8bae253c6b03c7356f7f3520cbf8c35917a8fa0ede3a38c569d5b848489768ab

Analysis

max time kernel
10s
max time network
8s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1246537483974348871.html
Size

6KB
MD5

188aa8ab7019e5ec99e1386e049cda9a
SHA1

6b3346aa06b95ce6fc72489c9c03fcf91c02407c
SHA256

8bae253c6b03c7356f7f3520cbf8c35917a8fa0ede3a38c569d5b848489768ab
SHA512

fd9503d3c24fee565006ae2b63db72ca9901c196de6290b9ea80663c23ce1c4081f3a33d805699974ba2af6d3dca2bc16fdaccb792c15ee9e951d9988f468887
SSDEEP

96:yUpHMOfRr8LN46e5hNvtdLXe5GaZftfnfjg4/f8ZH+900yTMQrBSCw:ycHhRr8BClu3924kH+00yThrBSCw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5826B5F1-2240-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2164	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2164	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28
PID 2164 wrote to memory of 2712	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1246537483974348871.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de094cc8c38fb8f54b0582d4ce5eabba

SHA1
2f0cdaae7dc8e65eadc8c09f9535c7c3dc2e2b04

SHA256
afb29955f80e1c9cc972896c5eaadb7f532448622875b379dc9aedec23b4b558

SHA512
020bb93db66200de17ad5375eda6d0b2763431682fc3626c2e32058e58dcd7718b9b9ffa80f12013a4ab38a5fa8dd8f2a140180b80e1d5688fe7e504c8aa05f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af6f4cd41d7c2e35e459a6c3d666b156

SHA1
6e28d7729d99f85989980d2d1c9064abee1a3cb8

SHA256
170eb94da4608afe625e651223cdaba4d6d1224331f9f041e1c8bede6c950f0a

SHA512
c8586d357e1713ee68a9577ee9b9f1aae5e757e902b6702c870f586c167495ba6e005a6519ad160cce60c72fd21fab7aef2c20dde3fa00c541ee853eced0f748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40d54f43e4c639f5c51b5f78eda15e0e

SHA1
333cb1afbafc6fe55e2dc3b906a36d32e28cafe1

SHA256
7a5ef94c1c1560f437a733a77e020dbe8831d48debdf0abaa9dfe9f39edc0be0

SHA512
15d3dd3215029bcab5e8b518138c89ab4588439df9cbf9c20d9ea9ca5fdb41dba86176eb4b0580a60a3874c4234fdf858dfb5882e151c5add4133fad5fddd22b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d0094fc744abf6ed9705bac5b6c17b

SHA1
c68065cc35901ff530b5b2e089dce0d90995db01

SHA256
9a3544be2a685dc0205e6a7b3eaa69d4008a4eb46fae6926d9bda711510391b0

SHA512
75f135ca0f519af316af255bb9295084a23d9521fcbd19d9304cba2ae6d92974f457c1f5d390453fa03c05bd6eae15efc0bf6073cdef3e87d31e59c151a0338c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0096bc8fb0474f8229379ce3da9e7f1d

SHA1
c533df0e05c9b1ae91ddd7d78d2d9f57617a1efe

SHA256
492bcfd65edf4a48cfa764954b1e04656fba5e25d567efb246904b0231870817

SHA512
af89119d1b8e9a01d218dd94f7934835fc8ab3746af7e5355684147a332707fd5bf45a91152f7012eec15bd1290c902e024e473298ee43a73407eda0cb54eb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf65b8312fe94744012b9e095593ef99

SHA1
c44f15bbb252509876dbfbe43ab24f4f4397909f

SHA256
32e1f898a0a59ebbad5acaa8aafe49e1c42dc50f8572ca0e2a76df763e8fa514

SHA512
f69a969e05168d9769c1b5b1db166f94fa35798a112ada6cd01560231426cb9a23dc294deb77045a2a4a02ace4dd0122a6f572f1c302b2d6dd0f968b13d0b533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328fa21aad7cbed520399b128c134edf

SHA1
4d293cdd318e4f57b44a817e93e6bf6cd51337f3

SHA256
728dffacb73ac4016a2b9edd5b39b8d7338e9406f8b1fbc14079e8d79f31e60f

SHA512
0c009422316ae5f0e9853667314990551a4063ce71119b1144e071872999b8a5a35955932282eeecfae653b07f915621ab69428ec43ed83d3d38268011d841a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0010af524a2bbdc16040e1a6beb89b1

SHA1
c07c7ccd3dc6b0617b35d2fc28a1cea48422f354

SHA256
89185d46f8664ccc62c69f37b8e620a29363c9f260b1a59472ec033aa4beb43b

SHA512
be5b4b5f19b7099d2786ade1b3481688629be6e31ba1f3c05e4abb58df9e169ffe34c3cf972d8150232c18396fb66abb2437010d0cd14db6b25ee0355bd93ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fcd77c552d4dd458c5e9f7573a98507

SHA1
5bbb637af92df7bbb942525d4795fc440235aed1

SHA256
0e192fac46008ac6ab7f3eb82c01261add8c1bf98c543a765c01a8e0717fb97f

SHA512
dc594d4559cce6e3b4fea398aa762de051fe0fa17693d48fb9a251c797b458c690cab33c351af6a8ecd854757526c433156af6fcdeb2cdf0f8863af1edcb5530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c40e786105c5fb0e61e6eee61fae10dd

SHA1
bd21ce200f8c180ac3041c2496d0410a84d25866

SHA256
833655001d16ef7fe1487ed29a10a026d072187ad88009673ffa9a6dd0f9ed8e

SHA512
596434aa9bd3103f23ae6060f8bcd07d0c138036a52201f1be3b9039d27ee4df8ac32b18ac0c1bf92acceb656c7c4f45d92a1a4582c1c23342718fb9702c4f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
358fedb497b5780e98b66029588aa0fe

SHA1
cd4724f32129bbc88c7ef40ca9696644a4a8acad

SHA256
bd221dcf9337b84447dc8596319eca685c9eb0377d46b29a29b6b11375fd34a1

SHA512
b93d877300dbd3ca88ba72e0cbc83d0349c27dcde7b0d6aa8715fc6b13aa5dc48fe48bac789413f2efec4a7df1c568d8ad3a26b38232c338d964e42d94fcca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2532.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2556.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit