0ce84ba31ebbc5c60e49da2fee469b461f8a648fdb7abe3f21e414f0db252146

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 14:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

64KB
MD5

2301908c73d604d41541207bef8c0301
SHA1

480b49ba314c4b630ae6771b8911633fc89dd2cd
SHA256

0ce84ba31ebbc5c60e49da2fee469b461f8a648fdb7abe3f21e414f0db252146
SHA512

6eb5e4a8160ec896381faf032cfe323f42d9426408c6b8da7dc9c26dfc094ddd11cb477753ddef330ed67b3fdce4f1041a1d95ff9a4f804f9bb53f90e19918d9
SSDEEP

1536:Qhm4GBv8QKIcijlWBvXrBUrrTRXt78gNSWW4YM0MMgj2xuw3UFgnLLXWs/IfAKWx:Qhm4GBv8QKIcijlWBvXrBUrrTRXt78gC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A940DDF1-D0C7-11EE-84BB-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ad71bb7c182ef34a7c4658539e14705017447ac16adf6b794026d74fa62255ce000000000e80000000020000200000002deb9d4c88482eddd6dbf4ac5c54ca39becd800a30a3b569027ae7bc2bca08de20000000d95508f3fdc1ae45574bc7c2fa3c52d218924a1f9fa06f6849b654ab53112927400000009e69669c54cf2c9a10010ec83fe371b3447f49586223d21d9aef5e7f32184d37cd08a5296608eee1b259df090177bc2906a0a329200d0ab906657a3f41a0cd4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02a877fd464da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000060d9c244f8f4d74b4730bc6b842adfa0276ef602628f194bf2766c916260b905000000000e8000000002000020000000848ef0f222c3572dbf469f7e264cc23e02d1ff80e009d352f245d3ecb636b3d4900000002f0eaf020fbffe0fa470fd7d9d81600396e7b8344dcd596e180147a3244ebca453c71d3b7c822a5d7be3371cc6ad39d2a8b470991c7bd190adb7576ad228a58786414d4e3e273f52f4757a613d16739178842254192f649e60f57c21abcc57c7318c5d312610d2f5269a8c0f27a096ff44a255b40a2e5af0f9f9fc9eeb3aa30b765a6e785e3f1ba8efcc442efa27db7c40000000d7865bcc16f81c2f9a998031b922771daed16fdda10e758ad673119a065da164b9cc47ea7f36bc4e24bd8d66ecc9b41ad6db58cc5878fb3d4ca2386de943faee	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2036	1088	iexplore.exe	28
PID 1088 wrote to memory of 2036	1088	iexplore.exe	28
PID 1088 wrote to memory of 2036	1088	iexplore.exe	28
PID 1088 wrote to memory of 2036	1088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7225CE37DFD86AC275659A82B3680A80

Filesize
503B

MD5
e732b95a5286abf9acb9b8a3848d4c8a

SHA1
a5a1ce4e2d1b06e2c468e1c51aea0bbf4b03c475

SHA256
630fd6aa0bf33730ccf2433281cb01eedda5517b78d336b0a891867075aadf55

SHA512
ed3affd4a3a5ec0ddcf6b26b6082c4263c6013c6bbc34c12ec0ee9c31adfff11d3db5e9c9da7cc2cf51f699f8673af83fd808af965762acf38e18a3cb63c70d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8408FE5CA4467EE4DA84A76EF238FE3

Filesize
1KB

MD5
e829e65d7c4307d6fbc13c179e037a36

SHA1
a053375bfe84e8b748782c7cee15827a6af5a405

SHA256
67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd

SHA512
96c5793b2b57d8df5891c94015720960e0da4c2cf8ce1fc5707a0b46e5db8ce3761fb5fdb430f619d1579f13e80fbdd973ef6a024129ed039aa193273158fcad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
f9f77bb5722e46e43b85a092fa5ab294

SHA1
ebed47c10fe1c50eaca5f6b62697a430806d6ab0

SHA256
dddd7e18de9dd09b9c5bfd5d5bfc1113ac687ecd98457685b62931292470f8b7

SHA512
347881dd95ab967dea1cd920702b275d34eaa054963e889efb08c33aa75c65676de17437ac346fb1f74d3db187af71bbbbf8251c2adb91712e15baef00e9a682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04767ccf77a225e4458a8876f784302d

SHA1
f35d4c242a1d2a7a68fce5059afd96e155cdea97

SHA256
9c0855e8bce110969d37877f239b2e1383684e05c7073f43a438d610956b6252

SHA512
d9dd22520b95ba705f700b9e212464d2cf8d1c1003ae63cee1c5b40e2c44cb51fbe7fc385ed5718b3d2b68813c25ec8b945bd4a7d149e71f6ea48071e42079bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b7b7143edb439774aadefafbc1c3f2

SHA1
fe34de7fbfdde343052a8bbccc73e2214f6e6064

SHA256
1b15c6453fd97a271f94c84ba509cafe174f8794300d35f1c314c36226c37a42

SHA512
53c4c0c41c9d08648533254f47fedbb98d4ec8aa8e1ec3ed1fb66f613242f9b0994d0883b664a6d32e464afd4d548b3670f4df1bab60f947c857d6e745ea85a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a9e10b784c4d692f402cc1b192c4450

SHA1
6d8172536bcceff92c6ea039765aece28695331b

SHA256
e6c1cbde48223cc7102f0630ac4bc88b395ea71e6ea1127fe812ccd0a116e21a

SHA512
dffec9e3f8af04d35109fd5f3d53d2987fc12e8a34efe6a0d677bda9302ac6f0288b6cd6575ec0fc10fac2dde11e034b064eacd81c1ec3d1975bd90a5115b882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8611fc7a0aca13a5920e07082ba88049

SHA1
6a3a107256044748282a048cdc913abb363df6cf

SHA256
bccc0c12c99695f648e48f876c43ea7d2bf1bc33ca7c3f3e9e32b7dcf183970c

SHA512
7d75ecc547f977afa3fa71f4ef460a204e39742838d8c85c8fa7017024c49a265d3a69e9c09457c4964de032c45352c7d40b73fec7872337f978f17084418431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb7c433425f396e89f5d4a1c9214474

SHA1
d1f026d4cc11d9a9a0594cb9c91f5ed67b4e9626

SHA256
ff194d70d2e3d01daa3ece3e24315f4ef6eeca6514b6bcecd25f91d5eaffa2e3

SHA512
6dd2bac718721b1620f15653903a1e650619e5b3d5d003174d1670eb042e139f2e849a9aed9d58ae53d0d32b56a16438e270763f90b5a75133ae7c935bf00142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bb80765d64160b7011c2c0b94a23b5c

SHA1
adc397bd528524b2d769f934a62c510d54cd7327

SHA256
73bf1f7fed9776b35e428d910a223cb9954bc72dfb81582dcb4a3e6612200df8

SHA512
4424d2f8c27a71daedc070f0a68117aede0fe7ac9adbb49db3decbf12912873574649bc8466b50d3ea5ebfa4938529f105393addfe3a8a3fb93e2385ecebfc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279904688328df9ae925010698a0d1ad

SHA1
b8544b11c3ed631372f7e8137e8885608aeba7ac

SHA256
304c6725023e8fb517da412e2d1ebcde04b43ed82df70cebda47ff0128b10c4b

SHA512
32321eb3844649b27b8b75c0b64782f473f9ce5926db17b7555f8e91cebadfea597c112ade66246085ad3e292680f0ba94260f21ff366648c034aa5426e36f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ded9c4da763116572b00ad69fff65c

SHA1
60cc7ae968f3b19a54fefd95524e17e18cd6b93a

SHA256
62a8e88ce41c462a8ce443e4573dd7c231222ad3bae8407f0c4e5f28a63acbe3

SHA512
811c871094c979e0ff1316938faba1a6d8d180db4aaca20ca398466c32f9bbd270441b3567e1e916cde628ece25b6e74a2d395bb8db87294f5a0126cefb54018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3

Filesize
192B

MD5
d7a1860b88b315c0e2479af3424f0631

SHA1
ad2144d4ea94f1ca7cdf4732bf29356f328103ad

SHA256
e56d6f64c71e9e8be2eeeda883ec0e4bf17f0a94ed6798c3f8dc92c14105a22e

SHA512
2cddff5b2a2d4ae867b1c8f076bf1ca5fee7aa198b1a172cdfaea02ae36e22205c792d63836066bb787a5a59e7658bfcc50590b78df89c72760273d8d2719522

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D7A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DBC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF6F597A900A27B39A.TMP

Filesize
16KB

MD5
941ca6d0933bd51da87c6163e1a25c25

SHA1
f0532da145f8fb7de1a78a603a223f0d678340f0

SHA256
5d62ea8aef1038f0918faba5c30a625b200c1e1ff3befe8f9ac35b13130c860b

SHA512
b8d809d87b2be2c7fba2cc44d6d62adf6ef9c542da14bef120960b49ee09d456be7ff23e1d714fe611fb217e61d4759c267e59fd39df890c6e850c31f4acaf8e

Download Submit