c59adf9296e08aacc0a7957936e444b9cfc180a6d4936ae0c6ad4cae9c231876

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b4f3080cd27cf55a2682b3078df8ce.html
Size

520B
MD5

07b4f3080cd27cf55a2682b3078df8ce
SHA1

6295c56a57b785e7864d79e1537418c26292db0d
SHA256

c59adf9296e08aacc0a7957936e444b9cfc180a6d4936ae0c6ad4cae9c231876
SHA512

119441086107acea41a2e81946d38e15efd2b74910f7cb8ea8a829f66acc6d120372fd134d0bbaaaec083f24254b61976eb4371c937989c04ed1092c31393821

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d19d07049265ada23a4a3d23db725f6be8b784b5d0f781ae363b1c4250dc480a000000000e80000000020000200000002105bb931a83f5c4ae906836bbafe775b8523efd901e85db96c9f9ec85b617b290000000f59104f2090f57bb92359b2d798104ce67a89b4ad97b587e7fc6ddbc4cf7a5940268eec6d4877d4a96c70c95681d2225e684b3a25e96aabc19d1c798e2917a7c89ded79d088595f2769f30f4b7716f6c09a975d2a5765a7d9a5a8cf3498750ed7ca1ce7e8a037c0bf66deba6862d2313cd7b923fc67f167f75d6e4697531ae3107b53bbb11d2e9ad17767fc1bda9bb8c400000004b172a1029d356f5825cbfa8ba600da30bbecd98c7eca0d65f855c611cb96b6fcc864a47af8f7fde79c941230a4b1ba697546914c05e947e3b86b5c5d29e5248	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A58B7DE1-D055-11EE-A4DC-6EC9990C2B7A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414639543"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c061027a6264da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ee08b3a2859997dc7a5c84a0f246e1351287f1eaee5368e2e9224ede7223f930000000000e8000000002000020000000d0ecdfc5996c37456b3d988c1d8a84d55d9920bdd7085ea2be9878c242f94a8620000000b0124de97e484ec7f0ee5287955f775af626cb02ff18927a2f45f612a3d8cd1240000000720b0c347a686f8ae952469b78da0a796487e052c000a26204dac7715b7b2f0e4e403f0df8a15133374663ca8b46c40071ab937536ffc957cae7d9b5b2c610c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2936	2212	iexplore.exe	28
PID 2212 wrote to memory of 2936	2212	iexplore.exe	28
PID 2212 wrote to memory of 2936	2212	iexplore.exe	28
PID 2212 wrote to memory of 2936	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07b4f3080cd27cf55a2682b3078df8ce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c84fe4b102c44cb78783162747f366d

SHA1
668992bad734e6d6e6a088af8f0dbcd572ff1ad9

SHA256
dec5b1f5a4827b1e4e03300aac81ac6a3fc9107d9173a5b4c57b5444685f0998

SHA512
a69dc3dc631a94c2358affd320bc9bd9147df92d7c3bd1c81f430d7ad3fe4c97b292faf0b9fe679bfba0210a7be21048d6d0c572828540b31754548d9b614f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a7eb533da99e2ab255d3daa0b176b9e

SHA1
bacf49fcb65a8192090cadb169e572359a07a85b

SHA256
c33a7e5545bcd9b86f2883cd55ba314d04e5e558297e653a7a2d09ecfd657b44

SHA512
3494214f5b890fa20b21fe3192e28c844438c4c81aace5928f9bacb676101f7915475f60e7f148606ad56b3b0edc3d72617474a34bdb85e43ec00129b64a2d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa81b5b68b55761a5509149c59ece30f

SHA1
3a441af5a3e9fd923d3f8d3641ea6c06c475a643

SHA256
9cbfbd37731a586f4cc45cfb81ebff36e909bb701461f4dab8ca250a85c1e1d0

SHA512
b4e5223152465f510f7eb7d8d185c04dea87ea91af9c6fbb0af703b7818326f06bac17d9a9efb0a8ff6722a56e174d1318b62be5a3466397e15ba360b2aab4fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6844d6ea093d7f367fb0f1d431930b11

SHA1
04573d7a3088441bf0f5f139f4989e9968b019df

SHA256
52c5929caef4d8a429190e74449b88d7651775d62f27853d46496af631461883

SHA512
be40641f59493532d7a5ea2c36606497ad87225366746853b309ee98d9e8e428c487bad59428faf1efb60acb4bb9c0f1f274d8c1cfc949d4ef6f0c0e3ecb4c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f19befbd22908f1f08022570812dd4e

SHA1
b04703696131386acc9e8fddd7cf33f1d0bc4f41

SHA256
7c2cfcf1e01ef604786acf44977404fc7281bd17c6446356f717a0e4ac97e74a

SHA512
a5a3744915dbefd6c0b4c639772b80d0184028f2769c640c4638e25b9eaeee752ccbdf2feea567bb9ada3333e023d9dd0e0183a637456d6d74aa58fef54bf775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9956e2b04ac23d5b2856f217e43989a5

SHA1
7faafb6c916577a80169669da07ec90216da4ff2

SHA256
88a7f2726a8aabec0319f7d33f5be456c115acbe3c483a1cb10cd1a8cb4b15ac

SHA512
04f90e06446b89cae65ad86dc77ed673d5c1bb2263585ac1801541325239680510c78a38cd84a86c63faf8164fdcfacea876179c0ad891de8ea00f5bc1267b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e3423f772ae99192b4cd2ff71c6a39

SHA1
6ceb7dfb31b2cd84e84179e0aa3a87066a2ccca5

SHA256
f34f3bf37b160122be6aedf56653782f8c121825159527b1cf6277ec49a41048

SHA512
81327965b11685e9431ce788404358009689f8808ad03961e00071e03a7f3b8fab8320fa097bada6aedbb6ce7b8c586381c1d203e61c0427144617397b086644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35569221c24886c33efa4cd1b4eb76f

SHA1
230dc6a2fa47482c8a86a607b830698f6143c971

SHA256
71acf33342a97d092f5ea62c06fc29e814ee6fcaff7ac90b9a588693b42a136a

SHA512
20572ed9e2aab1f207d8d94b9f6d589b51d75a76b8d33b48890308d56f5f2e999a87e0a4e2b1571c1f2f9caee57f340971b34766daa052e86242f7e1e2b5df1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e45b3beecbf10a4997185c203636a4

SHA1
8c303337e6a0665845a3dc5affdc05c1b7b0eb3d

SHA256
83381b2e9e78d4afcbba6c62c0496011c0fea0b1e56ac58acd62f21018c0c228

SHA512
fbdd645eef8f1913b2b9864d455abbdf16f3f09785fe2f2105f8357e0d6a6bd7e20d38e02c26550219c514fb92929fd4d62a09dd2252caf2317e59cfef3b9b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4836a2032dddda644d990abfb36835fe

SHA1
93215c8da64502ed48a8aa0cb8dfabb8b880559b

SHA256
4b61131865d3af70dd7b27bf24852df2de447e59e4ccb8d132eec896804ad2cd

SHA512
d829b3b358821348c2d39a96afb5ef3db5f4c32d2d01e796bcbf2e02bf794f083ac9e881766089b66882b316a728d8fe9dddd26f1498e7c3a8c380f3b0913c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
840048d75901c132301436d2bf9bc0a1

SHA1
735286fe4a9cfb9f65a39ad403fae4cee7c4e2d8

SHA256
3f59cf0fc1b0864289d56e3c9b2189061b342b42838e3a0268d04b4ee090df8e

SHA512
23eb2f7093c8a661aaded6c77b224777827e0fa3c3cbd7beba9fcf1211abc5f71f484bc06f54238feb9ae4ee1e9f26b1bbaa528689ae76e63ce8b3cb7be688be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f60ed2a93ffb9d1c7591367ad26f616d

SHA1
3667700df6dc8e434690e8c3fef052c7b58277be

SHA256
5fe4bc0a47f3ee25a668a7f8cfcd051007104676402364cf9b991fccabf56352

SHA512
14353c93070d7789325a64e9586911a191702e4d8daa63fdb00b6b529cd3f3e908de1941afc961e3c1e411b9399b324214c6b7508514086cbf6461fbe75de7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e0b56697b882163d107dc45c53145da

SHA1
5dc7a23f8b3735548a375c6c34a8177f3faa1900

SHA256
f6e793e64209fcbcb5d7a4260686dd994705e2945187116760ca9789d5458ab9

SHA512
10b7040fa1495242d8e46906285cac4e83185ba016e1f349a12fb43baf9eb8c46c7ba76a1730bc88596362ae4072d5556115271b303683460e56d77652558999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39c20b0cf98a1e3d4da01e6c949daa89

SHA1
a9684fe6aca261fbd88643c368e09f6a14c53d06

SHA256
ff9fe18533f843c881045b2133732a2d2a39b71b6962e452c3d26b39d3e10aea

SHA512
66863982dc156b5ba263a0df82e916f4118e7d49e0073c4ac50609ea01f8725a27cd0c72a4553da264d8b685efb91d0a90cce4b750c6be128ed5cb0098bf13b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86a93e6805b0d9a963efe6fb4707ef46

SHA1
3cff8c6a73ee6f72fc6471ed87f8cb4c704d2d5e

SHA256
cbfd63899e19a6f4a5d57470375ea5a77569ae02f86c809621b9bb89d45626d0

SHA512
33f19e32c09bad1baf4876a9f5cf628a545aa15e5263ca6a5e2c275c381d0e5f66d57cf053a3de01fb99e3f3f381604288f22c398ea5a94a2e5131403238ebe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a005bad58a0c1802331576578f13a8

SHA1
ccb4719f9be296001cd94db07a425a68c2a4da82

SHA256
dc420944278cd703fe42fea227cc433e9aafbffec41ce8ca0cba841294f4bce7

SHA512
688338b44e8bc9699554f5b0cba474840b9d81e6631734951a168ac06c2e57144801efb90a2ae892d65866b86ff58d5c013cb799adbb124f2b23297d2159dfee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159e6010c0bdb8b67a0d168e7a67fd7a

SHA1
210377b6a23dbf170086fcae7925ae1a6d7c1462

SHA256
df4186a219aa91f8f4e6b203c0afd5577bdd8a7e412701c099a4c36ec795f03c

SHA512
b959fd5aeb478e46054b61ce0c49fa2d9b623c48ed497d72ab4af30d33f6314ee33e5e9be0c68f6b4e25ed1cdc30e6fb5420d951bb74729cc31558f7a4e710d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar288D.tmp

Filesize
64KB

MD5
69b8e2fe3bb7142b759bbc3bd3092cc2

SHA1
c55b032e44415d77a1a2f3f6c6c049b7cc32afd7

SHA256
d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4

SHA512
c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b

Download Submit