5a263119d971a552d0ef9fa47f7f4f6a46e5402bc37df056cb4a8e195586ebdf

Resubmissions

24/02/2024, 11:02

240224-m49y8ahh22 1

24/02/2024, 10:56

240224-m1xvgsae4t 1

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

42KB
MD5

5f17f67efcf64b3843cc50cce259b3dd
SHA1

0c762500f57364ea2d5371bfdabe552a765e4e38
SHA256

5a263119d971a552d0ef9fa47f7f4f6a46e5402bc37df056cb4a8e195586ebdf
SHA512

4bfd48ffff0ae16660623e7f23578fe47c9f4b6b1ccb8ef813207581d59089b04f8a6f4f4fccab0f2bf4076e19da7b1a4b0968e88d52b739c270b3e3992a3134
SSDEEP

768:TdpqmL0Id3AAYEpk7IFvRP0Mad6CZ4VWwCW3KI8ivfJkPVoEAd2Z4VWwCW3KI8iO:Td8mL0Id3AAYEpk7IFvRP99CZ4VWwCWI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00b8e091167da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32EA64C1-D304-11EE-9A09-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d3f1a14a542c5c1edaeab97224fd87bf6fbe7fde7928cf028781d1ac42528a4a000000000e8000000002000020000000e8d01373b0a453e22206b85b07c0c52247809a4fb3fc93d997ff61900c4676842000000007a2dbe0b9fc8dcbe7adbd96d9ac9200d2e3e9f6c6ec55d2d119a5e3853941da400000006ad6da5e8adafc396a8a83c03cb3154f271275a725e8596e8c12f22efc59256fb3ed114ceb168f87a57aa23bf6ed8c74941b99a47c6a98924aa85a0ea9dd7632	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009a9cf565e9732b53472444f79d0c52da4e31cb357a59bc85cd6aad20d7adaf2a000000000e80000000020000200000000551b939815ce655033724001b0a73d178f277c10c8f3007bd463583cab8719790000000b0273d47308a5a708c500b30704c8a08d88d58e64bcdd125dbff4eab8dfeb051489d9bdff5202691d00466c0002756fbfd03e639c57e6befec4d05d1936e202a2474986d5da253aa44f1941d7d08765aa766e6debebec03aeb63aa3ca1f8a2d20ae4814c9b5b9d4c55c39e0fc93099519cb6fdf87bbb27e118629b598247622369acc969ee8b3fa89ea7e3398e42b03b40000000c7e0c00cacf67958d6f615bdd57f17381e42bebab3a0419d2b2594cdd36540ffb7e65d8441bca76005b2672af44b9f48ae00dac4e08b5604dff651ee724ed92d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414934418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2540	2656	iexplore.exe	28
PID 2656 wrote to memory of 2540	2656	iexplore.exe	28
PID 2656 wrote to memory of 2540	2656	iexplore.exe	28
PID 2656 wrote to memory of 2540	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77b45b2461b846b4844293f6b3655249

SHA1
261951c509ed896e6aa732ea18a2f2f032e2a365

SHA256
34a1f85464be4e7cc2f14df31dd77b0c1a7225f056a68c4930ce6cb34e814254

SHA512
d594a8bb22b797d0b7e8d98f45fb6176418d4bb162d1300aca4069971d18ac2ca5c9433bdf530964865d33cfb99a6f07501248d427be4e939d5a0e79cfcba937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b3f162e023edd844230994ec51bfe1

SHA1
69d41fbcbd91c41c208a438ae4887c1f61934da3

SHA256
7222d4bc78c0a5f6854ba9cad159fe5c1eea3bace46c39297afaec71294ef841

SHA512
a21825296dbb4d278504786ca96fc1753104cc5993362c85cd88b94ac01720b56d8bcdb064fbd9401ff14f2c10721c2ab9860dafd7efd8c3d7bb73351d209734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6824ed52cf7e30ac8e027fbba74e345a

SHA1
4bed632b69ebef14880ea88da9a620cef4b08f03

SHA256
d80e2a7127ad9fe7b0e397554458f104ebcfe33857092b2a598b894f676008e7

SHA512
be68a53f44a7c96a7cfba38e15918d5b68c08fec114f708551ee92ec71022a657bb97720e5d762d98cdb1b8a72e1f283c8ebf4cf49cfae56d536d6f4b0a94423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc0993bc5b67ccbbc1db2573b4b86c3

SHA1
34e8be4fd51f74f382a33980b80332b1b030d196

SHA256
42f41e436e5f94a5141e1b0685392c32aa963c1765666e7c1bd784fe0335ed8c

SHA512
0db87723b3ad60b44dcc6e6314b0b89540c416f4e617b6a5aca3b5d570752db1d050267a65e1876d1c82ef40d0623bc6f54f1373885c7c101df4a262420e1794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3f312c2d725840af305b49f5955de03

SHA1
589668d2a75caf245b1b979104b146a6828d9209

SHA256
aeae9638fcbc84910d748bfecc69886feee3b580c4e5af2b270faf84a29da04b

SHA512
bbbc202cc2945caf696810cf80976a0f385085266cca50b790485921a1fc5d343ab8007b23aad5200f5b530431cebe40cf2f9eb1c5d2889f1b310c3d4e4c2356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8382b4f91fb017011c7563a00e3572a

SHA1
983a786b219db52ea71ca68819f9e3132b21402b

SHA256
4de316035469ed825cc39029e872a1ebd12f7e414835dda804154e4446948677

SHA512
0f710467a869bcb6846d837eff3238ea648fcabc6ee24d4efa6e9763bbdbf14670c563d52a4bface97a4ebfa43c27f7aba12b9750cd27698a34e03fe3f08fed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc07ec2d61176534041f75cc90d9597

SHA1
cf5b49401f9b761aadd7c59b7d512f8e38291de4

SHA256
6c30de8ae6a177d1c740dff0f34f8de4c1dd552da51d00b1079902957f280c0b

SHA512
6601578ab328006ac4e7b455eb2a194c617f4a181a1de83abb5e8a52a44f33889257f22dc06b736a6521422bcb5733511da2ea353219000ea164988d52ab1030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a1f571c9f6791c05db7f23005ca0c2f

SHA1
c51b199e5a3fe2b8b32a73c939f37ad1005b9cec

SHA256
12b3697d0875666ed8958c5442a04d00df339f677b277b28fc2687afed36f4ad

SHA512
1343c25d68afc2baee5a74c8bf7b75de7304894c85bca98375f2b7339260ccad82ef6faf7bf6d54048f90d5c906265a0e7f0ac13ddf277353d00918802fd6503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b345e87989b5fca175c07160cf44c2

SHA1
f4cac368cecae7b4f2c7a00fed738e926c31458f

SHA256
cc49ab2327c5354082a7a173dfef908ba10ea1f31e145065e312c403b4935841

SHA512
4df8304238d036d8ea3cf687fa1a3512f80ba7e3a1e4899e386ac94b59e4a58f9edd06f1d2bf64668c4b9687331e65ad434e51d4dc1b5ecb6211197ba149f0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7011fa8b4228ceff9b7945692aa6f638

SHA1
1ee7a610a47f9c48f20901eae76533c05e1f7205

SHA256
60efa2b8cb0cc27c41c35f2b9c73fa3dfc4184d2903fe05d0f336314e3ac92f6

SHA512
e576bd0a0fd1e1a8c21a4093fdd6fc945245467f721e21709e0ea49cc188b48c85aae6c610702bd65fde54f0e652c5465b1b2743b626f0abf0a0803881f80142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0ca3f3759a4208d66ce756576472418

SHA1
ab42e8b64f8b2c5227cd0280a3c93d2db3dded87

SHA256
2ac332be56cc2e0915b20b3a41f3bc1b52ecafe249712580de218f3ff9896a63

SHA512
37a58563019535ab521cd1e595b0a15c73d12c4d926c2d77cf8dc5de1bf89179f460590ada6d1fa7e7bdd5173fe2563b34f93bd06d86a9975638d960e4ad824f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5aa71f76d83a404b8a2bdfc5c11dc08

SHA1
bb321912c38ce66ace7e2d3052a6164957315e16

SHA256
50962be64f3bbb640f0de2ede484f8df6af227c685f729728bdf745cefa1d025

SHA512
903e1e4cc3d481fd99b16e67a8e6f854c367d3490695fda7737ca5c5125b38924866f2451eccc62d2823c036daa278909a2034ab57c1f72ac2f6bc781d78d04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd4edff524df47ca02166133dc43329

SHA1
c959f2f69fe263891c58ba1b1318b1894b4710a2

SHA256
df597e2f9271de92de2481c08b747f890ead0b657152e8dade68a69d56864ace

SHA512
dfff1775fe9ac96f8b37f76834daa4d4157c6dd134749a0b6f5deba7c220c0eef75504486fd7f28d9201ca0198270ed2149fee2436bc2d1c5181549939c75aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4fc0e3f3a0213a5f9f3e94f49a7394

SHA1
e37b95f7b5556e175b239682835c8751c901a0b3

SHA256
0dbe5930c79346949948e64fc40f1988ef3a036ce7c98c565704df79771d3d30

SHA512
563f6ab326d1c48545c462160b2af335c95f46e42faf38948d43b372b1df79f5e627662dc2ce03bddb2d3f4f61abb0fd90cbd444b486d0a875308371bbd383de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f38a6879d7799e61b877cda0fa7962

SHA1
a222e5ee376749cb290800cdd2356c9cba24bc02

SHA256
8b59eff618094e16f70a95576814c9708bea0b5d6cc24e4a9f6165a31094064f

SHA512
5a9bbb81ff72595a448aca23adeb3311a2c3748c63b4ddbbfa2548581593befcf75fb161a4f0d3bf7545ba1714dc4b1f64cd2ade62ad6da91a4bbc2ab4c61b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9898da44c839c35e031932e912d9ee36

SHA1
c4f664e38ac740b78ef9c1396aa98b9dcd4058c2

SHA256
532fce0f11f2629cd4d066f7ee98172c9fdb81749b5ce3c711d6b7cf8b8fbad9

SHA512
c45e7e152fff106aca0928e30c4776598ed34a8df2058fce24e2c86754614271d7d30378afb1e8c25ed7b1540d330b816f169560de7e9a944d9bfac9c351bc43

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA28C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit