e23e1878d6c2a191bba4012aa30706028b511d166266e9b0efbf0a3eafcd3596

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b421b2411726135ce0200d4bb5faf981.html
Size

201KB
MD5

b421b2411726135ce0200d4bb5faf981
SHA1

7ef96e8bd831c0223a8d5b934be3b6f729fa81d1
SHA256

e23e1878d6c2a191bba4012aa30706028b511d166266e9b0efbf0a3eafcd3596
SHA512

10c65514a9cee0c6bd079739364ae4db931af7690e92632ad4dbe2038e8fffb76c74a2e1f8e52dfc7b0d2f9aec89fc44bfd6322f711c9eef689bd52ba1ad2eba
SSDEEP

3072:QluF+mnERc5vczabd2RULBw2tncNQ1X3TsFy0LAfJ3mjyX82s50:QluF3ERc5vczabd6WX86

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002a2340b5ed0591146aa6c7e72340c3e6e2a06a377c9c100bc2757fc576223f50000000000e8000000002000020000000e0de96f9392712417a98d62129445c87846b22a1d310306b4111e1b99d2b44eb900000003ab2b09ca4f3a3ce174ebb8497e61c2b60b6171d4db447ce16422fae90dcb56751c4445eff7fdbd0ee4ea611f4561e41030d4122bbf1a54d62e5e2fafdf8c622ff66edea9f7de5bad145fcbdddf3785c2ea7b13ff8eb719da746a1f95654d95faa502094f5afd8c316e7a8afd8c9fd982aba860790df66fa9648ed3a92df1561dd23460b001aa280572763858d607340400000003c802b6d0fbfc57c338115162cc48abf7236b0aff63106b0bd52e896d60854c4c3e05d17bcb9634108818ee1b2f6a01c016a5c037fd68153c19fc62829e576f4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415785389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2071dd5ece6eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000019a53e3be6a3235edbfc453a7e569fdde3fbbd825ad478d1d6529e84d5d257a8000000000e8000000002000020000000b8f036d8b884f6cd421d5803532b7e75a49fed27f8b912874d59bce327f3c46a200000000d77c1794c4058ced4b2275441598894fdf2949245638fd3ff85359c13c4d31c40000000719bda1f9fb765d81214950fc190508611e45c810189031c393474785800e4a1a6e1364b59122377d8d50710f9f4881f66f6844df7898f381b1db359f942d507	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{846FF891-DAC1-11EE-B671-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28
PID 2460 wrote to memory of 2984	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b421b2411726135ce0200d4bb5faf981.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
79db4a12063df1d403661b67c398c5ec

SHA1
742ba0d348d3ae4afd37074113526c89eddc36cc

SHA256
22fd64705c77b2e1b1745fcd7440c7527469414859f206023c2271e791b7b620

SHA512
6beada843c52e16e3a2d748ccb922fd50833cdc782363ed657141562e64e8493a925d932c6113c166f55e81e82cf34bb755183fc000a4152fb260b829ad194a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1bbc8e037374bb7e921c209c86d5cb6b

SHA1
5ea37b2b0a7be623d692b49bab67a16b5295bc35

SHA256
e5947f332e038409ee207e47e2c426a34e80c4da8658e51a05a3ccf26fd2c0eb

SHA512
666f1b715beadb030a6be1000ba6446a049ba8e52b363ebbf33ef296c656b4137314c472e679b563dca6c61469f67036570dba64d190d1aceb8f288a6b0bfcbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
480cad2ae8f41bd4794e58da20ef7433

SHA1
b98211bb317f61fd90155757d8df94d37bc0dad3

SHA256
3d3ae0675e9097ae463318d4c0fab99bca7fc47dd9e5e0d7e4920a65af17cbed

SHA512
88b5b5a5719dbd5bfea2f29023fa2d1d45898461118e843b8195c6f50b1fc5015c14efab678ae4845c21e897b842cb55a40a68d7d6a060c6db8d51991f742844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
267a99f8b3063fb1cf5aa017dc40f956

SHA1
638a064228caf88870bb15e871250ea8303975be

SHA256
9962d78a39162e59f11fb7fecf3ca75ef5b8c2d1d48c573e313ab72e77e5d10d

SHA512
d05b735c1559f5539c1e97b323cd1ed42c19ea966a65823ae96c3d46b88f90c57e67ee6ba8f30374a3f33e138df72cff495d2a6264246983b23bfcf3e44f4abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09f95b2dffb2b84a1c14a298e470a7ac

SHA1
d3705c3d3095113da8cc769a9f25e71f80622857

SHA256
e8882b5993e253b56477753e8e68807ffe09c5e9a44952b1df46e67f1fb9305f

SHA512
ce163c7d6151f38067bbfc4e14b8cf3ab268fe3a7d8e21a0ed138c01ec8ac60e45b33c5715638b24017f8a695114dc9734d485b8a144f15868353b138c3165f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72046ad2deed742c69ec29a6b7ffa36d

SHA1
90cfc81114672118f10dcad12f4ad6cea957ca0d

SHA256
b8b9f1201fe23e9b88df44cc1b54392e8c9bbad0c06aa351fa788b19063ba9bb

SHA512
54b06f628c945d46731d09ff8e1deac9318cba5b803f85ad503f4603bf2ef4c0bdb4af04f9268f77fe1c3a0d021c18cb212c9ac7eaa3d350e87686e3222991a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
538d1a45e49d0e28f4fba94791907c50

SHA1
54cb4d97dfa7f747fde770e8cd8714e4350753cd

SHA256
c0a476532f5c71375dff9bf652f43a99b6b7cd289bbcbb19778949adf8f3f61c

SHA512
e925d77c3424df1ceafa29583bd15783ccc550b6919a39ab23bad02114c54f55f2a820ee7a8475c7aa379db119b64e5ad837be1c8f1633628ebff9196b328b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3565616af028ad4110e1fd514b0f39e0

SHA1
7ba2ca16197d83d35f21dfad631bc76e66ad80f1

SHA256
b9d8db72616dc80c63972dceee19eb94e5dfc4a68d24603220c98d8ae4a55172

SHA512
2cf1fbefedd4db9f5df085de0d89907b17a4800f56e1e7df90273011d694a6504545f7765a4ed10bc86d1813ddc1889e1f9a1a946151804fa36d2c28c0f63720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c3c26d64b7141de76f3adb7c2cf25f5

SHA1
c4daba3aa4963e57dd49ca7bfdef7b7545423d34

SHA256
049a5102632c84924a68449ca755684bebe0ae3787fdda5eab277596819e233c

SHA512
edbf35a871e3b9f5d0f376bbf7cc1ae47dc850bdf87a22ed65523fe79af51ea19332f73c2d8ba155c88df8a25355369d662e93133f7288f65a77ad3e083b016b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
081f2d1608cc341d4e49a47674626ec4

SHA1
ee15ea7680f19227fa004a34bc486ed05c4e4608

SHA256
60d7a3979cbe2c4474a22846d4cd66440270498cb6f5913e7abba1af1516992d

SHA512
8e9c74ca4f2b41ed7968bf6aec799be26c039e78d15096cdb0c9b983487b96cd129c86ef265d3c7ea6cd8a6a2b8bc6d2b7f6b943359493191ed359fdca5efa75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
732a86caf2f4914b2c83375e66353767

SHA1
c8ad1da9fef414a64a6f74d07c67d14fc28a3927

SHA256
ae123c2859f795977180d5dac7d9ba391e1c90bc591785db235cdfcc9274194b

SHA512
c116de62ef9f59474585ac05951d4291e880f2d22c48f826c062d1286fcdc8288a081645ab063fbda30f0cd127214369df2a0ab185afb00ba3e0a9462f7d33cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\platform[1].js

Filesize
56KB

MD5
22bb0bee85abdb9d4a065962582936fc

SHA1
01ba1a8588197194c93a4673c472ff4a804bcc9c

SHA256
e23a7507aebfd7528cc99957bbaa4a9917de241a5559fa73ed0ed51e424aebff

SHA512
7a630871713814aca7f1ee133b99677eeca76a40541477fbce8bce4e17c6202ed4319d880eaae1f8c88cebef664a4e191825d056597ddc6471521f32103d3cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\cb=gapi[1].js

Filesize
133KB

MD5
c8be3350843695958a33474aeb3ea8f1

SHA1
ad92694d9b189ee479c1be438636e39247b216af

SHA256
22494eb4f5fc2ef8c229b9df2e171990687e4837282655145cca0fa302af1278

SHA512
54ba5d4076fe9fe4c4ac22f45cd7d2ebb4e8027d8b8f82580436dccbcd60fa2adbb948ff1234d9912c663bf1fb33ac834007850f5a3f2abfb96a7a4feb110bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9520.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2BE.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit