53c1503fb90772f85d8786423df3fcc98d497efc37a79ba857c412ad05c810a8

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

314B
MD5

d4f55580b1f137f094e4adeba7528ec2
SHA1

b340bf4b18b60ebdf7afc8686ac82535288dfa2a
SHA256

53c1503fb90772f85d8786423df3fcc98d497efc37a79ba857c412ad05c810a8
SHA512

4fa76b952a7f9eec2ce495a929470ca68bea7435b885c5dfbb1103b3873794c57e2255ce9cdbd646fe65763e9416bfb1df6703a7388b0ff5ee2b7e2f53610fd2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c44c73a6a6ac2747977dd34382e865c45269d879e631308378464d8b00e29f95000000000e8000000002000020000000e4a50b0ff399f7d26c7d16fb21a77ae4955fb1c458549c5fbfc61d3a69439a5e200000002e43581df117b6751e5870f4ea0c9f5c370890b777975ebd2391736c9413e08b40000000a71c5a966e1965d27b6675217dc8cb99524465369d25f70128d2923189b85e82ff6d899d6060ac4463024493064555ac3a88eaffbf76e58c658dc03136f05661	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c2dc25306ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415277637"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{516885E1-D623-11EE-A01B-4AADDC6219DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000d6e4f24ebdf11b96d6152676d3f0990c0c69a71b940a502b7a4698ff196f916000000000e80000000020000200000008510c5af05abbe5ebcc49cba3b7e533c467eee85aa925fc93249ea6828c0999e90000000408a0beb608bcb9b07e4d40807e40e3c48bc63dec08505965d7201645e52b1227dc970c1a8c5d6ee9d80565d8bca9a2db67edb5e66a5943ab86085a737da0fe979710cc55dec47937478d8464efe25db1095020b55327b132cd46350f9fe0646e2e09f4ef80fe045b6138c4ce2f756e3b5754edbc3ab416b1caa927f344409a39d452fe1591b28c8ce706a42907503ec40000000476bcafef193f7161eda073d6a278218f2668656e441361ca6ac2b3a0b9f23afd650d089455261a9a5a76222ebfc739bf749b2c76336943b9016cd45479d2950	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1916	1044	iexplore.exe	28
PID 1044 wrote to memory of 1916	1044	iexplore.exe	28
PID 1044 wrote to memory of 1916	1044	iexplore.exe	28
PID 1044 wrote to memory of 1916	1044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e487a02a9fc6bebb87fa52747792086f

SHA1
27b11641e80c9e4c8524f5a90fe3490abf141b13

SHA256
090a0ae7db5cf109b60420f9e9de025a40d279de087118770a5cc05936659074

SHA512
3d464f42a3a275a56c798903c304d40a77c0988ffb8c84216f48a6a74e2343969723908145d0a32f657942796708ed5a56917aec91dfd7bc085bb5642f308af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80ec1a918899be60080eefe35b5366e

SHA1
6dc0aed5dccb3c38e89989ed8a4e4c4ecdd25bc2

SHA256
ffc0d40c27f7695e2329ead777e034f9743ea54e66fa2e9c5cb463b235b4edf4

SHA512
d89c0875d9b88694525a62fc35e7e24b9dc233ef51031f37c87ef5fce812b82f3cbcd2ce264323b910d617cce83d1a04bfdb99a30735ca13f2ddbcf518c2bf49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1272207138e1d654a612a82750df25c

SHA1
c4b6cf73b47c60cf07779d4870f73db9588aaf76

SHA256
dfcd9c3f9fc6b25ac3d911b23ad9f8ea8b3493b954be5761f2f12757ad88d564

SHA512
51ba08bbc4fe59a62503051a815482f4e0656dd9330239cac9cdda935d5fc47a968007363deafac648d24eef6559532c90c1e9ebe9e0b32ff32d067a4dfd5f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6093f431e000166eb868adc498a69155

SHA1
d5a31d115573f0c4dd11387a708efe2de78e3854

SHA256
1aad8db5ddf1269da000db984d156931c8b6e60ee3d864db7f4484460bbfd3a6

SHA512
0f0f4c44a17e6f1c1b6824d13dc1574326c421df6894ed0912df6068959caf5ff5dca3631646242752bcae82c454ffcd331168df2b44f7143c3e2e5a1c4c2233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd7a0e8bd148f8780cd68c8b77521ae0

SHA1
72e2f8261f06432bbb984cdb91009f9d7a09bc0e

SHA256
120113e6aca379b07bbac33d88146c81fd5027af4c9ec760af8f027320a0251a

SHA512
1d37e64e023f933e8bf41e7df7e41f3bf61b2b23d0bf8540e1cc145dde8c4c422230289c26f824d9af5c18294de56c59d49457093714b001bec2841a23f8c465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ded5057e452f58f9e2f8d87d6f5296ae

SHA1
fb2f98e57b7ed0aa0920fe40fcf2ed4bde0349fc

SHA256
a72c125cc312a4013a5554c97a5348613ed34449295c11db31c0cd84d9da0062

SHA512
58c0d40888feb01515be84bf49505b5458e86cd63480b989d446886a1f735b4dcdd6e146857cf0fbd4e76933ea78a0126e0ada0a22869295df4d3ebe1c4fd556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5cc0120664fd85bedb8e026ee7ea01e

SHA1
48804ee302ccbbe6bfcf98cb9f1d808bd160d9d3

SHA256
9a021dfca2c9262b5aec47105c0e8456bba099699c8b3d1fe5147396f284e8a2

SHA512
b85691b3396d80912598daaae840180da437a76b6ea9a03fcbf73aee89915e733079bf8d333eb2c3fbf1160af63a4071205857cb89e8c88bcb25b784b6b665a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0b1dbcbfe4593f2ced0a2c5d724ad2c

SHA1
d237e5f7646d71478d100877eaec0403b9f137a0

SHA256
a927a230ae55990a396ae6d176725012eb1b1ea842151064a39fd34e4cb92f11

SHA512
814bcb2b7e64308186725e5e993ef037cd74d1a19b82d2aad9271dd46ff0c6beb04945a58254c8d49d5d2dcb07daf40448d522875e42ed15d1014a8af9657bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05938a3ba463be74550ed5ae3645a25f

SHA1
18d7e6fd8c1cd0a3e9005ac945affaf45a01db8b

SHA256
7e7dc6f6a7752f324a9334aafb2492de9c8160200451b93daa9a6e8b331231f9

SHA512
c50a199e971a9766bb08b491181ecc6bd5a25a4671b9190dc2d6f92e421add3c2388119505d18af77ee64dd5ded40cf3a6acfcffc0ce80760b49b2ab76fc3805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7af1d09631535ac5ce59d5821cf1bec

SHA1
5d246af66d3c269d39624b0669b81d5574bf70f0

SHA256
1530f8dc28741f615dcd076e7f434f7e401fe7e8f69f5460a13374fb7ed55bab

SHA512
97e4fc4ae50fb1ee809f80bdc3bb37a38c15f4169ae0b03551671d05ebc65b1775bc6c51a247e8097619461f05b340c2549ffb6e9b839b6da6758c883b09088f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc280179e7d68b76bb888e92470b72ee

SHA1
b8ad96091726cf4596744e2205d4a3ef60092086

SHA256
1f4bbc222e6273b2ad218189fea81b389512023c099f1c04145e701668559a15

SHA512
668bd4563150922969984ed6eec5873f363e743c65f5be2737680888708e307cdb0ac271717dfa44ae776e909e8e6030cdf3539dd297f5dfbc54ed362009e7b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a81ba745c1dc5af5a21287f12d2ac117

SHA1
1322a194bfc7060fffaeb62b814154e1a2f1d7ae

SHA256
d1f9f43be154866258289e33db6d5beae1f15486df02fb0784f1e0b794af7776

SHA512
bc39f5ea8962a04fe4fd3007439fd41bdcd0d118c9148f86941c379fcee585373c52c310e9867d2b827f80f33b2ed2c5d8ff06ec0a146328908419385c1549b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7150b48ffeb9d055d6b1ab6d9867dab

SHA1
31009c0b976c2634c327befd0625b8c584b558ac

SHA256
c171ca511a79adf4b71acaec7ddac6a1c981bbf47b442176929d4e7fd59bb2fc

SHA512
60d7bd73eadc7e8ce6e03185ebc2ef45f7a5ad4aa525c5f8f84a2ebcf90187dad41b444a044a3efc490db75096db4183e7725788a3fbe34126e6644f3972609e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a5834834706f02edbbd616bd60999f7

SHA1
0888ba9552e1d69a2a43ac518d655f153adc4b21

SHA256
2330bbd1b4ff61024b0290c1498ecf3f7ecd623da0b879e4c25340abe6cbdfad

SHA512
e1e5fe17c455a6ee1267d01a0522ed1a52b7d6ddf5725911850df84cc5104963e568e55e93774d66210cfc965c8623539c4080eef675b1092043ecdf55061766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9008cf398d8f48d959346ebedf99f8a8

SHA1
d8515b93cc76162822db591af6e7daafb2064db6

SHA256
cadab6ece27059f34b14fdb46a052495f8dbdbf2e57bebbccdbbe11131ed0787

SHA512
eb5a0292bff658713f57c370b24edc7da163d764ae94b7fe98b705e0e96f99fc080f46b15d133c37c0edc807815656df0c1f0fbe53589cdbdd6f8e8a8fd25730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2149.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2279.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit