739b5621cf637cefac413b4a0257dc20c6b55c8bbd2e5be2ae0f02168f5bd877

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

如何安装.htm
Size

17KB
MD5

e152d6651cc0b3dd129f3387524d7eee
SHA1

b364fd4c12bd3d353fdaf21399bdbc8e7a1306e7
SHA256

3e0c85e647247d9663bcc9fc8c70890e5ea824a50459a3e9c9ea51fdc2a42d13
SHA512

d54829a9c93611ff60d7cd386e2caac9e5ea80f9e2c5e99f89465ac4bd110ba0d7cb322221854bd2a6b7921ce621718533c85b431dffffb9d781b5c5817dfb98
SSDEEP

384:pfXj8TpeQZjPQTYwgAfqQeFQe3eeFJeRAhFiJ84c4TdPRo/+NoxgwZfcOjX09j6i:pr8N3RPiYwVpeFQe3eeFJeRAhFiex45J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{047B4AE1-419B-11EF-82E4-7667FF076EE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427093822"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f5232b71b79f298930eadfae42a0ed14fe5549725287d1601f94908b2d159a29000000000e8000000002000020000000d85fb4760d09d65b03d506a756e517e11046be2f04a848ed3bbb2b53ae0b89f29000000024e5b07203bbd32b1a2036a13bb560397705f0c2be5d0b93a8b93e328070f9748aab960ba142ed19d2e50c4e7a9e5f12e454446152620dcd39ef7bdecef1e78e9b097bdc4440d3ad34ac62dac80b6aa7d68a9dcde199fa18aef0e83421af36fe646459a3e5dec9bf5bc533330225293b4e85964a6e27931567d4d1969d5d917cbf748582793eae71576f25b40b193a24400000002931a3d2b1987d94d1dc056580af141fa132bbbc420d7f449005b6e8a961c4ac8ca8ccb0039c0c0c8946c0edba532d1eac9dc1069e7714dbb08faae0834d2583	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000027bdb76240c0521785685ed7698a8673e01ccb7736d499444cf9c37effe49d1000000000e80000000020000200000009ba0c47321bc8a25dc2b71560dca053e0db5e71adb73417bc2c45d810e38c04620000000a280de68ae0bef4b5988963eceb2a8dda90f96e23c5bd57de3734a5c1cc8053440000000d61d1671a34e705aa794cf10296bb3c940bc2daaa538cedf380edca4c9c881ff107ba89bb293ba57a89db40ab2a3736bac1531e9b9b08c09dccebc8fd4b21690	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e509d9a7d5da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 764	2152	iexplore.exe	28
PID 2152 wrote to memory of 764	2152	iexplore.exe	28
PID 2152 wrote to memory of 764	2152	iexplore.exe	28
PID 2152 wrote to memory of 764	2152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\如何安装.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7464266fd075eb26a1d608b04dbdda6

SHA1
76931525339de6825aa6d59efd9838928f9e881b

SHA256
75f5e1f235a0af904c4cf2dd970091293a578db8f3ee733b436ffbfd3cf7aa9f

SHA512
2650d375c0f50316500acbdde49de721b94efbcc8e7583200ef5c898c9faf8a43a29c7fe530e45273c3a1c25c0c86c8aa6baeeb44f872eee5b1c8074f228d3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f627ba0a4a8d6c92880e39907daf5a

SHA1
2bcc6d13813db1d0961101ed5158ce0f3f14401d

SHA256
c734bf02bd2fde50ba050466a4b31ef1239e51faa09f945fe59b2d79d0512445

SHA512
4196860639a3351af2713d8d82a89f40da00e32066398d8ff2140357763759d59ff4a84e80ec7a9868a32c15039b4ea49e0d3a78357e2c1ec8026bc5cfb659c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c98430a36755bfd0f091cd59ec0f54e4

SHA1
c2893f950b9819edc2a19d6818d27cb999431551

SHA256
c9c422f61a5ac393b6e73f58e88a086a4876b18117305f9a69d480dfda8dc3d0

SHA512
a49bd09cd3c0e47c5337e541e1ff0d5db88c50a15cbd791e4c5e0c9f8eae59f5124b2316be62326e62335faa5a5166841b011f5d2bdc399bb8b3f35721f6c9f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42202fedbe8facac8fc2c37934ddbf0e

SHA1
b709aa341bac248438c37d95dae5b9bcec9580b0

SHA256
c3f4622720700573c34bfc3177350f1aeeee32a323321354819cb4c156b9ec0d

SHA512
8fca3c44288c71ee5add4e71b4e897c33d687c3b3d918019b05aff479cfb2ae0cd43374313dadfa481dd2f5b5ad99f3be1ba77ecaff9c8a2b6632aed486c94ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9257bd304bfd725ed854c2136e4a6a0

SHA1
efbb911136ed32117cde06badac1544dab5b53ad

SHA256
0f20443b78a71b389fa4931a4bd7bb7f6f97eeaef76068df3f8688bafd96fc1b

SHA512
ca17f5ca47333dbac7f3a5eb30dc936c04bc2dd4ed65a4e36674b1a2049a67d036cd0c05a5ad500149c592948e473b2e87f944d7d546c1ec124a06c11c40ce31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f629a3ed3111606d41eca2d483b9ed9

SHA1
0e9b55d31684c35f091ca49134efb3f1f395ed03

SHA256
d7542be93727f975d363a8b7b398b45c51876383aa5377f2ea8a001b2b950dbb

SHA512
551dce0ee5a0e63664e2369a606c4e219b224ca772dc851b09a030ed2d33548fda510c6c78fc1d6ad753d561148ec83de59efa52f1edb8188dcb886134028f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b16a93e5318742dd83767cad7f8d5623

SHA1
949868790e890495a324c97a478443d5d59ab692

SHA256
2a2bc218b4628cb8740aa7510ed55153afad9b7fe912401e0033a6b69ecd1685

SHA512
f3dcdad4d4f3d7a54405e7678799ac26f729906439368aa8857d7d7cd5fde26ff89f22d7755a30c6a409a94d960204dc01e529513698f9dd389c119881713ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13b801b9f3be9520d8dc8f5f5d310ef1

SHA1
51866fbd480f0912380efa51a8654e548e4d73d2

SHA256
dedfd3e6f9b3de62c464e1a2eb0ee14c6701fca077809a8b75b86072b487625c

SHA512
1f16923b565efc6fb9b7fd3000ed9e51a23703b171844673c4004dbe84095966bd5639b3928f8efefe42d76dab66c5d1b1117ccc795527d6c18098bfb201df7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c1a3bd79b21f58ef228d90174a177b2

SHA1
1ec30961d2defde2e53749f581f52020af00f993

SHA256
b8acf8c99b6321f70ab874bba084258c69ad5b7ebd7dd102ad68e87af85aa144

SHA512
b5433b5ec46fb7a8a120946b42577d73d57104254ea37469148d8bd8078a7683ae6141a5fa52d0ce512d7cded193088a7afddfebae1ae0199c8374d87af13de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b70702d533119e1381ff9c2dc4237986

SHA1
c65e5efae919f1223d10f8ceaa676ddfc087adb3

SHA256
c9a08d86fd5987c160c739da39db493369e122f365eea43c02169a0e83761658

SHA512
5be451c0721e6af6db7a2a5668022ac748e4efbcab95e23f8473514447b9abd9fd1e9b1f21b84aa2b0dc50be9d9add9cb11275792eb8fb3986df9a944410b4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c702edd8c81c11d9a56143c6a0aee533

SHA1
02d48829c0541a44d872a0efd69fe2771cee07de

SHA256
b776784494163b410e4284afcf8fb594be87d67bfac9c02b5b308c23dfc3c9a1

SHA512
f7ed9abbf6d5db12e3fecaa425482732f0fb31e87246b7ade7491d65d3f68e630467b9459cff3cc78b8e80f71dc86d578a05151e5b0818bd6bb8bed469c981e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c27cc934d98b733ef224475f7d641320

SHA1
563eced9789207d13e953e20257b87e283984549

SHA256
47dea7ac8f4e3f5a63732f26fb1c64211982f39dacf6c4bb2311760efff54c38

SHA512
02786c4976d9a189ded6a84fe637ffb75e311ece1aac31a5e123c1d0a462e4df457ec192020a67c546a76ca02294462a0dd847d36ad1b5053e4eaa6992d9a99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ac9bc17002a82d3a8006f1061ae358

SHA1
a8240586c6938819e1a20fe2411e451f1aad09b8

SHA256
ac129a7744d578b742395b9248eb43275d35a5ebee502f1ce49b8b6ca6833b32

SHA512
8a88212fa86c12ab00119780ee6ff916bda1112d6df63f4c7736a84673b360da74e6fbba976672cf05858c61f0e86c8ee8125b726c0c3e9d7b0a177d0525e0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCE9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDEE0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit