1122756d9e0a6ef6dc86ca200d6dd39c83af2361042d68dec0f3be4e0d1bedb4

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boutique-floor/css/bootstrap.min.html
Size

1KB
MD5

692c74ff468dda749af57f6aa4fa8b98
SHA1

c68df6ba5d4871823b7fb5e9d612b48fb2b8ca52
SHA256

73c20f6add651fe88d636c27f8f553391be38106ffbc68d0c0c5a92d520afaee
SHA512

bb8f837fb07c96ab0aeb38e505b6d0ac354f0ed4e0ea5a3d3a1e9e12694062bde4af26397cefc44ff7744a917bce3cc12de21fd6e22469e0429c106d80412494

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000a89c45d1aa157d260a8e52d2a0a86c82582b739ed36daa1f1f4637a8e008296e000000000e800000000200002000000086e55949aadc14c9713f61f29af0f6ef14d3c0f409db7a37f7f7d3f85fddb19190000000236cf3678f3297bdf8ffc1edf238704627bc20c0ebe076347f06818fcf0a766cadde84fca3631ae33aff46106c0f94e45baa701def87306c6fc28591adbf2baac2b50bf53bcfe7105cddc69bf738d4c20ca13c9265b01276d5061e8d03c3bdddacedd6581db7080ee5793ed1f4dc200a77bd1ec3492ef13476360c6b9dd3e54dea4cc4076bb13969788cd352a96b2c0f4000000059a80696ccb670714db97d3ee26536bb43c2a1a38ec4b3e47b5fc8ad132bc0115f72c6dc50c8b7da44b579e010f33b8b8b883f4fb78f762d2cf9d7c692c13f24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C7FA41-D2F1-11EE-8119-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414926226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a0aaf5fd66da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000008d17bf1edc7b4cbe82f541f5b209eb53c5bff99b5ea50d7f955d620f6ccf9953000000000e8000000002000020000000eb9d2d90836104d2c9a86d51a1bad79ee67509599cc7ebaa6a80670e0439e6cd20000000271bff875011f70511b37170db675988810deaff38c24757c8745cdf376f1f6740000000103ef354769dd5dc48e7ca85fb8c1470f97a2acfb97830ce4c0f752f91e46840c67b92e886d9bc83636bff96af70707de009a334fa9cb79d02d92e174aa7aa2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2956	2236	iexplore.exe	28
PID 2236 wrote to memory of 2956	2236	iexplore.exe	28
PID 2236 wrote to memory of 2956	2236	iexplore.exe	28
PID 2236 wrote to memory of 2956	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\boutique-floor\css\bootstrap.min.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2423902673e19afb1cac3ba0ff3609

SHA1
97541f99c66b00e02a940be18d0f84aa704e4035

SHA256
785b94d8ad4314e2533a83537883f1313c74419c54151e3bb809f97cfd35abab

SHA512
b641c92bc8703429ce2b7f6d382a9c610616fd741163efc4c3901af9a03a44958468259b1ce80404c51bafdcf7a5648e2ae0c9d511c2ee27f5b16364d2c14d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
592ca0fb20e23d23a5a1142d90d0728a

SHA1
f1d46f4fb26e29b2c454651cead1e77e4204ad85

SHA256
917b46d6df41459ec0543d61aa3f647c9db0cf9d141b566941a03531dc193725

SHA512
ed2335cfb0e3f8cace8a2e313865cca2a9d043425ea0fc3539b1fab4d289bbbf950009dfb7d0dff3bdfc88135e7be2afd2a44f8a4b9fa4a8f66567dd64c34e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6b5538dff9df6c49679c2b04e3907b

SHA1
38c5f346243373a7b96cbd086050f79bffb55f96

SHA256
999d366eac8ba13970cac647161af93441deedab0fa695eff2b104baca664f4c

SHA512
02d5d30a654222ca9f51a59f2e53669d3de42afb4dc964208128046d9479b8ef0a16b82cae828aa6a8762f8a82d6274d08aef8f3e2fbd6a39f04a709f12f53d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493ecdf719fbb319297e01ba6588fec7

SHA1
06406eede0332a414e01b3069e5a4f524ca274fc

SHA256
321e0ca35bb61ed3d76c281ee4ad674094e35473902160099847b285743950ad

SHA512
ec4e336c3215f8a58b61b083bdafde505720f6fc7cda9ad492547240f906f44a9d15ff94507eabe3ea11a9ea1fa6b91f8a9ca699f89584e5a099583360c8c5d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08806bdd78f96e77d7cada7da5d9112

SHA1
5dfb6bc7eb293511d831c6e49b4042998e232782

SHA256
90755ece0209df27cfce664c023d21c32845dff1ece32c93e606667a4ad143a6

SHA512
ae4797a598d3e0a473377dd1c2cfe3b39094630f0ac1bcd086b4c1aa526d02891a6185769d1ef522dbb43a772e66ebda83915e244fea64f6565062ebd535bf16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8d34478b1dcd8314570f5cbe8c2c4c

SHA1
c68115fe88452335285f45927516b275ae63eb8c

SHA256
fa9311e4bde1c71838441de69772a490a1878d5ca77c572e1aa1fb93fb4e2c55

SHA512
9b73b7545df0fc549d57b34f90c91c1b3d9c35418ac90d03b66bce850664c0609f34f0f3289af84fa5fca879599b9e5f2eba98198517cb1cf05c8bd8c52c0822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff8988a284b31961550058443577b71

SHA1
562c9aef24c367446584ef84fad9334a929a3aef

SHA256
fec9c52c140ed1b0dd585441f5db3346680038fe9233c52ac5798bd437d209aa

SHA512
aa8b82aa8501dd25d423bcc5f3707ef32b51739e12287364d5a32af025ada7596d0ad0a234b64a5461f003d7050a8f4d5d1741417ddffa4fe7aaa277006538f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
901c3089f960b320d02d10145cb8b0dc

SHA1
ea1dabafcb85bfdba324214da3c089654779d2e7

SHA256
44aa068a896b07fdb347316db957f0ee6848f66f72143c59d8a1034fc427335a

SHA512
7be55562d687e516ad1aef6aa08e364110d4c28e46fa1694d488e4ba3027945dc9163b94fdff9115d619e18aedbb041888e9279fbe401f9adc535cce925fd00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9f9588e1b57ed059565b1fac0db588

SHA1
aae947bab1e34a8573291136629041c7dfd01bf6

SHA256
d30830dc23ecefba9793e7109cfa53b47a21bf443ff7f149b66898b32d88bc3e

SHA512
e54a13053b61661160c1a7357438c2d419fa435f4b6eefab10e3c1fe41a4842c239c4929ad3395652d1e27891cd7f3c2db60beb36572d40febcca019c89c2cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c632d1b785f1fbe6f9aae421a369fe57

SHA1
3104d87c7afcc903dd8b213692650d8cc38e1038

SHA256
06efbe8c4bd6fb806b6a7223fbdc3309104e9093f77bfa420a52b457222d150a

SHA512
6429609fedf459a288d53c1d3cf41e43f57384a1ccac7fca6888639698a7807a5daf8d40a38ef1524d6eeefc536dea5f0a3446b4044e4a037d9f14474d5e30e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2afdafc49797fc3913079356f36da083

SHA1
09de45614286cf6661ad4b125894f32f9c09c536

SHA256
34b57841c930c953c56994d0383ec702f7f4088e340ccb3cf29c6eb6a8187c10

SHA512
ec900a0067b412774db92531bc31b339931ad148716aafc5b72124e09716dbabecce6d4aaf6a53427cb98e547867bb5a6a31ede463d3c3c05bdd7e3b188cc246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff23c15a214b892a93b26144554714af

SHA1
e5653420abf127b66d0202ff0917e28fc79bb1b0

SHA256
ba0604c5af5657c18db8933369761b04bd4c3c241d13646c175076e30c553b66

SHA512
3e1be8f490c2ab610da7b5035353264bc8048aa58f0d95f6e0f7413a3af056620ba9464474faf07078b68794162c2db384cc8cb44dd19ba2080215c4fdfd7dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22868a6c3e23337766fb3d8d5aac90a3

SHA1
6965536289a212260b11f3964007c3baaa5d6673

SHA256
61df9752405eb8a792b576423673f3d0e293257eda42ee1f56e5b3199e946e95

SHA512
3dfab8db4845268eb0ef0a84286e31cf4ddd797037d4bb3e3057e455c36003ab5d835d6bc0c9f19bc16bea3b8a33d8c850402159f28ee64b678cb205f785092e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8b139bfafa02f9994db7a5fbc2303e

SHA1
c08589b66ed0f6cbf1cdce6127361e1b0352f6d6

SHA256
dd905af7d50e23cfeb7ec918ad7e78a9e53c3562458248ffef14ce3e5ec94193

SHA512
f2a8cbb40d1e8565d5fcef99421dc06c40c91ed5388bd2eb806b6afe1e2a27f2dc14a6fe3ce5f4218aec5c0e754686d1fca0b775a66baf9062d6229784ef2689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d9316c19cb20a629388f9ec537c127

SHA1
2e1ac7149e701d1ad1746250afa78b0a37c18d35

SHA256
5b3f7e789f104182163d50550563d1b9457c7e3ba49df51e9f9d80176c29a4c9

SHA512
9db36aa8d85e1dbad3d24a0aae73e9235493019fcad3dfc945291dc165bd8011403c5446e93c4291e7a94e4aafaf5bc0a9561ba1a33df60491aa932a12b347a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae895050e24f08760de29006b1635d5f

SHA1
0efb0695cd898bfd333ea63b22abb6a5066f66ae

SHA256
b89c869cf62babda53e86947a77f3ba13e65fe37e403dbf1f84f6fb10aa5cdff

SHA512
b47f72a167d910316aec4478b74c8f087ba26ddf5012da9e5f9ebe4f842feb0f119de243b7c988cf99b7568b1085ba359c84ca190421ea5ea3d6b50406e6d445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63d257e595a7458a4ee141d10f8d4932

SHA1
c136f158af3aa18bf7f732285fd0daacf3661b33

SHA256
af60bf28b22d52bc275fc5b2ea98083c931a98e22db0b9618b63fdac6bfac318

SHA512
eadfb23dd807bfa4fa1f6cd8ecc30317b26aba0e0bdb7152cd68187fd8fb32a946632fc54e06139b9c0f870b58d0c3274b05ff3eb78a6c358c18e8e636e7f46d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D2B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit