13be0eacee61aeb89378200b35c530f445539f955ee56da58c3d671d9145f3fd

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa2f195c718fed4ac83e492569cb95fd.html
Size

1KB
MD5

aa2f195c718fed4ac83e492569cb95fd
SHA1

00a10049ffd75e3f561d52287f96afe3299db14a
SHA256

13be0eacee61aeb89378200b35c530f445539f955ee56da58c3d671d9145f3fd
SHA512

f325bd21a7b15a4c2d3374ad88ebbbe5e8cf47d3aba56785b398b8ff8a7bc7796a787f10eca8a60667ff05dad511e8971c13cf95f62a26ad1f9f2b576e872665

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D25B6B1-D5B6-11EE-9502-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000005f1c8f7919a556d0d220592ccb1f5c1d11f9a64510155463690f1247d5a2456f000000000e80000000020000200000007ce0ff94d91a31ac305c6fc1a1f5f6c012ecf34f39a128dede07580db4c882372000000048c4c8cbe529f84148506cada4b4224290c7de4d545ad3f5f07c3e9d03c17494400000007ce148e188bfa5091482bd518bc505cdde01f2922586877842788f4e8b684ae8b19625da5acbb6d401bfceea44a8fe106dbf96ea3af00f3c8ce75e8b512b5281	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60584f12c369da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415230787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000af6d067ba5295423aed6cf38dcf2336b405ac7b06c1a4cc4f01a97116c17dea1000000000e8000000002000020000000e8548537f982dcc092ce7898592d2a87f9e36fe0d6d6d304a2e44884057de9d390000000f43d078be110ea39a67d57702fdebf50bf7733a883710dfccf2561c152816fdba9b307b3ca6f35dfa5cd851f92f0f7da4c85d250bd99dc019fb9be8452eeacc9d6797849fe5b2d546b729efc208956bc77c027057a8d0b407658bc60278052d7aa869878f291e6ae7c19d28d4eb53b489a1f8c61f8caa08318773250dcd4506b3a2e31a6cf4189e95e9142deb299bb82400000003a7785807c196b110e4018eca518bf72ac533551eb460927a45bc194b0d2db7c6a07e34942ea399086f75387ea63df8fdf25760dcb537038d3a6ab69661336e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2784	2008	iexplore.exe	28
PID 2008 wrote to memory of 2784	2008	iexplore.exe	28
PID 2008 wrote to memory of 2784	2008	iexplore.exe	28
PID 2008 wrote to memory of 2784	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa2f195c718fed4ac83e492569cb95fd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b125af3614e1ccb16cc115a4cf98e7

SHA1
5cb8c58c4155fce30e46210746f4306fc8c5b66a

SHA256
488145e736b8f4cbd8db71b1f66f2ebd310271a1782feccc2cc5546a763ba9db

SHA512
769655a1e1bdc74490adf0f576d24d2cac774f19a71ae04eaa89aed6b5706938a3dc7864d278bca480f25ed17e5208e5fd911d6fef5dd3fcd031a3ff17a7e552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6934aefaea997318a86b66cd8f62a2a

SHA1
5f3405db178f4bb8d0259aad7180e0ba148cfac5

SHA256
7b49d997e806ec98d9152c861a314fd22965f652805442c470f5f7ed78f3c483

SHA512
8d82472b44cf9e03dbffa3d87b5ddcdead4cbf50bacb2d3de26ccef69261f1929e7370f181b67004d3725bb02d899dfd7decc00a6dede35a5de5ca8d6039afff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc27e5b01a895422d7dee934280665b

SHA1
a7b793977cfa5d62197d2e99d5d80fd76e9674b6

SHA256
e703898254c2d43dd0c5754e5ff847bbaa8fa9362091fe037beb52d25e816f95

SHA512
ab2f81c07159daeeba431e1c165a598d9c7302d40af96087fde8b5bfd74acdd01950f4f41014818252ec5bb8db1024a879cdd323b9e7a3841bbbe758bde83787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a600385788e57cbd2e42babdc9941d

SHA1
4b327d7739342d127c90235c9984b33d878031d8

SHA256
f101d0f54c0a04bfa92c5af3e97b3a035f8d0716a06d74ab5fb66855a17c7494

SHA512
5f815df4140425ac43871be6860655dfb29e4d0e67804bac6a9b08a6ecbf3ce5663924aa13fc581d1d1821cf6c204f579d7ca5f1f55e822147148a9f06aecfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b709e449fa7643671f76510cf77ef93

SHA1
7e60014551f5e0bbd8d9e1d43d98dd96ff4efb35

SHA256
d84c69c7b55c7344ae6933d709ed035a85033c4f4f32cdd98991785793bdfe32

SHA512
2d74b4bf45b960976b10f107da279b61a64b8157c1e8ae607aff3798c86b7b301a26517d5a5ff77b0ebb759bc28d49cff8e06a2a75e59887e5b83b6ff48d828f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
899f4bc2cb45bd7d88d88e7127d6824b

SHA1
59c3079f0f5f79d622c3748b91edb3cfe9571714

SHA256
3dff66661056013418de9262b4630c504acd630f23b931574b417fc570846d43

SHA512
856db33c238550dade5b0a661111235f61560c7d67e946ed08f05355b8b4136797de701c7055eab01fe926d42a4ac48f634a9e6e325890180753228cd761c54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f239e185a23c5104ab617970038d745

SHA1
3daf62463695c8b0e6bf5bf306e60dbc62412e2f

SHA256
6269919dbb0a76760d4d6f437f328003612402455ab15fe9706f2caf92f619c9

SHA512
a7f4093d73d6dd84637e2d529d779088973b958f518044441419f70c905773fafa6f141df2899634f510e299b3cd4da23be5768e59c3c01ae77129cf9576377d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f929cbea3225e056ee16850423baedc

SHA1
ee48601e2bc88714d920b56d965113472cbb83fc

SHA256
eebe1c30cbb77b80529dbb0b20a37bf16bc71c1922dcb9da13a0eb9245db52a3

SHA512
d250935649958f63edec7b72db9ddca61b68f048d70054c6e00a727c50593245c73bf7cc64d60d8dfa6675c9bbfb8e256fa2969983058ff9ec54eedc91c899e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8729d02926466cf47a4995578c4f4354

SHA1
6394834e06e03b4e5f13b79cc74fa8699f588a02

SHA256
e03f05611ea615e724184153966931ec2b5895000a9251eac5201195102add17

SHA512
983c0b5324f05c41cd9d710c4ef0c31d95b1a9833212cc8baa5a861448669dccc967582b4afdc0ee2e7234d7a9b7fd8bd1b0d58d02a7bdef82c1c2868066afe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ee666e08074c351cbd9a8f22e84b06e

SHA1
1cc4f792ade7dc7cd2fb9475333889b13f888e25

SHA256
1ae5fd7413fa1dcfc1f18c3e2b66a5d7af614e8a257c8ce51eaf20315e82a074

SHA512
ab8479b23c91b6acff222ab512e2c5a2432eb0479cfd2985805e07590bb70d1056c3660572cd81f4914d57352cc2ee433b7f2650334d8c976e62cbb4e972733d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8974f3db3cc294b87804898cc4bd9d7c

SHA1
e0ff75fcd7851166da92d3d269ad1dde89566552

SHA256
cdc2d5243f37d4eff741364c4d2d179bdef5b05d7d0feaac292d192e8738cae0

SHA512
49d0831c7f329641e7c1406c095d6af729e5c774172f44fd3b746dfb5a94421c0090255c75ea70fd0ffe0bf87facb20313d64519126b6abca0a302d2060450e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d24facfcb55829ba769e7adcc00196

SHA1
624b98a8142193e0be30105a44ad83967991fa4b

SHA256
7bfccdfc363350f0744f867d7ad2e5ed6035737670a8122dd872bcccb09da95e

SHA512
0d4dcc147bfc2ebb830862e7a3bf55f0bcfcd3223627998f358d64bf7742fcbd68ed0415ef89ac748697523f011861c820ae78849b8e3d11b1c884e3927a82d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b83f8dd9e7b8ccb1bc4976682e421a

SHA1
4b970c9a8b350d2b87a7d2fe48fc484da15d2b69

SHA256
c5df96f5a4c498faf0ba36d6da12fee61d558b8ae0209685a00853001f0a7b60

SHA512
e1c6fed99323631169239020d3a1064e000da87cad43005ee6fa8b8778126bb12782ee1624633f46e8b193bf878abbe5e146821ce24c4f7d981cc5a667fb8e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a1fad95e3f406114dfe96eb3783846

SHA1
bde5eecb11163e7025a4123e748d2afb3cd06da5

SHA256
f49de6a316ba56b4a92daaff40f1c17c1754f5ac6296b141a8921c18d37f6da5

SHA512
8d8ebef8f73ae99a98356267c8901ab6ba97f187cb0e7923ad22f97dc35bd54c48a3d3b7e77360261db5b2cfe31b2d324e4a4db1051f00ba8b982bfdb3794906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe9c8243835b19a891af38998f4dced

SHA1
149e57301e9ed6ca193a66b6b591d3e5de033954

SHA256
5fa491294419d37257a2e0775e915c178e2ecffbbd0b958a423151f2edb37827

SHA512
0ece5c231c52af3ab7357e0c768f4814237ab9460332f30c21917bd88d4c7843981eebc496481b06942beb6019a61c17e34ba55c9b4f6a8e97f5f25efa58511f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA73A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAE9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit