f0de2461e526ac34b0c2d0efb984ce0bdcfe2d27233c21c749d4f68d0a5bf651

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4406df12f2c500a867fd26abdba5239.html
Size

979B
MD5

b4406df12f2c500a867fd26abdba5239
SHA1

2d747e2f3968af94587d688f1f032269c84a902e
SHA256

f0de2461e526ac34b0c2d0efb984ce0bdcfe2d27233c21c749d4f68d0a5bf651
SHA512

de81aa9ac541084384c29404e7c25012651d41637bbc60b8b712526296e487738c675004760c371741994ff278224f0b6f21c847b0983e52a0f599937025fd77

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008fc985bab2f43d16d289b1c87866922d7d5d7f37ff2fe375a52a576dbd24d6a0000000000e8000000002000020000000fcf7974f278dadac4bbff7325543a5152c891772f3c5d0d1ac6b3f4e115a719d90000000a15336996e6b2da7610c3b8c55ecb9521b31272ae06329ada47393c2202a86cc8e79c26f7274f23c6e7bd90436e51ee95a772202da7d6fc276ea092388bcf2f2a1938d63f1fc5cdca7e79618cfe809f1cf7796a9aac71434472d45f1d6110c32f44b25c934f1e68a0bd4ba883e86d110cf6926aba0248ba44039f81b78220f71110fe33fa48360fda6a7283aa297399640000000ae0129d8471127521a8eecb83981089afb4c21c0b1298b2c8be4f937536c05445a590d0b39da2074b5c46b3c7e2df6961357395ef4c3a826b3ff5e20414e09d1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415789074"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000fa3dad755159147866564f6c7bf898af29c62f26c0f208b3e83517a66a1ed43d000000000e8000000002000020000000ab4487d9a4871764e095fa467e50e9381838aaf09f1f8c21164599bce0aac0cb20000000982d102b81977c03d63692a0352c8d034696afb7b001cafc3bfcdc0878385d7a40000000213d9ad2ebdea31a784212afd068a106e2a1ac2ab883e0e0b90ad00e17891fba3b69e78ffb2bfd4444bda5191ec671079434ae454c1b6d65031d808a64d5956d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1902A9F1-DACA-11EE-9BF8-4A0EF18FE26D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606bd7efd66eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4406df12f2c500a867fd26abdba5239.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33615adb8a4a4e65ca7626421cbc4c49

SHA1
efc6b5a760a1b3cf5067e814d2d749c136ce7d3f

SHA256
c5cb88915fced6ad7bd8f70e092342095a511ff6646b2cfb0a995eb5ef037c7a

SHA512
e7f5676b7441bef57196969ea3791a334396b58b3e469a400b0945cd6bf78520186bb778092946131067e0cb1707bbb1ac7844eed5e0c991e0f2faa42823fe6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3150241d905009e44cc73735f4ff46

SHA1
f8a5d0faa29e966d04b63f0b86fcc67b09c78dc7

SHA256
677e32475b5570e66638a8de2aff1e8f958d36201aed78d3dcc778a4c5272392

SHA512
18ed8d69167f073c37b38ea3755a7cf78ae5aa15cdade36d83abdef7e96e2caebd40fcbe2e3b864d23adfb0c74d4d7d99776e7f572bc1b52c918f5825171b5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d03ee0334f9b8cc515f057a27fc4f9d

SHA1
773f08d64e552ffc84fde0c536ee4ff81e6d76fd

SHA256
04fed06cda2c0f42762e410291ebbc0a4722c3e4785f75af41a9aabb6a49fa67

SHA512
efba0e3a2c0a521d605232c504ad5ab8ed6e16f6096fc33a807afa98196607872bd32c4b0c474cf7359a863ba3d11a16d234131030d8d19b114287c4715dc1a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edbf264d3cf714bcd570af7c55d6b005

SHA1
bfd2f7b1ccbdc9ceac0e64f955a81fca534912a3

SHA256
097d2d6696c74b5618cb3c1b73121a2cbec39b7a9e674e674f7c96bf8fcc9ffc

SHA512
7165b4e7913630b480b1f2bbfd58186208f82a778db703090114fb38eca5643fa991314b27ef9d1278a8f2e3f5fd9944ff7626cbbec4510f534d83469b400d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
969ae0770dcc9a2280395ba459d6fa31

SHA1
42d24f1ef42906528b233cbdfcc01a517000ffa0

SHA256
4d9149119d3c3392fe8eee66de58576a18d9d504b9cc3532516d5b4ae3d6a511

SHA512
54052ae02a9953a23ac920cff2e0b04d9e6bf737c681dd15c4ac4b0eb56529d67c256f0d4bcd11e1f0ed1d5a5f037475c7293873bddd51ce33d54893842a84bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ff126bde7dbee47a93109bf6072e6f7

SHA1
1765baac8a0f2c82169fc6ac498e636f3bb022b0

SHA256
5925ed80e21059a0110b942ac43bb31867d30762f57a1c7f069abe5dc53158e4

SHA512
9c4c3dd7abe276e67f478ed306dae2aafc8f32206418e9c8d3a8722d3f44faa9c6055806e93e23bc15db3dc48a1acdc46566b5b0fe5659a5bac9c1a8c69aa25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f658d13ea7c3781ec68fc298ff2da88

SHA1
42f86f256826503b9bea497dde931476d5bea221

SHA256
db44e0226e49f4582c376e5552be07c16ccb3a8d39ffd563552d828055c40ecf

SHA512
480d2d3d05404e41d8add51d31df27fd492ca5532e38c471a3a56acc91892cdbec93a8a62966984f92d602d79b7d9406d2cabf4fd8be9b330f2ff0a0438750b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1c3da345418c7e28887b62689f4a7ed

SHA1
a63148a7d68c8c67971baa015d8790afa14db591

SHA256
e191a4c32054c202bc2ca12bfade81b8f55f7c538de9ad07294121c26a013b5e

SHA512
1af4ef71f95ff0e0d8b4eeff8cbb38035d73351f5d8f3ae1f0721df349bf1d6b103766f57bb4961a75f8c5b6b9274e4c446326ef0e0ef32a7692c8bd22259c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00bc7718869fcd60ccce3071c44ab5c7

SHA1
da301369a52a87f5949a0f5d52c9ded1bd3741d3

SHA256
ed7a782ccc3885c07140f7922f8af278d6f9ffe456b885785647f57a54e61674

SHA512
bef48cc990100d751e138472944463016d396b4f9c0c34f639ca134ef5e956b1efcfc31bce6b5e62882b1cb4f9c98f2149306bed27be753b3cb5fcc9be28d3f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c94be045bbacd0774ecee1ebd5795e5f

SHA1
69f704766c813c98b10f5cd10a6571404ab3f17f

SHA256
0e6e0ed2065d595498e5ca9e665f0f5748c7a6a5ae4b2753263bd725dfbf72ee

SHA512
b54936e8db9a4e87fce206586b025ceaff1d92cd912beae846a636b441fcebea8baf2b18d5dfb4814c6a9e150906ce02b3e6d1a1aa1521e770031e338b030da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d519e5d9b560824015b9d0b4cd76974

SHA1
12f9af8c905525a0f21048708ba99304168ce1c3

SHA256
109f7b1b039e739ca97de9fdb20792c2cb60790371359910985aa57c45c4fc3d

SHA512
9e8ebc6464acfa7460511e85604dcc87f0040aa15622dd41980aec577d07bf7de6fc9f31a38abf3c47707f84df6cbbeb4ccac7096c81d5204c40efda673f5d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd693427a7c82f377b3317bcf23c8c09

SHA1
2556ed119f9505b37257b65863de4abe0cade213

SHA256
180eccb601399c9177b34ebfc84869447f64575b2a0830fbeb89e9e9f57e4af2

SHA512
2b54316987c4e629ceefdc5e7aae37c0319796ed0eb0ac8324e6158432f06567e2c37ed0a2c4afff5972282a41528ae45a40034c1a37588b7780c0a29464a919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9a57cd878785620b5fde02a73de5b1b

SHA1
3445e60c0f472175eec3e0508ea7da58c61d6250

SHA256
8610b3cbc55a48c6982015b00438476ae0dbca15ed4844409a2823ea6d941394

SHA512
60e1073a11ced131413605263da6c3c9043f942a482d6f738c134634ae8815b6646552ef8c60766fdab82fb6e3afc7905a66f8db383c8c47ff7039ce6d186454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7467914da7904fbcdf8882f694e1645

SHA1
a9157411193fcb26f5e50e9ae7fe4ad6491096e4

SHA256
0a087bea0d53f497b23cc6bc529c6f877c6b932106da920365841473c146c19a

SHA512
bad0d915763c5eda80be6c5e0763fcf3abed6ed84b202b1b305656e9cb407779ac35620b0e63d7011465c71f31e9d49c818cee3604558a3af667626af58de547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9461ff4a284eefd6225b568a3c2404b

SHA1
aff5c2f887c1746156ebb5c460afbd1255e45144

SHA256
02ea798a5699323380817b3755f7c608e7118af17c7f1c0170aaeac08f4f9cf8

SHA512
b3bc418459faf1e80655159eb7430805668dbbec88f2b635643c7d79c54cb63050b8b0360b15b297e480e48d8696b4c05b4cf5c34ec0d83f165c248fdc024a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae8fd15cca6a3468745a14bb0608aa43

SHA1
216bef1d1555999eeca8da45ba7dfe61a10bf498

SHA256
53fa3163e0d652f9cdf212b6c521a0707f310b5ee7ad72c5d5521a81d614e941

SHA512
c47533301d503f158b03ed07e757300e5383517d7c3f54eefd707cd6822dcf6182584eef2d7e3bb28e8eee15cbdbe9fd13165c88a47774cc16a46bef87189897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14D1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit