3300a257935179c856bf0b3f682674b2069a12ae969140418aa024e13de418bc

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab827147f04d4d58e351d78a43efd8b7.html
Size

34KB
MD5

ab827147f04d4d58e351d78a43efd8b7
SHA1

0c34fa1f802971d633c6f311c5e4a2f48ae91959
SHA256

3300a257935179c856bf0b3f682674b2069a12ae969140418aa024e13de418bc
SHA512

00f6fb909614d7682b5e49394f4eab1bcfd8592e163d2cf0cfabb6401da0cce877bd3031fe12657ad936904d4e8feb8c897534cea139aaf38a36e46d30a4be76
SSDEEP

768:/uCCm/BVcSEwx7Vo56kg0NccHRmR0JlgSW0rUrDouPGlOGpeGYF+TGRH9mDru9C:/uCCQKxu0wJ0IrDouPGlOGpeVF+TGRHu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000000c37b52f08eb00a9ee438bfd87f3a1df75be1e3630c84179346b1e66dfacc608000000000e80000000020000200000005169e4546746f8e5d0c3f995fe2c2cadf92243899d5f7740e6c081f9145850ce90000000da1ca772270f02f56618e911ee98e36cb8f3d2ff5a293b3c9352b5b0e0d6e0d57c4d56c36a59d4d28416815b488b7b1d60b69c5dad97bd14bad4611741c73d27d9ae7f3ac4d94552499ebe3a11afda627cee1b75704de785f9654c8be7114ebafb4dafd0c23fafd66761fb287ae799f59beca787681c932ebbd71fe4d967a582e76e239df0e25fc85fdf107a61b5313b40000000273fdf343dfa8057dabd9966f8a148f0b1a30f9b02902a42b32110de02741e82690368c6555254bac72a20a87f7055f980365abcc069ccbca74669d32c4dabf3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fd28d9246ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415272779"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000001fb5dcefdc619c37f89d45dec753a03d971dbafc17b0a502420f3ea2a38a8889000000000e800000000200002000000092bceb005fa1181758b2eb9996f3dcba28394d2f626dd8175dc6a61860930eca20000000a46ca48e5e6d037ce92791c689be22fa99ce111f53e727e99dc6ec6a4d36a55d40000000c6c67515ed49774665f1c3506145ed485c85526eafad2cf95d83a48fcfc5536fabfccf616d6fe4d056b44f08d71abfcc06a69cb318e83423a662d870c0734c71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD0BD111-D617-11EE-85CA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1504	iexplore.exe
1504	iexplore.exe
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1576	1504	iexplore.exe	28
PID 1504 wrote to memory of 1576	1504	iexplore.exe	28
PID 1504 wrote to memory of 1576	1504	iexplore.exe	28
PID 1504 wrote to memory of 1576	1504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab827147f04d4d58e351d78a43efd8b7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
705f3a645ea5842b9b6b22c675e55177

SHA1
fca7eb6da0117247aff6bbccdb4bedc242e30513

SHA256
47cab5de6761e99d0bffb105f321bb2a69914b0e63f380a03cbc39e786b08663

SHA512
9c37e0b1be7a56f62ba4c2201713516ba0571a27b4c8768aedfc3a5b3d6b8732a0033375a996223331c4e3a49d3b3188662837cfe5ef701e375eddea64322dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd74f56cd22743257d8f5144e309999e

SHA1
82cac1ff93e15c815f2c6da7fe669379af2a3e7e

SHA256
f0f9ed430cfe90dd8e86d585ef8ca1e7ec76675fd479ba789a2a69791eb50134

SHA512
be6dcd31d670f2ce5466ce0688a39301625c15833945859abf696f818f094a59d41d9cc4149915a2ba3406cee74cdeb082f9ebbc1172bd70a12515a941a5a043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19d670398beed9b4cd25c18591176c7

SHA1
310a143d10e382e494a333ab2e187d18edbe726b

SHA256
415d3f07707261368f8b526fe4f630a3b23ea70516d5067f906ac66dae6d7fd4

SHA512
f9793f44aee5912659798a210d793f3ff58906f34fe06b199b0ecc702fe6a1ff1b6b85bc55cc16037465f55361acd5e819e355964c062958754b1bdf6d1e8987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6eda3d2372281bc662b9ac57dda9af

SHA1
775915f34137228393005b31cd2c10a77725f5dd

SHA256
5d114993170a8ca079cdb9cb8d5016010fe3c0f28e84147c8eb35de007b4a8fb

SHA512
b5fe97b9f4d58a88ceb195c1203c1bc123cd3558ccc3242d620f40bb0275b5f0aa7fa36a9ba17bb70c155550161fb76872a1ab79785e1165368cfa684d0eab99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892eaea68c38926a7dee639962bd7def

SHA1
3203305965da5dd440c37d74a8238b9341505b90

SHA256
7ba29bd2d9449861261aaa4d84e6d5c0d06e29216a0e97aed02b97cd75486cab

SHA512
2f7b50793245294041653d01f303db95123e24df181cff54b3103f34c58058dcb8b1f1fafc9470a234ab92945ab7bb05aa41a64ddcd26831b050447c75e7e552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35b1e865cc061a405da5859e8ce9d32

SHA1
346f4f0299ba307fd5e567509dcfbdb2d1a44fc7

SHA256
c12a82f7d0e60032adb5250fa8724096415e5f438bbc69d680810fd80c0771a9

SHA512
067030dae208cac4a569e2a03f8eeaf397969b31553dd4fc76cc6461a355bdc1018299e55c5b405ed68ebcc41d86e3562de8782cbb1549ddd9d3104b1a75cfa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a4b17ac5971c8e98992867d044f903

SHA1
6121d13b9d0ea146b834ebacf97dda38a565a9ed

SHA256
b787ae72ce76c31e04c0d4acce0e7cf8141347931a33780463860bc98438b691

SHA512
0d53d03c1290a4f0bc7c96ee3c50ce592c8e6ad31717cf1344d958f02d84676be845b9d5c95437e162b3dfe4155606b8975f13fce5cf302631d2a023693eb23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\cb=gapi[1].js

Filesize
179KB

MD5
4d4e1c761e3b8eb804a71cdf093cace9

SHA1
6c17659b5b7782edac52e8d940594a4299f160ce

SHA256
ee0c655ef27e84f0b50811b4d851be3b9a1177c8195f2060e7249c9e100daa81

SHA512
974874a33feb1db1ca7a4e7f000b76526c511a65889a5bd1b8b2d131e3b41902503101879756c87a0b1020dd7f299c3ff1de9b19f3c1d21e352fe5c0bd66b220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IT88KKGO\55013136-widget_css_bundle[1].css

Filesize
29KB

MD5
e3f09df1bc175f411d1ec3dfb5afb17b

SHA1
3994ec3efe3c2447e7bbfdd97bb7e190dd1658f9

SHA256
1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617

SHA512
16164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\cookienotice[1].js

Filesize
6KB

MD5
a705132a2174f88e196ec3610d68faa8

SHA1
3bad57a48d973a678fec600d45933010f6edc659

SHA256
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

SHA512
e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\plusone[1].js

Filesize
56KB

MD5
b9dd4bc0c774f6e47fc7f6f84318d3bd

SHA1
71e659af69facf4538bde88422c6ac7574c3bb5c

SHA256
e0f79422a5e14ac8ca345540ab58da18651216e375c4fe02143496bd9dc046dd

SHA512
419b21dd145dab3ab4b543c87fad7fed6281c2300ac7f1cfef1119703e5ee97930f1c07353b2a1274d4879b481bb673ce3566306c9b0b91b1e573ee43486b342

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7264.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar770D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit