a96eb7549794a91a836141a3f1fd5198cbb6d66fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41854f4bd890d1f53e8e55767e8760ca

SHA1
203372e79ce62260d18bb9cea1d9587eee81c908

SHA256
63ef21a6f42ff90ee5b37c946a75d499b9e95a7d61b9b1e8e19a8878827edd59

SHA512
68af822accf9c932a0475252a29dac0c2f5f8defa2aafca5b1dfb06af99a82c690b41e136014fd9c0b14b3e036d19772506c6024497b629533fe23e36f26e742

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab566D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56CD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit