ddeef45b4276da261883e1213f5d0ddcef350b16326a25dd3da9c731d96a5ca6

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adb157ceb4109c27c21e9c402aec1a5d.html
Size

11KB
MD5

adb157ceb4109c27c21e9c402aec1a5d
SHA1

453f3fa86f4df407765c6e9fb9d1677b809c7f5b
SHA256

ddeef45b4276da261883e1213f5d0ddcef350b16326a25dd3da9c731d96a5ca6
SHA512

6eda6e590c6204f42ba949e64e3e00dfe82df7b094f56d4d8fff32ea6db52f53b724ff7856daf039a02fca7ac68584a8e39f184114bf30e87768c5386c7ebe62
SSDEEP

192:2ValIsr0r57MdxmT8H/w1wvqa1bAuBuLbdU8d:salIcIQdxX/ggbAguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{351253B1-D6BB-11EE-995F-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415342871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2128	2292	iexplore.exe	2
PID 2292 wrote to memory of 2128	2292	iexplore.exe	2
PID 2292 wrote to memory of 2128	2292	iexplore.exe	2
PID 2292 wrote to memory of 2128	2292	iexplore.exe	2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adb157ceb4109c27c21e9c402aec1a5d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31298c1fabda5f35d394deac6dc4d3f3

SHA1
e97f9e5ec316b60288fcb9522bde6131ded17dc6

SHA256
76e669f975a6afc3742cb2da03a4fdc03efaa956c39fffce9582f65d6b47eff3

SHA512
98575ed8c59d857c2ef3f987f9334cea0a8890cafb24a9a0d03b93aef60ed307a0cc22445c4dd1527639a6ed15190ced42e832f335ac3b35945e1218aaf5caed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa1ec69673182f339116d072c1150f66

SHA1
faee91bbff554e27674005db431880a473c9fcfc

SHA256
52493ebe7cffd8d4417e68d75c001dec847f50cf7916dfeadd2585c2a37b26fb

SHA512
b950952b5c9ada31542c7186bd52845e819f1340f6ecc957c84cc23037356d887723eaa874fac5dfc36e391056851ed77d8503984db5c764e15aa786bcc943b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68933664135782498219f017d7098f2

SHA1
a5872ac9b110bc0dbee8e5b13d5684104d32ef40

SHA256
3c3c74a950cd23421ac39094c40d1c907352fd9c9ce75c1ec430a702e6f18328

SHA512
5aefaa37aa8eac75debd93e5d5e2bd53bae409f4b269e135b7d84492189d47adb224dbd9a916f00afb0ab2e7fc48641628436a75af8c8f7ae52ac5be1e7e66a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8995ec1d7fe6b84d0df90ac1d37cfe5

SHA1
d968c8baa4a0d46e96faecc31bf0ca1b158d9370

SHA256
72eeb438645219b79e8555ed6fe7b5e1681a214ecc04bd6675e0c12b054411e3

SHA512
553084c4c4e42085eca550ca5fe02195cd7d1385139b2e80f93c2f7174ed8e9c2beaae7975ea0a97928219f3ff738ce9b7d717c28aff281e04592e4a2e1224b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
496d209e1465f3c545bd78c29c732846

SHA1
42fd80078e8423ee45d4c6410e54b949bbdfde20

SHA256
150e8cc1335a8daca336fb4d0ac5c9d2ad4be3c0ffcd5a93ca5fdc85c49b0072

SHA512
8a7147c32f5c17cd35a8969656e6fd248a8b85bdf5315ecc17e3d824f0cee2f9a4ee496e9bef0bfee02389b26d59e02f3f9b110b6dbd1fbf1a3dd91f9eed4700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebbe64ee6943f110cd6e9a39cd76459c

SHA1
98389b6275da88b86de01e434ca38e6b4a4a1ed9

SHA256
a6f540a27f0f2200bdd2e9a90074ca54f61eb057b1038599215cfb1662d6b995

SHA512
9dbc4d5e6c997c53884372f0e3cbf25739909b56ea7b242107f0382e2dfe245052e54101d5f5a209da219c893050f29bf03c209bf2a2587b23156650746632cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc7bdff9d27747bc7694644c482b2d7

SHA1
e2c92dba5ff96349c947c203eae28410de7d0fea

SHA256
39324d3ae373107eda7abe070802c4ea977ffafeeba178a650211af521465216

SHA512
bc797a69b87a756ea30e6b344b4facd7e5df1d3478e67c87bc995783bf8d767e61cbdad97b28ad88f14158cc50a56666ec1f2d4a03bf9490abeda99b58b20a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fffa9985a8ac80045c833f065db4b502

SHA1
c460a5a4f14f7c6f41d65fae6de4b3f07b42236e

SHA256
6b7b8b1b68d6afef4dd810e9f9b90cad3a9be49776dacde348ef7bcb0f68d0ee

SHA512
f6ff8422497b23671007460a0dbe76a9a5340ea381ac1409ea64f3b70b1172bdb97ee057dd73046a239de381dcea9804108d5c32719a2364d4143c7bda202edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2998f5d630dc8c4c1174b22650ede39

SHA1
31d455e16603a36f8ea7edd197ab4dfc24b199c4

SHA256
3cd9d900b221927fd0eb21631194fb99adeaf87df47c496853bd5c62604a8513

SHA512
8cbaf634b7a2144cf23aee3489f7ec18bb8c98fe856bc65601c420e97ebe48463e272d59efd5fd6153f13ef2323d874edb41f1eb8d050d57cce5f80def0ae060

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab168D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17AF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit