bdf5a220fc31112d2e1948d81a1f6d0b4c90cc8b48db293e2ca2761840f93696

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a5d0ccda646647bd94bbaecd5d1d59.html
Size

2KB
MD5

b4a5d0ccda646647bd94bbaecd5d1d59
SHA1

f80fd6adfa12dcc73f2a01598ac5bde320bcf04d
SHA256

bdf5a220fc31112d2e1948d81a1f6d0b4c90cc8b48db293e2ca2761840f93696
SHA512

82234c5af1e467f9ca94783410a30762ef91bdf632d499d26520d328fbb2700a7c1d58b6433e881ac9d81d12fffb4f940ca6a215132805a7b1c89a7247f88190

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c0ebdb15f095919d86d825c99222c07e8bdfc300f046cc3f5429b63d1574bffc000000000e80000000020000200000007fd5710abcda42accf1eec6523960c979df7264a55eba30e923028fdc519256820000000389aad4878ce3ab5565ef8c63240ec4871209b89638d13c07f7ceea616986730400000009c815dc2a03a55fdd2961320935a43d7568653743513e9370ca89c196ab6f35c88e9a5f580dfe1bd8c7135f092ee28f1e26b34e46205745c6be9031cb3b5cc3e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ef6d23e74971272aad4d4839744ff3768c14852c20366c982f8ff23e9775cdaf000000000e80000000020000200000008ab773d98c83e4132f063fc81e97cd0667970eb44927aee4d3caf304208513f890000000a979b60c1e9a9874b3ee0a52f1c3b3d5fdf0e92193a64965edf7fee72eda9bd118e140eeb88b2c8333b9428f6a9f69d9a781d6746013a4ab678c45ed3472a38c5f699f41061647b1bb29b440627512f2288672f5aa52c30d6fbbac6c60e474d88934704f23a2cdd22299c698001bbe1020aeb1d5c563b813c8c9bc3d64c2bc5b1e2cd6bd4ff81a471602c280ebbbd90440000000819515018d984f9d766c7eaf74eaf96d670a98fdf4e0420d11a6018de727318952c73442fed39c5091fd8aa10f3917c52a7edae5315e3053253b862f8d635965	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02bbdc7f46eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2EA8B71-DAE7-11EE-92B8-52226696DE45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415801893"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4a5d0ccda646647bd94bbaecd5d1d59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac15be95fc864a38e1a2e3659179d32

SHA1
66c3f560d04251e06d80f6c00c227c95c4d38abe

SHA256
2a27e7f54ab3c52f17b63fef49a7f6f9d44955f926c237320e0b802138712dae

SHA512
7d9d04ffd07e523fe7e833b430637975c204fc74d2de2da12985efd8b3c41d0784ca56a594045b9db7a5bbd87701c2d0ce97af07b1b774078b28e2618573de6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0961d549fd2154919a0a8b47adfb9f3d

SHA1
e34b4ed002377c77bf0a917debb35c028b57306f

SHA256
cbb88b38cb71797d27c59ad419f7411aefb48d004a474791350b34d47798f6c2

SHA512
e65328f20cd617f43f03351aaa2dbf65a74d0f5881a6984417416bfbde7f64c50954f95b02fa9732c0ba3cd8f69f9716cce5c2160b75d4ad850faef596d63294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4cc20397e76ab6922a7ab48d3a62627

SHA1
d92eacf727d156f08e00f1a6ad82a33347cdf1fb

SHA256
432228e2f285e61b0c0caad0c74aee3bd89271e210534a92df40db8a9a43187f

SHA512
5a792e1ac82d77a1a7eb6358e0e6b6fbfc2662ecdcae15da53e3fb04f9ad71f0cfcfa115b1e1c5180d80bd69260a99963affe5fec1af6cda42f615ad4acb0a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67c859b6022be10d7cfdd6b528c8acf

SHA1
dfca271f90f563ac80149096066e304aa4e264bd

SHA256
9647302a5248ecfb64b1b66e37222adccfe42781043ca2793f509a3e801f1fc0

SHA512
01942fcee16ee5c5f4de24e1556346eeb2a635e4d320b832001b69f9608f89ae7fa716846d9f836d25e53a41356f6ea37fd086fbe87a865ae78c55c6d8caf149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38a40cd6794017c2f968e34fbcf9e08

SHA1
e1790cb1212c66011939ef906e6d6c0fdcd96d72

SHA256
99bd48f341c52ea92a100447017a39ecebaadf5265ca2b4950e1f955aed1b9c3

SHA512
e076980a3898d87c0352d30f60e4da88b83acd9709c490c1389508ec9fd71d74bb6e68fdc35395f78fab3ab35cbbcce20a825817174483782f64f6cffac587d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1ed5f5dc34d8422661914f34958598

SHA1
4b9bed490631cd7e6ef3e544fd4cc3de82cd386d

SHA256
109e22e6407fa7483c484aba2b9b8e8ead73da6a4560ed7833c9bb9becca457a

SHA512
064144016d9b80fb6a9b47a570cdfa5344d5b6b3b4e2f865e33927c1a285340e44e6db315e334fb13df4a4cb3a6d36bf9de691a6183464504ddf4edfd81df9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0f620cb917fbf4c9cecb9adbdd39d0

SHA1
85e99c73354e0ec24aa58eceda1554c02b7b47cd

SHA256
6aa31b1f36d90f0ae7aed5fef2931eed0ee49002bda0a5a112eff7812c202e41

SHA512
ff44831381962dffa835f70932d64e4c2dce294d2e8b495e1063867498e6c4c550d5cc9da99806959ba533d95e2611ee944a79949b3358c09e77ac6527204cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc168e199958acb21035c6555871aaf

SHA1
84d3060be2ccd4fb5f7d5cafd0a1236ad86e59c6

SHA256
ddac493385d81077cec07ff2dd7aff96e3f09c534cc19278643471e848f38a5e

SHA512
353e5e942ebfdaba8ba3dc813c5d838f71749b54df4b7fcc0b5c91d7f78e82a4d21693e05c66bbd524bcf00db0c76c504135e0c3ccf2362534e78c33de308035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f26abc5db824014d835472c33b03f8e

SHA1
88303ffc69666c9e4883b9042307570756530312

SHA256
a7ae5b35a53c19574193d5e7dc2e06c40256ba6dabb72c69c4d36c75309b2ab1

SHA512
c10f563ce9d1b9ae182a3f08d2328e757ceda49184890aefb58974fd2689df43eba9dbfc6604195e4584a263f443bf24785e870738a5c77d7e678e5db69d033f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ffdd889fe79bf06c1057a4819100bbe

SHA1
51455464b97ef63b51d1323027216201255a5c44

SHA256
9aa9edf53faea6df1283f1e79be1f73c100ae47a2ba613a4d817496cd68f0d53

SHA512
36c4671a42fc60a22e013c52da37a04e37a12858daea269400280ee906335c986cb9503d4713121a7069c2f1afcc541c9de5305117943a446b169c14a72fb04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38B7.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit