b1d1c0b582636f3f9f067b2ff0053cd038f2dccbb93d4d3f0c76940a36251671

Analysis

max time kernel
30s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

1KB
MD5

8e0a9e37a0ab6079cca42a80d6351de8
SHA1

6df7c5bd7073a728e8a3ed552288d477e74d56df
SHA256

b1d1c0b582636f3f9f067b2ff0053cd038f2dccbb93d4d3f0c76940a36251671
SHA512

9a19f8281c218ceb7472ea1adb5ae5a2a6826fa9f7d26a8846a81576eb61da5e2e3355e4ed8896dac5a4816cce8e7b25ae2e20eb4aa061dd7e51fc46001718d9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA57EC11-D360-11EE-A4A3-CE86F81DDAFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008d5e5355700082507b5c2b137f2c110011e7ae5862b322db99a562aced5e51c3000000000e8000000002000020000000cbcce5d8cbebb6bfd2289c975c73e5071df72902fe27b1b3a9b9366caf44b2dc20000000ab0543a5a886778c4bff70abf24cdff0bee2fadef6e002b325bbad84b1decee6400000005529f53b5af280f837de34b0b36e76ea791ba29aa4b9acea077e3e0b53820ca299d8cf747b48c7d59ccee546939dd3b508ca9d80c049564973b26ea847621512	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a4c77e6d67da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005ddf8103ffd1bf7c96f18632b3eacf71efc6829e641ee01571b8d9246387689d000000000e80000000020000200000005911c14c2eda15d1d310a9f6d52eff0e6f74c3f023b7ff710ce5ae4830fac76d900000007a20a484b08051029be3923e54e2e412d16757fea80189ba13fc18dfcb1bb5303523dba35bc109790ef89708f052e60b909ca0eed19d5a947a832e88c1da74c7b461ddcdd1012b32845c2b492142b18c576ad55e54a6f856ce3fba32978dd296833d8fa2cee2fcff4377e0979a274fbc07747cc59aec1827823958cef5526ef463eda9fa257cfcb20ee7060fcd7b9e1240000000e8475cd76aef6b625a942572f2dfd61dd66736e95bb291c75aae1afea14f899d2b1e39f09f34975f4c6b9da32fda6ed80bad804869d1f07c5c3283c0f370cb88	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1540	iexplore.exe
1540	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2832	1540	iexplore.exe	28
PID 1540 wrote to memory of 2832	1540	iexplore.exe	28
PID 1540 wrote to memory of 2832	1540	iexplore.exe	28
PID 1540 wrote to memory of 2832	1540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5f05299e29cc192dae6092b414ea3c

SHA1
55b9b8ebed516a54eab76a325ef84daaf4ba4886

SHA256
d61f4109245d1b8977a21565806c4f1f13706787586b7a2c5465c83f8f383470

SHA512
9622cc2061e339c52c1a7ade7d4a030b810dc4ad2529a112811e3217bac7004f300cb9b1e08fa97b7c3883fb9551aedb76c1214ad8761516467d85cb8ccfd2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f1edd78596e3f99f356b033cdc10fe

SHA1
9d7c091db7fba79ac8ad598ee06e706f98c5d122

SHA256
234c651d6bb2b88590f2b7618ca776c6d17c508c154d8642eabd233d156a2d48

SHA512
c0cbc2f5d1ee0526e7493440dcabeb6b4535977c4ea8824fae661512b3c4f2b91397bc0f229cde6b7081b56c125154f38593a28e651510b639d72c4653db653c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca703fe8867a396e022f2d9f37ea426f

SHA1
eb97b9640334b43f7daebed05945b00f4259dee0

SHA256
a09392442ce70f525649e2334642df5f3bc516e6af998bcbc5407f2b7f1de88b

SHA512
4f356ec09ea8eb2494e7a6bd96507cbec5450ff7414318f3d0986c62ba9159db6df87902c35c44f2a440c4db4a190145bea78670b194503871b237b81b5516a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2833d5cd09d26d64c14b5502f78a39e

SHA1
c7474aaf57ea5f1db9673903099afaeb6c917fb9

SHA256
09621febe99a7a510ba28467ab5486d600dbf92d5781813b56a906214d020808

SHA512
3c528a0a484cef2f41cfb3d0f183d5336f71a9689ffe9d9cda47f5cd9a78ea937bfca9aa00d6bb04ecb7e02e79c400851e67c4add3acd43b3bbbdd796b2736ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4831b9e3017d8e2d546a759f600d8b5f

SHA1
0e65d0ce8e5258412cd1ee5c410e1f69c8c237a0

SHA256
e1b2ec526268c56df5a3dc1ce1b25d04f58b76f0161adf70276e234fd6546c87

SHA512
457e7b5d884f375e8948bd3eab4155d07ed86e4e5c03b166f2e377574634d5fad5fd355c35d0865ebb55e31a5d25007e913934b8f61a894ea86b7e0c623ccb9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e924c4ea80c14cf3bdd5dd8849b6528

SHA1
8c0a8c8d1dea60a96807374a68201207851d9e28

SHA256
580ffc40ca5788a0132783fdccc1eac8aa8ec7afe93a69c749b62c8507aecddc

SHA512
9a44c9d6a50e367ad795801d75fa9b1fe8b5596f46a4282b7dac5387b02452543f6279629db7a3eb9aa495ee77505c32b2fb5caa488af429438fa853917ce2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
605ca1466e2b7ab14fbf2c7b95536075

SHA1
9848e1155e83971de6ff7a13dab5d57ae4feaa4b

SHA256
ee20b2362cf781a9316f955ac58cd77e9266112ba70273373e84365d8c5a056c

SHA512
3031d70c0f6b47b38e9bf8fb7846fd40962e2d483a8254fd46e4a048919aef0932d823ff94aa3125fce6448148e018a40252bc8cc5c74495ebd630519b099cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7d2d304680a23380267ceddfe48a6d

SHA1
919587a70f1fec8aaf24959d1e9bddff069636cb

SHA256
59e988c5d549c06e0295cced140866efc0d24c7f1151ae4bd439120ee838fb58

SHA512
d7de5e153bd399f7fba2bf83974f4452f71e6782e562fda2a4c54b1489a7821667fa33afb0fbb2937e18a4c4ed38e89f6998e07ce756c164c2865f0a141ba416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44d826a72b71462529130cb3a757b5f3

SHA1
a467a3f7a2b15544e17b3027c59e70d319d77a24

SHA256
a32d0632d06387f0e88ba7107300917f8ec68fdd89b40792b798c1e489c5a445

SHA512
4d6fe84f5110645e7316cb64c8a410e6ba471bb68c855eee546fed90cda43484bbb06f647dcfcb55f307350dfe505195170382d939c642a658bb17c9a79cc3ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33C3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit