d1a62cb9a4ee71eb52e78e15b413a8079b6e5eb737a635ffec076409c8e176ab

Analysis

max time kernel
30s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Gu5eS8.html
Size

536B
MD5

3a56236ee19142421f9d69e259720ecb
SHA1

31ac786b64869307b9017d33935c68b3f0620bcc
SHA256

d1a62cb9a4ee71eb52e78e15b413a8079b6e5eb737a635ffec076409c8e176ab
SHA512

8396f01718aecdb88f26840d3c576e56b67a81c6faba07b2f8b81d910296986de7a7c6c604324357c6ed9600b5fb5f3602fa060681db32987e9c5ba3f3285c9e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CDC4291-4857-11EF-8E5A-6EB28AAB65BF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000080d1bde30ddeafee794bf8e84ab6e850d9c22373cbc6edefc2ad2e6b6f71f5a5000000000e8000000002000020000000fde2d68f6f490c0c7b29c85fe430f6e86339ceab8b8eb479375fedbea560a94f200000002383051b0d90a219191b03444ed9700ede462b80a4f7bf0341750a47bffc56ff40000000d86d66431a31c0d9507a370f77010a3ab1cfba1349fdfdab8cb3915c79de701d506af03ce5f8e8e5608964b1da0b7317a6906095f6b86bd83e82919cfed9405c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e90e9f0ee30884763dfb312abdec90710a18c62444b471ec97348406ff3d62f4000000000e80000000020000200000009057acc6a22029244c2828206c42aa9e2a8ed771980872dd3a3263d5fa96679690000000757b22be3f162d91266168df528f0d1fa469954971fb72508eca0ec7c355ec3630765dfbb69d0fce8bc43ebfa2289aa61067b064d425888f4bfe35338e1368aa06c213eb885f7e854d868c88607c109ed62e353ad23b8985e71434f8d383c30c59d3aa92e2807dbd8c3d3abda6bcfd309242290084c30503e6730ec39daa0a6c4255b0bd833fd934007bb9f9bb02179040000000ee54a0395acbe0a10be0c1a50f9fe7dd6e9627c6ca554b9386303237bf25465107439841a1ba01acb3b3ed14da65622abfc2654b98c376659ff036831c976976	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509d477164dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1092	iexplore.exe
1092	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2268	1092	iexplore.exe	29
PID 1092 wrote to memory of 2268	1092	iexplore.exe	29
PID 1092 wrote to memory of 2268	1092	iexplore.exe	29
PID 1092 wrote to memory of 2268	1092	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Gu5eS8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
473ac08672eee242f47c4e88ab391a2b

SHA1
007d3593ac8f4721258e620ed8c90fab7042b52a

SHA256
b7a10046e971c6dcdc0f391c4bee441574cb8baf97707e9ff6c54909320d1046

SHA512
b4b706e538daba9304663cd403f0e3bdbdd15d4317349c1dac22b0d5515c6d7399f34f02784e032f396d4a5f2852ee2877e11ba52ef82cb00e82604e5d7d1e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3ddba9cf343a0538e150e7171f91eec

SHA1
f5012240729a3780048e21461aed374d837f5396

SHA256
ba2f5449a1a3f5570a6419504f4896d45d0faf44aab08a349c6bd931f45cc66a

SHA512
e20e5e254009139bbe0f70507ddb6c1984cec82b14a8623c14188dadad49ae6a7c886d0ae0f5100615a556b24164e19a42bcdfef961bbd0106e4ad3a51f2abe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4085d109c2acef6c29336abf78f9510f

SHA1
fcc560b2a64bfb4bcb4eff05bd17f177b07fad06

SHA256
d2fc4586c76d41d3b70ad700d94b6bb4b25316478db5d6f583bbbc7d770f224d

SHA512
3a2cfc37f8f419ab3c0d29b39dcc98c61d5bf2113b643fc371fa248731f7e9ff6b11b243bbae9998863881c5564a112968ada96032631e6b3241898691687cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b757bc551fef86f8f68bd03f41b6d60b

SHA1
b3257fbdc14ccb800c00abbfdf51f7d3a9072b0a

SHA256
207cdf8407f4d79012785430e9f1c45d4beed239444a70513a0426147405c23a

SHA512
9c30153f19229e69bec698ec2a481db30aea0796cc32131f46452ea9fb888bc71b7b70c1036c594282f93ec1ed05101242016e7d80f845e43e195640704a3ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39abcbf1cafb7c4efb0a99053d97dccb

SHA1
5d56d5f3ad16deb35fbf0d69e7a58368f751e037

SHA256
a852fbbd8a76af3e5a5f22c013936496ca2c2f93329d8b278ded5b4651479686

SHA512
031a685168fd94e79e72eda88bdade580dec64711364d6bf7e5230073f7dc065bb2b7a818d46d272665089d9d61e2b0d66dfc8aab9078ff2ca88d8c4a71547a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94463de0e4569fc206c282a1d5c72ffd

SHA1
20a53bad259a5391580193d68159e94d986ed737

SHA256
12e66f8cd5853640e3aadcdee09188dfc0a3522e5836375aba66fc923e16bc37

SHA512
3908e0d07df2ddcb7f7a2b864654207399e486d68a4c1ad46e71f36e50a4383502e367c1e39d5bce431816d2bfb47690c86dc8fbd607ab1f422b7b166ce67706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c0fcca56f4d5601da1e80a42b19de35

SHA1
7b8ac6f1166ed12eca67cc7fa1f748f958bfd693

SHA256
fbcd697a40a835ab4c55253fc45dde5fa38776d890368acd49f602c076b90388

SHA512
bbbc2ac89ddb57dc6c4af83a1f69d1355719fd091b9b01b89a2026264e2ec6b00a0c2e2c356ef2c2fa2daecb0cd9fe15aded8d59c15eba1a4e6bd4ce9cb30a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecb0194024b26a9f2b45e771f85f01e1

SHA1
b306151bb778375839cec65215656cafd845096b

SHA256
a0eac0693e8fb28e494c3a24f286e8d0a539fb1d5de7da64b01cf8d0784746d1

SHA512
594541712bb1fbedb4020eaa7c0e8ae9d01df2165a86e759cebccf4c11109b814430a8812b847cf8d6503fe80b0648e13dcfc62ed0d3dbc8316ef87add106d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce7913938a6e8095a924353b7eb7a257

SHA1
222ea5a9a31a7a12dc1df55dfdc76de1e62ecd5e

SHA256
1813518b3111befa4d109e5d19dded271352a2e8ae5da66bb5c35b500fd8fd73

SHA512
fa3bb8c1b911524091bfe4f55e09d1fbc9ce3357ecb66ef1ed656ea4e2eb989044436c17013af64f89ee891e449499f9356c0753384fee7c5e66123ed06bde41

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB445.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit