03c54a962f7aedadf608a73ac32727f1a3004f269d3a11911492ff7f80c8d6fa

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44e06888ea4669b11739291747f7b57.html
Size

62KB
MD5

a44e06888ea4669b11739291747f7b57
SHA1

1546afed172a88be9e5900b5fa93a264de729d1e
SHA256

03c54a962f7aedadf608a73ac32727f1a3004f269d3a11911492ff7f80c8d6fa
SHA512

4f3fb12f7777fefe0c96d3ecfb4b1baf96ea59e78e4086d3f40472fcf5b634fcac069bd67d5355eab92dfa8d4ec067165364517cd0c8527e15d18d5a2e3afa9e
SSDEEP

1536:rIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sx13K:213U1Oh5R4Ae

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3882931-D3FE-11EE-9443-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000007f1670767b1bc1016b53a8fad19697d73620a6d4d92c6f63f2396abcbee5c099000000000e8000000002000020000000a0d56c7abac508eab9cb2103a84bacb3df1646f9c5bb5e9c3251f498f4b7d4e490000000c26b9627038bfc29a5f3664f284c0909e767e88677bf9f74b7a04491ec3f16b73b61f41c10b485cdf0a7584a2a2cc84ea2b3426cb632698c3fcb260c869f4cfbbd9a7378eb52bb0302b7dd423254ba26965e5ca8c012b9e629d69bd40315870a22d3267a721cdcfb5e8865018cfe17a40618163e185c365bbe675a7b7f2e8d5233e22c741a22c40bb8587d2357ccdaaa40000000596bc4bd5e5c09cf6a359fbb8703b8c16c2fa2156ce82d3880fc5aeb6ade01aefd15d90a3e685354ef31cc4898ec32a691bbbd1cdf76c857181a7877af335260	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bf08aa0b68da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000a206f076472a6d0595ac3e804f7835a1c5af01f545d86fd8a9b8014bcdbb42d4000000000e8000000002000020000000b4c28541d24210d9d8c2abc6194cd7c6f8ce2bdd25971cadd51b981418d5cc8b2000000033410eb22fd36a4b3fc17436ade86b3aaee4ba0b7012999423bbf365ccef7163400000000ba87db437d789b74381e33f3ba2221b80419f91c65cf57f5b02bd86d3f8a3c04e34e333d02afcad30e91c7eccbec44458cbff84a7c02823082fb30d560fc101	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415042061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2128	2152	iexplore.exe	28
PID 2152 wrote to memory of 2128	2152	iexplore.exe	28
PID 2152 wrote to memory of 2128	2152	iexplore.exe	28
PID 2152 wrote to memory of 2128	2152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a44e06888ea4669b11739291747f7b57.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a396515bcfe78b476d4f4bc61527ad76

SHA1
287834ac86c1ee2b132a5a613da473d1f9a29558

SHA256
94baaa0e4fc10524e97e6add56e52c930c885f2b800b29350a34d150d169c098

SHA512
17161fd53d7ffc10b8562ffaf2cbc4510d361e3f13ad16b3a27992157e050acbb26af485fb17cf40dfda1b95831e059ff991582c182faaababbf9d9aa7f88cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc698793298c541fe68a00c53cfb63ba

SHA1
7571c65111cc61c7c847672ee71b35f4b1781ccf

SHA256
87b99ee770b4dd93c4421a0fa9a1ab7a470fa37cb7f6e0d8cbba22be25f400f2

SHA512
ca365037c026572fbfe457ac928bd1a1d7b9d115bf5505d12c777f852e74bc9f97a4e17b9dc1718ca7c3cf529aef330dc1f010b0757e64c7174f8b847cc9029e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ad8509b1a19ff250b2ab7959bc30ca

SHA1
ba4fdaa4c10ca2b3e6120abb4066d96b2da92a38

SHA256
22d9ee02e068a3e189fe8a59985195216c17ad7b2d9c0c5364d7577f75f94175

SHA512
76cd6debb435d81ef7ddc90df9531dcbba5a9d16b3bf657cfe7008e00cc91c5e4f80febd5a70d8133598ce80f3a03e4cc540de5c9132e3ada7e8ab9dd6200907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc7f35ca0a5a3ed6e00f757f887e50f

SHA1
16b970d0200fe8fe01b749b249e061eb5e872078

SHA256
a79a5f7b929248bd87c2d865c37975b036de7d5235d5e5e0dae02dba74e06d82

SHA512
16a5fe7c2459b742aefd2b7c9c75830c0753c61439068906f5e1af12e5dde282936ae7593312de5914b4bc64e014deead73b777d2cec449184384a1eeb760b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62838c0b0d2207a0e86f70d30dfa7525

SHA1
76ec1574986eb4e5a633c8cdaff90432e9cdaab2

SHA256
776e13f3bd7667f6ae02e19b816bf641995e98f9441f9611c58dc1f6fbdb7617

SHA512
8a2ce94b0e11cfa9d79f1fcf15f92f2d2e5a06d3f23493d071efdd2b82c03920714889a1e32c499e8f1607082654efe24ecdba66dc3927a4ac16c353d41d95f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a60f41e6f8a4ca277d3f56db0b3fff9

SHA1
56211ff14052047f9558bae0bad9a52ea431cffb

SHA256
509b1a9f5f6be6b6b3e3cadc919cdcd551c0ae5b6944dbdaf5acdcc3e5cd2293

SHA512
6c67563078ad14c4379f8422dda6b9967a255fc013ab84573ff8dbe3c1732f9ac099441cfcf8d53ccea36cba7908ce5924d87fcb430f7f71ffc7a9201775faf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf0f3127f343d3bb8b60dc9ac6766f2d

SHA1
a30ce1c998596d3c32811b67e5be6ac2224ea2d5

SHA256
ed4f760e9213f0bf239a41c043b7db1db0a3456b3bd30e9ff362281949b7c058

SHA512
b57235417e8f824f6587eb62da930163ae4765092b1b60d981c16101056cf6e7bd3ee53bd830c3d480d1cdc286a2035c3a4741238fd580e5fa07eca67fa61aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0584b74728472190dae2d322dbbe2d59

SHA1
d3de26cb9006b6b993245cf8a9e71baa63380f98

SHA256
14b18f030803458e6346a7146bb5f9310e2ad3466445821d257b4d0fae135a72

SHA512
e0016eb57d140bf92f12192ae123721a5400e75712791bdfe59f5e1dd707b7e4c5203556afde72172c5877a4d400d847ca526f47b2c5dcfd4d8d1ebfffd589df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cefecb7ae11df6f773837b18a1b571

SHA1
a75eb2e4b0187ca7524e4f4714c9bc1df4386f88

SHA256
3f952805668496d75a6ef45a51cab6a12fd20ed3e7de3efafce5fdb52fcebce3

SHA512
c99301060da9476607291930254715b9c4cbf071a765ee06e790ec12f36056d185f3003686f17e7ef3f954428b75b6219f89c6c8e92c075b3bc590cad15473de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
603ded416dbedeb9e164feed5700845d

SHA1
236f49e7a77332dfb8abdc13a1aa9fd81aa11a2b

SHA256
79e8c630efccd782023f8736e7c962ecad12239c927f387bb773e0b126641e69

SHA512
749ece9607f1a4898b1e83befb41d212ae3abc4d7eda76b09a47079320e7dd4c65c3b8cca19b5cfac2190f14a0aabffc8a830715cd16fa90b95673c48275f9fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9eae44a746468b624561159160f537a

SHA1
7316a7eed74e8ed1f650b41d13a900eb391e49d1

SHA256
8fda4196374a78889fa63364c334396024562de38d3d7b45eb36788d9888e555

SHA512
97a580c3cdc9ea22c6778f4df5a46943dd8df6484feac7e5595b58546668738bb629bff402633d51dbd47614108cdf04f194ab3cce4780c66c526972b847c1cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1d6bf570d324cc77ac3c9314f1d6eb5

SHA1
37e4f21529bcb10b179f2fdf1a99a8d00ed23035

SHA256
614bb5c03a32ff2d2b9a37b18881a3b4ea7ecee417f4fe30e5685f61928ef4d3

SHA512
c3f5418786a30885ab6862ee145e09c968b8d6d45aed20efe5c5a76d3b9a39755d834550e4e4f0680f9378bbcc9bf49cea44e7399bc39ae4b61217feddb34680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
621021dfa5f0375b9e9557c110b002e2

SHA1
b453d4a6c54a8b78fff1f3e276b9d75f548d54b7

SHA256
7caa482c22b87160efcc1d9f41c7b61291235719d6fbafa775064ee394047c77

SHA512
95ef1df3a875c61b6ca26c75d4dc3deb3a136910a84bbe4ada8970658748da33e112b101bff9f2d99f3d33526e5bcb0422aa1cfbd8f98b0da429c959241fb979

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A4B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B57.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit