fe6b90f7528013999b9c876a4d8185d29a8d1e7f145eeeba89631799154f4ab5

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lt07vdx7.html
Size

315B
MD5

0b4add8e47308f50e116aeff7dfdca5c
SHA1

9fd64bd65eb0d86f8fd5893ea4ff974d1dad85fa
SHA256

fe6b90f7528013999b9c876a4d8185d29a8d1e7f145eeeba89631799154f4ab5
SHA512

b0b88c96feaf98572ef727ea449fea8bc7747784982e48e1356ed6e5c5d8a08a53d7c52504b6416ef00d68e6111883f91f46af9a8dbef1dc4f15ed2c2a2e179f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d8d2514141c504388ddf30245934bf100000000020000000000106600000001000020000000b9f677090a667c162dca5bc51929860a72d9b876033abe0c3793d0cb60c9890f000000000e80000000020000200000005a8ac05721a054d4452ca186553de7e8e831b82f539963a64f133f7eb634bd1d2000000077d6dea7c8c37360616fc89f908066e8dd3da9782fa087366306b9b15cb5953440000000daf3975805bd1237074bf21260e7433f3cb9c1cc50a481f85609370e46c8ff2531dfd8ce055aa53fbd76aa69f43b275f2b76ca6a9b6ca29c200f681bdec5554b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d8d2514141c504388ddf30245934bf1000000000200000000001066000000010000200000000294884cba1ab005e0e2aa5aee97731f1834aa37089721f2aba50bfddc817aa5000000000e8000000002000020000000445a31a0d6d47a5b34a147bd6d5bc8718f5dedd3436b12d4d1dd42709c43b55b9000000003ad6b1805b80a8894feea71a3b0a6c6fa3a6a793cfe8b348fb0257b711933d5ce5cad082f08b1a9d229624cd82e384471b98db6ddb112ce64b9be95246504c3cd74caabaf7a3c8e038339d9b7363fc5d9cdebe373d08d39aa048109f39f05c98653b1d985fcd66cc549c79709cff8dbe5c61b508708e55262fcbcef36899e4208abaf9fbdd7251c5b4d9fb27d8e2204400000001a434dc5a665339dab678058cbce3e1fdac967851586d870152b6d38c1c0b7a2d4037f1bcf44724630958347a4be2d8450d372c192478e03f8d48e77e0b68630	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423845704"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68848A41-2410-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e91d301db8da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2228	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2984	2228	iexplore.exe	28
PID 2228 wrote to memory of 2984	2228	iexplore.exe	28
PID 2228 wrote to memory of 2984	2228	iexplore.exe	28
PID 2228 wrote to memory of 2984	2228	iexplore.exe	28
PID 2228 wrote to memory of 2424	2228	iexplore.exe	30
PID 2228 wrote to memory of 2424	2228	iexplore.exe	30
PID 2228 wrote to memory of 2424	2228	iexplore.exe	30
PID 2228 wrote to memory of 2424	2228	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lt07vdx7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275469 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
647d4db9f8da0bf65bebb76ebd5fe3af

SHA1
04550c0a828eaff74f2760308428a6e018d0a32e

SHA256
e87993e52ef5be2224554d35c9ba887cfa8cc97f1d5fbb10715c704fff7e0def

SHA512
876f610d61646a92dd395cc6e97a4353f615f392876dbda2e01952192c273cedb69c799db0d21ecd6b3ba86d3492f18dfa582176a3c628ca175fa48eed2206cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6760ea06f951ef596bebf32a67b0d893

SHA1
aaf86e5629a6e5d814cf051870e43fc005c62118

SHA256
2e8ceadeb249dd8e7d2baf53506d5a1897cf0e2018516f28e800712dd76fc949

SHA512
b0275a4867b3d68a5d68d90784bd1a37b2e0608e85d405c659e14c5649b8c105791e81c410b62a4b332d3adc6e81b1dafd929e292d0927b1338174c99705dada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e80b4072df793b9c73c608d28c1cdb

SHA1
4c8aafd373f5639d291f4a97e91d2a7b4e43d0cc

SHA256
12655e200f2f3e6def21c28baabbdaef3921c47fd45cf321577c32c56b37a5d9

SHA512
b631eaa8f0e12a5ac44e70d90f6b594d335fb2872896c16ac6a464cedfab90d8c9c95c8777a66dc729532ed74c265c4a30e8d81d34d6578e48ef784ce036f66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53b9f6775e8e9d7bc300e9f705a74698

SHA1
27a39b6be74b42b53281951d29d4d023dedd2559

SHA256
366c0027de35d7f9609bc5c9ca7099bbcf5c7ab5a7f982d630c357c9054a6377

SHA512
1ccfaa4ae526bc0b821bf2fbb2b669cd4a5132639946d30a6e6b17ccd424c8f32eff073b960733be09ff1d79f27a4f7abcfc386841ffff21f8f6d61c87e14669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1197ddfaabf304bf18ba5e61a8ff56c2

SHA1
4c105a19defce8581911e6a349522411ac990f15

SHA256
d870d30764baba776fcb5999f8955c93be1cb4ea6df435060bccdbb69568307c

SHA512
a80cb17f3f02040a8b7318dbe637ba665a256bb6083142efdb88641a163d4b0e8516972dff875dbc004e41af6019e9175f1c1a15de038ac8d53e86bff8703776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a676f90f81f3d34a5cee56d3548c9e1

SHA1
5c300e839c733f3610f41a055ef3f8bccacde1eb

SHA256
f4ed12d2acec5a859b35af3217ffcde13aba631a09345ea00f44169fe42450f3

SHA512
0b362b1eda09936da4570ca92238172c03df7d01bae41010fa5c87cdac91bec4207de761078727f43b3eaf115dfb25a12fc35b083a31668de369e07a5047c070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
952b7417933cdb2b8bb7888e52339067

SHA1
d4b730f56074396e6bd43ff9fd8dcb2a5adfaf83

SHA256
8f5998658ee5d2913fbc5bd2534601e1a59160ab330fff42cda650c7a4261a4f

SHA512
b5ec0ab25633a52a2681b9e5a1ce766f39c5aaae8da42baca6ba55c296ea0b161e41fd47b102eecba6438048fe48366ca4ca6432e087e70485b405089a5c5d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ed97a34e0c95800f7ac2a5f69e2a7ce

SHA1
191dd233e7342cc6fd1e5d0693d89aaf3e62a5dc

SHA256
b051904aaa9f236562d04e33c4897c1d974f35728d35458fbfcf5079f6715e2a

SHA512
1a13d5fe8f35024973d44cea62a9e43d2bc78506465ec1eb9a5c6356e59426b3c9c83d4a239628b525aaefc9fc0801f8003a4735f9a3bb2399d6157c90bd14a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
334ab1487f160507ac63cb85d6f27a9c

SHA1
98ee6d69ad13b03a8e6f4d222bf819237d31ea42

SHA256
cec2ead944a01cbb748f47aa34b99949ec7ba02581fd39c290fb8b0dbfe28235

SHA512
b010828e0655f0682b3e00a5be513b0f9125c7f954f40972d68d8c80cff18b31539967e5e40e85fcd7ef15417144be6894a795930fe2df3e728bc6e0d3af9325

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc4b01e17363ddd12b14e4a2784c5fd

SHA1
bb981e6824d0e78bee45e69709084863127b5511

SHA256
5636a3de1ffaff52d458c92b2eb195a6dd343bb4d88f0432b1ba1bee1ec3e0d0

SHA512
f440492c9f8376f6cfa9cd878990036c3e61a5d6f853048fdf20526cfa562750806399a48b9057febf388c27ec289d2c596ce82d93f017285b220c1a20303aee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3379.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit