eeed3d3be325b29b1c976b406ae4fbbbc4dbefa2f99a73186ac629dfa016fe6b

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/A4519702/htm/page5.html
Size

2KB
MD5

62f3ba7c62429071f43ba9dc2c204cd8
SHA1

d080dfe16221be2c554ce50c343874d3db4ba9fc
SHA256

c2c9194dae7193c03a8f379eaed227702b8dc19adeb0dac6b723dd8f10dfa00a
SHA512

8d65fc8a250357b62b2761ec96b7cc8fb4f4a642a77307fed8df528a84bbe82881ff3bfc6c187c74022bc18f00ec63d383bd39d981b38dcbc33aa7cf0deced56

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96C84491-330C-11EF-90CD-4A18CE615B84} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425493331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002050cbcc2c95823f2d01067d91447f8c78f590bea69afa794fa314bc629aaaa3000000000e8000000002000020000000a04935da8851c4357b1dfd4b7a956ef3df453d8db0ca5d4ee6079922cf9e863590000000367412f77f2e489135455d9a3f62867e83d4d359a3aad06958b6b5a5a553cfcba01d4d51017316748d0dd2fa5d257435469612163273e9b7b3929a63f00277f5f174fe30c4a319b92cb2480b68cd058b8543b33d6507bb06cf048a8775c0ea68a9f2d38e7f56b3d41cad28c1765a5c49f79ab537eddf19e77b5a498c27fc0bc9e763bc001c3bc8043d8d820c06a09df7400000006fcd17f207b8f5c74b729b1146c65c347cc14408621532a516eccdb3eae2ffd98b14f69057328c5bb9b024c9f2632034b8e7558e00e8006e87c2639ea612e507	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d97e4ede4e9d17af9fa47b7eadf28ad7f49412bbca6ad256036897881a1e1ac2000000000e8000000002000020000000a1b9e18757e7de5e813b325a34a1bd2ac331c76f451587bdc871fde06543132b200000005f4f62f848bfacf72713728ca9065603ee022e15c171e75164d8fc08723ba76940000000fbd64dde0a3066b14b67cac76c0ff3594790e09baad869ec49d0554360f938c581a5665db72094a135f48531a3c8a2621ef9ef5ad17fd743ad1ddb2d3340630b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0093536b19c7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3060	2084	iexplore.exe	28
PID 2084 wrote to memory of 3060	2084	iexplore.exe	28
PID 2084 wrote to memory of 3060	2084	iexplore.exe	28
PID 2084 wrote to memory of 3060	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$TEMP\A4519702\htm\page5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd8c15df1a31d48d6ce74ce114c43788

SHA1
cbc384c91360a1163775a9ea22fb2391363ad87f

SHA256
e4ee0817b45d21f9867f31714196e010482252d1b6e1b533af690bd6ca53c81c

SHA512
2be11cdfca6ee74cc9c60046ed026900db58bbd1612177c3df209aa871d8b77783d16e557fd9bc84626f193977f627e1cdaa0ad9483bd5c63422cb4ebcf3b6fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61deb2a515bd5b074225b24ac6afd313

SHA1
d4a7366cf0f89e1a26928de2e15b821e0a3a63ec

SHA256
9f5ed7de2ff322c0e6f472ad645a1449f1fe83fd9e7abb98f4a528d1ee56cab2

SHA512
d2ecc6724489cc68345efb499bf693f2bb44612ca1fc7614e2c84bd73acef9ef88fe89b290de33d03092707c7e86baac81ce16445d05ea4f279e4caa71e54334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2b0efe72e921a08b84e828011d67aeb

SHA1
acbd996695c75e49143530ed5c6281dc916da8d2

SHA256
41a22db29d0669215a3ff917dd0f4ce9aa8e84f61daa6c452b3b9a59c5e7845d

SHA512
e295facc3d78b626da1b89d5136651cdf3eeeb49e0a7b91f1702ab424d88253ea2194457d41767ea004edce4e256412405c5a1b285574fcad4f47e037a59ab57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab4d384594d2219fa8df41dec7a2783c

SHA1
ba48ffcd74791d207a4648660efc34766d9fce3f

SHA256
45a193152645555ef2878c1e62219340c9c47465b64177f3150d422472802975

SHA512
94a628b67a30bf277d79e63df965f43d2fb8bcc93c4a78e786f2beaa181eb7f8e26dbbacdfdbb3549ce5ef62d5ec3ef0318901da4faa0d5e5bf57d59d5666a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef035dbf93a11dd5b4f102125dba1cef

SHA1
0aa0bced7dabd3dbba6b67e927b1e7f8922d253b

SHA256
27559280082c585937923b29687168484ec225330d1e869ab5a9d42323d8057c

SHA512
b590da8f536f239049b1a0cc9e67cce1565bcfa1fad98af804ebf8c07964417394e8dbfb233fe41ccd64d655d21c3f62a5c9696ac6aec28b1e94690a5340a75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bae6e1c18d437437ac90687e0978207

SHA1
31f7d2787079d54ca7993d134b13cad805e24560

SHA256
616c83dd103708e034200cb9ae4a90ffd247afaa6134df52db04d9d52cc309d7

SHA512
bcea265463b99392cf170cf49e41d396ea51de9c8ea80f305503d17ad54672d8f638449aa5164382e0774ff982269ceac6913bc015af0131ee0cbf173f23b2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbcb73a9c3bf8f090252f6261ac746fe

SHA1
041293417ad3083a027615395f194f8c00840801

SHA256
d147de539ee64deac446d49afca0524dfeba7cdb8a2947f0ce2fc57c51a6568b

SHA512
880ccb05bc6e70b22c69469a37726a2ac15966a6d174fb80ebb275085d9daa0d7d07c7a4c750d29d3545a6d749685e4f2f1e208a8b9854db5f62dfe3a6912211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a7d666ad3b7a7a8a649c4448ae3491b

SHA1
4cbbc7d3fb5d18877bb81580cdfd7014e35e2bbc

SHA256
c8e162e04455171118dd786b51d3765c11a8ca53f839c174667b0acd30bd4edf

SHA512
c8cf454d1f737477e88f2cc95381d21b740d5b62b04e4932f454b30b9e2478651aa69eef3928e139806b0824cca70116da097e3e6df38fbf2a559a5d9f2768cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3625ba530da02431f7213c8ce5155c97

SHA1
b80aafef8e75fa053b82c945d0586a240688c682

SHA256
1d9a7453803fac742202853cbf9f04099a815fc4f71a21999fee768babf034ee

SHA512
0ebeb0d7330c189dc593d5a70a9bb468839bb08f6b71ff701e08956704511a88ef291f6863090a39ff5c604e69e21df48ac560fe6d6f8394cfa3972b6662e28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
391d40adaf582e65a320beac3db160bf

SHA1
744bcd46a254fbcf4b18c97e234ace42a8e6b0f0

SHA256
4c17884ce636c03a190263be41954170da2f1ba0e7ae7daf66fb39237587be85

SHA512
8393287c95bb626a36d189f745e652a90b2fcc0375aeba34d6869e5d635e045fc982dd014cbf892b5cb2706cb4805fb375af12318ef18a4b76c07e33515bfde5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a908e21be75768cccd1d9854365dd176

SHA1
4c0a27c1895d619b569215e9616ca44af791cb2c

SHA256
a56803908f40cdb6ba36c01837e5239e31c76e9c2c92bc6ebb50ff2855837850

SHA512
df1a8537581a442a23559ed1d64a09cd4bb77c3d0d306b973fe004053427ed09dfc0b1602eae7ace744e86312495a8fe4f4a425e33d71e3b5ad470efd7d14e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4325a88c01a50a8c79224f5abd0ea670

SHA1
4c441bf13bc8ce4c953424206fa8a71abb5ebb1b

SHA256
8fb8002f4b5fd1c99f99ab01f11478425353d081b6598797dcf1895c46433760

SHA512
4e148dd43976598e52617bc54981a934b434b41e2d276ffe1530c026a994686e9903f57c387e6d6ec2951164f493a29fd80f986476c31d64c2144893e96f29db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16aea79ef134aacd0fc647eda6a74314

SHA1
d199231a3c98a045e8ac5ee16dbe7421f58eb854

SHA256
dec7ff60d904e5959b7f9ac4a76dc976648742a21dc763d09b20002d752ecfdf

SHA512
12419a4f7519a38261d87f404a8a1527e6484aadec9eecef4192542109aefa5ea9133f873bda077c90ba0d51915270b5c5ac321397767a510ab2e7608dbc2e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4bf1728d32c6dc984657940c473868

SHA1
d2bf31fd4d209ac9d9d35f3929169c51c7eb8c33

SHA256
dc4fcc7822d25a0a1f230a89d5673ce14b1542e4b7d9e898437884f1faf9220b

SHA512
f3efd61643207e3cf4147caad6803b838dc1718f0a089c354ba7db0ab8625d9fe289cd832d9070a6d7f70ee66d6b50efa73c6ef2a1242477d677cc15f03798e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265d9846a50eb810929a46fc1cbbc188

SHA1
4200a3e068829a264f6d9fb4dbdd62a64015fdac

SHA256
cdda22768e50e151be2f9a822f0ca056e58c3c7e60ff10780fa52440036e0c39

SHA512
02c80fe3d32d70119287f50cf495534255a9597c740276689df32e8fd7596a512bdabd0e99dfdd888d6b88e705c0fbdaa19395120f01fc8682bb0471a4c870b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c079f9d4f757645e64f2154f4e15ca4c

SHA1
2921c5d278ed47f6b5fc0b5da7a61a841f90df30

SHA256
f15c0ba3f183f2ab5b534f5f3b7636d2883dbf3440284d455d377951445d0f05

SHA512
23b802a5d3a8fd5cbec4e2a26e457ae82aeb18a532662de095b285cc659cb4691fbaca2a5691fb2d216defb295a155189198c9a119157903d3dd6249f58dfeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d460250984484090364d3e72d1adceee

SHA1
e03648d7cf40c735a4ff1d34cf4b056abfeee52c

SHA256
6bb62516877f3f41733f1b7cdfd6413317e225d9a13249a2d440db329942fe16

SHA512
f794ba60ce64eb470e7d48ae0d8fa930acce6112cfc2050ff6558760cfa44cc297af5ec5e9268a499acea073b94e6681567cc502fabd55477f8193211b80b88b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2291.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2372.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit