14640e06eb0e93e55dba761514d3acbb126c3d92618b205b400bac5b9f7bcab7

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b568a1d7bdbbb7fff56c3bc977d3d765.html
Size

25KB
MD5

b568a1d7bdbbb7fff56c3bc977d3d765
SHA1

79ab615c5800e38357fbe2edda927d39f58b9c27
SHA256

14640e06eb0e93e55dba761514d3acbb126c3d92618b205b400bac5b9f7bcab7
SHA512

2831d1102c00131667e046e36f37c507c78a7955873543541c935efcbcd92916309838a919c926c63c85c99b22b55078d4144d6fb84184145b208207ddbda870
SSDEEP

384:Qdg2H8oT7GwtUNXOUtxKTeBfKTpf3l2UfhlLgWQQ/U4yhoy7jfIWrYc51IlSAuVS:6g2HlT78ltITe051/nNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000e38757cdc9375c68dcf6cc5e3444a9364a25b1366d3c164098afa5d1856c253000000000e8000000002000020000000daa51155109f4f26cfce051c53c70d0a63aa7b11c266367c9b9eacbf06b396d5200000007415b786d6059315330a19d7a14bcdef222d67ac5e1ba6508018a6dc354b546440000000d2b27a3cd42d914499d2ab37f5e058f40952151decdffb0c0abcaaefebbe4dd29224d5357d5dcdd6b351ec0621d691fd6e3c4eab9298861bb4af239632b1410b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415826140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63AAEA71-DB20-11EE-BF93-66356D7B1278} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e749382d6fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006833ec10050913af53f3f5f2de3a38eb99d331257245ced6f1f7c30cfffd47b4000000000e80000000020000200000008e028a595a0dd882769b8478bdfbf564e059cd8ae4dad7fcb3fdb0dcb55606fb900000004e2385890884cdc9447588a111c3c9b4657e3fe4974cfca687f17ad3cc60be743b232e3f3ca37a18fd710aaec8dfbe95fd984bcd062b34cd52918096e567218eebb220e57ca4d3eafde4fd9781e22881dd4cfec26962497bf99f988aae9ef51f060b2dfdc9fa3d0cd163a10fa9d49f3a1b18b172c63ed153e4d3ad09a059687eb9c6faded44364b2177447fd47d261b040000000a79a71af76443759850600d53b952d9a137132ce4a0935ce7f954c65219de78627dfe5c994e09a799af0e7dc190f877b1a8e56c7924a706f99715c84057456ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2036	2040	iexplore.exe	28
PID 2040 wrote to memory of 2036	2040	iexplore.exe	28
PID 2040 wrote to memory of 2036	2040	iexplore.exe	28
PID 2040 wrote to memory of 2036	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b568a1d7bdbbb7fff56c3bc977d3d765.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68bfee8577f8abc507f7475dafb51865

SHA1
75d4c9a42f760f03a98031c312176566f94693cd

SHA256
74433216430bdbe370e996072843a475f55e66e063f548eb2e2278479bc2a597

SHA512
d4035aa54306933bdf97b90c3d73b8953a5f97e3ac9633c961f4dc3dddb648490d0cfd069a7fabadaa10705c94865739eef5df95903a13c163842f7757c62747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ef3461798d99853cc545a9cfd144db

SHA1
7dfae4979d0f29ab8373430a7cc7a176ab1c681b

SHA256
78de6033524b0485a88ed6db6d8b93e09759c912c2fee36edc71f06bc951f958

SHA512
4ad92ab7d269f7e122c0746297cbf40d782daa0855f9ab40737df67a2e3ae49ba6125d1277e9557393f1b6d0cbe86a8059d8ca874dac80bd97a32850155b402e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc3b1c35edbc67f33c55efa44e5838a

SHA1
2714e1e4b6e6459939fa550404a04abaecad4dcb

SHA256
7fe861c76520911e850bed0ed546d4ed54761ac7e5b2a2e23b3fce8520efdc2c

SHA512
4e98db28a5dd6cf3c9689549e2126dd442661e600d118cd5c0efa26771d1a6f2a916783adad5fd6f3b7f200c1fd4b1cfe24e4327e0b38ccb948cb7a600142f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e724af319bcf10871edeefbaa700eb28

SHA1
6b71cb25b9890950b723106dd6b664fd8ae78edb

SHA256
dbd6e7bb1a13f72368ef3611de3f16d455dba87dfd54bef4536d7e14ad9c8da1

SHA512
a24ed9844e1d4087b1c1520fe9913164d4952c4d9a64b4283e20a91775ffbb952fd1e071d183a8a14e8da728cdf2edc77b62dadcf89ba2244e6153d4f44f1694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
389c89ef2e1d243c109b008375d354c6

SHA1
1bf5b3137f437f10a4cf61fb131e5de6f8d87b43

SHA256
29db9b81e0839e6af8763c21e8e0d8335836a10f2405d5299d8a673e17cf5be4

SHA512
4a3a05be13b0a71fc7a488e16463e1c254fec008be8bee7299c275694951477b6fd8180a2566ab18d32cb5a3bed4109bb5d6b54de9a6ec3ce79d973778233d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f8cc841b8245848d488173e3f2b7dd

SHA1
749031d6651c493da82d475d1aded991c6e7526f

SHA256
64b25083d33968cd8d3144516d2555c1ee874ebf710f6cf5d29915be06387843

SHA512
f8f79d48a2a6ed2229eb40848b7eb1e9b35726e08d041cee51de730c02acbc33de78ac49dc87bd36bc4cd7008a60165e4a9322339b74ab732618ca7b8d8417da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0c348da2a224dcc355126326f865d1b

SHA1
15f14e235df80a8a2da9ed52d1f2c5aebc47a349

SHA256
a90eb864de0ae195b3867d057e136f20a1e5fa602a50d51eddea85dd5ecfbd71

SHA512
40cc672915aefd1528b554bad3fee7ace7b79e7167cb986debbd69253f5b8527a2027d335e231168600828424e1d5b0ec0141ad6c872b88017d1c33554df2ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93784f3a2be8ba3cbb88c49455abd4b1

SHA1
4fccd8c75f5deb3a9e34f87ce5f0255795af2c66

SHA256
fef6ff9f07d5844ad75a2788f3c9bb414144d1384d6ec28884da42a97c4d502e

SHA512
133aac0b4bcb9583f2f78e7508eea02d75ac27e307aececf7275ad6fe3efa959656be99c78fda02efb135c2748ee246a17f6709464a1f5b62c7eb800a4ccbf43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935f71933d6e83c289c1d762555a6709

SHA1
7f8c148d2f8f1e9b879770be382bb91a6534fc02

SHA256
a7f669c85c423209d59781f87afd19d1b4d974b6e5a16acdb33aad26722b70c3

SHA512
c87eefebe1c1e621918b64778cea1d1b2e5605c7d7d15fcca78cfb1360f6e9fce0ca8160bdc04f9ac37cfcd260c515bf7379a0f708a2891d9d6f6a04d4feb2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82120f4a100eac3d7ac8a11c7fcae42d

SHA1
b95bfe7fbd90e4f951ebedec26759d0cd9a5d825

SHA256
32552bddaec4c88d65e7720676f3d99d861ef8a53eec1ee2c95047b838b1c32e

SHA512
da6527c7fe491e1ba1a8047bf32bda100748995c32487c6a8ed681cf541a65776e541b119b451d224fb06c4b6d48e5bf8defc8e3a2afa5facf8bbbe28f3e073d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beeceb63c679367544b2da3f34496de4

SHA1
0d7cd31cc5cd4651ec00a3bf7227f874585d8c1b

SHA256
a9c438b29ea5533100eb466664d1ac564e5d1301f863d96d3093fe30f112624e

SHA512
529397f48e03210698b19125b30a576e2a4fc206882c128ee3cabd32a7fefc27b2fd65cef0243c0a13a931b9876fecbe09f3668701b5d683b4ed89de0d805dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2771.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29B9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit