9d0a49b44046a8ecf5c2f32bc1efa15354be3572ae09082366ea61c587689d6f

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ace3fe7741a35829ab2c9b10cf7e9521.html
Size

2KB
MD5

ace3fe7741a35829ab2c9b10cf7e9521
SHA1

2091acd394b0641a603392c8efcc83ca16a1210d
SHA256

9d0a49b44046a8ecf5c2f32bc1efa15354be3572ae09082366ea61c587689d6f
SHA512

d642b03c14c38668c5dc77cfaf3f8b9d4c3ce3cdc14263843bfd34b268594f82750f84632c0f31ce3e0b9e34d024db6493f089eb3e68fd2e89b4156194d72c5c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b16dd95b363b77408340c778ae709b04bc16d8d714ac4a4cc5787f396a8222ef000000000e8000000002000020000000e62c7def3d0b1ddca00f5c66359073fb396cae068c6c57d8ce6c175b7fcd9024900000002d654fcb3764c1910cc27164ee19ebda04bb3d387583f31bfbf37674b883fde2b3a32f86929407d51858c334c932a38f3d82cf57c1642c0256880c67eaa8d0ee355822d5699a2586ed5ca507172ecbdd6766eba174cde346ac9880827bbe8a945daeb106b6d21a3c309369d648324751f1c83fc2e2fed330536eca02a66f7c9fe9e7d211e6bf16b4349f9cba0c6860a34000000065001797d6e6fb2d5d433efa84750bbdabc6b237bfec713309ba9f279ec16193eb72c786779e708a5cabfb3bb8a21bd2eb019c9d6c5a0833db98746154e80d28	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f42eb58c6ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c9db018bc9d1de3722eb3080c3c184e5b69c1ab4ac210193e676ea9172388a1e000000000e80000000020000200000006d799f76b835e37b2a3232d91d69e87ac64d253da2fd061e7ff05fa72410669a20000000bc17f8721f71099d47b8d5471181da2b4edcaa8be8dd0413080abc9ddca7473e40000000a4063d7179098bca7894ce6514ba76a442a02a8bdbed9eaba68df9b7d422b0f8189476ba44ae92c246ecbf760475c1631188d8aba3140f327b40f1627b276849	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415317390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFF8D791-D67F-11EE-AFF6-E61A8C993A67} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28
PID 2696 wrote to memory of 2136	2696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ace3fe7741a35829ab2c9b10cf7e9521.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
109912c56aa0dd8df444bbb43ebc48e7

SHA1
097cf159bb55f7fd861fa94c05bcec894aa43446

SHA256
f5a0377163fae5780066e2143d142d2d6f08c8778fe5ffa222f1cbb9e62c8a7b

SHA512
02956b8876d8de4f12192cbc23b2c9a7d573b13ec62a3125a426b2a7efdb55344dd3f1e35f2051780b5c8001051d72b45d56e230eb09398b8311664c9a7b383a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfff6ffdb82cb5c9ef8f145eb164947b

SHA1
9b98e9c04c7c3f89ffab8723095780db49eacd22

SHA256
b18bae9f11bb025130a1bcc02896d1b733a6974de20b4cd2487b570e457c68c6

SHA512
42541907b23d5a05f0cdd654ef82ca8a7cbad9df9d847883600ce59a6f0b9301788a8be59664d5c7414158950958656583397c88c9591ca193d399b7e0046b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366cd295c92c310f9ba14b87299e14be

SHA1
6f87ab838f9e78dc356e13a8e8711c777c5f749a

SHA256
90346fdc7bd405493b6caa2e6d4f6d351a46f945bddf8c28dd954ba451be71a8

SHA512
e44a1ef3c1f03c007fa0d6ec5aef628c4287497bd28bf9175e6357a10252e21a3e1ac0218b1a7c76f55bf4610c77324ebd64df46a26c219830c31ab6930be3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0acc609f460214301369dfb3921a2899

SHA1
0a847694033f6a89b0377237a82abf19a18c9353

SHA256
81aa9e10412c15d213f23ad296986c84777b6ac8a28149ee61a48e949b650b54

SHA512
fef69c840a4e0b49d879ed89169820657309261efcb50e7b4a5bddb6ce3dc5cacd6b3f5be222126935a421946ddd85aa331b7be598f9db5e5622c1aadbb0ac3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b30e4d7b7e234a2cf0cf553109f4882

SHA1
8b43581903634faf3a940ad9c44de9a5d085c4f3

SHA256
e1273bb7827fdf2b5cd0ab76aa8dd8340f7601306acbc8c5c42e9db47b9f9908

SHA512
3bc3115f99f854dc05a78697b811b11e020d27ce6008134804553d252fedf0ebefd1635d2ef933d33a5a724594baf63b3a4e14e59de5030f29b639bd88ce5b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d13686aa90c83aacdd24f1a3d77a3e67

SHA1
3b7b00043f5368ee9d4b2b9f09a4f65f25ebc60f

SHA256
081feaee9b76d12aa0c71bc7251140e00fa199d0284a1ac91b22530a37b50705

SHA512
a3fb10cbb6c673f4054ff159a5836a3d31529e435629e85d6e89522913ade18a9d94b67a16f07f45779874f0cf268b87acbe6635dd144357c6a9faac0e75fc88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d6181436764d71ccc8b36c3aae5421

SHA1
9c38904da1bfb3af4682cb7f10c60f065479c1c0

SHA256
d0b1aa10b02a73e90b46d3026bd72fca989ac5d405902dc647cb53accdefb4c7

SHA512
47cfbeefce5daf2527437c005678535b128e9f95dd20c7228562d87684bd89146e96770013fcdf9827d7f137854147c3aad2e342d1ffd3c7663bc3675c5b4970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
742674bb5ff7efe5e5a3a648cc9c66f5

SHA1
13692a09531e9051f7c29dfe531e52eab5622280

SHA256
fcfe66d43af9428f3b00ce39089ccb46c89f8020c09c4b62cbfa96c53ea5fb49

SHA512
9dd722c0ad1ddfb6258798271c613025dc69bb3a3dd55d58e9b762d908f6c5aaa662820d6af886abc2cbbf653cb58a0fdd6facd9d595923fd01b9b346772e763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2cf92a205196f9c74e4196f62af028c

SHA1
1ce24b9f09bc7fcd1a32223e08a1c776f4e8d187

SHA256
cec020b4bd6ab27c443c4d77f4af439044f528d88af9a15e2770789e24a75793

SHA512
cf9397d1af7d3fdebf38972ba3d99f68c80f76c3ca83931e76d9d7996f37cde0424a8b64719568a62eaf9d67d66622af3596827a14e2ca2374c0f988aa575c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
470c937ce19bfc1c8f7ff4ebdaf6cbef

SHA1
7e6f08aa286d5082d995b4006aae213e691ff666

SHA256
81409c6d17b11a8581cecdc038c120ed53f0b288e301061292e331d7f6aa734f

SHA512
3819eefacd296bac5e0586ef0cc13b104b061edd78b9e005583ed3fa29a67ce956e1c7f300672206b5988c0f40cbf8163538d98f0786704b338c74d855cda3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0957f1aaeae296732ab3a9d5123e0899

SHA1
7a4705ee626678ecc3981452b82e425cf164825e

SHA256
28b4bd708f281590eb22aceca66903e315eae993f1d45a17d199cc4a8d2e9499

SHA512
9647998c904219f246dbc32c74da323f264c5e0f59e4d79bacea32f3219bfd455f94394b255a5ac8380c09d78999af774fd4d147167f0efca6d4dd985ebe1d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a300ed6acee198a9920fc305b5c7982d

SHA1
cc5c35b83900e6bd1c36c53d0a06efa866195fe5

SHA256
43c36c88eafb3bc60f9ed93d41a257835c2546579cb75520600227f514d82364

SHA512
271656210fdf6ab4b7de98b82c6db1510df333539c5d61f4397e37640ee276f0e431f29a86ae59cf518e2408e591abd2a10f02fd5d8d839c98f077db6d2cc838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c2a125b558a3f7f6f9766293705624

SHA1
fdb2845396706ec4d5bc171c378a9d4d7d10c91a

SHA256
cf9430a76d3f4defa980b09ec4ca435a08ceac6b7bb771c952401f51b4b96080

SHA512
737e967f082e7d1ee09fd358d8cba95fefaa248d03e45c386c5604eea5faa068c87c4931d2859cd13dbb8ee55ad391d63a2fd664992d8657abb32d74b3e14c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98d2042f7a2855af3c63ec3b5c42e13

SHA1
9aad0bfd3b340d9152f863b51c75414ac201134a

SHA256
6bd69b3f311753b12f31765d935a5f1aa1eda877ddb743972a336f6dccefde53

SHA512
373c04e2d28b2cafe7255b960b6c32c3377145ed5b70b647aae5cd23d6d95a189dff592032590068b8fac2f2f1a830b24f4248547134f2cb3939475d422cceba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9847c03c9d6bd2040716d2cdbc099d84

SHA1
90603a281ebbf4f39b3ac0c7dd16f9dd8b7b51bb

SHA256
b5d464e4f218a3fe0441efa824b3fade41a72a371f853dff4d4becc74b868b24

SHA512
da98c1a058c51acb5d4ae18bb61fa678ce8fa861b0f4c77095ad2fd4917ff4fa77f8ae7f3ac89a5986273928c09aa12c6da4a856dc942162e7ba1b342f5584d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f8ec2dc15b150a0f1bc0c3570102b6

SHA1
356c1043bdf849c1a2d7792f61caa2db163329fc

SHA256
28dd03f12199a7713bcd464bbe9f313df74e09609f6d3fd24e6add306f1b0c30

SHA512
d939a1326345291973af4f1aecd50c94395ebeb604cfcbdb44c818ba76c336bb34a1ad1f8419e5dfe3967abf0d3b131eb6d3b8a197a8787f4e8bba99c676b988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ff46cb6fdb61b36a84338ff9dfbb74

SHA1
ace1967d0bead5d846333e02124ad0853b2d2e2a

SHA256
b6a0e8b3ec53dae83e9ec8dd24b7f5dbd37b07ddd24290e3e3a3f18631783370

SHA512
8e74a75b586db11b24a67e3597086a6ca7cbedeaafde3327b9982dc77151b93cce06e846434f6cde52c2604e611bc6ae3f4e58eb73280cdf69199645143c0559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9975.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A90.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AD3.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit