cbccb3ab46f9d4ee05de19f716cff906c671c38fb02ccbf4a78028f76996a169

Analysis

max time kernel
118s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b624e3b747419520beeae5b53c23a33c.html
Size

28KB
MD5

b624e3b747419520beeae5b53c23a33c
SHA1

c6716612df76d334b6163d0421b703c5e57cbd8b
SHA256

cbccb3ab46f9d4ee05de19f716cff906c671c38fb02ccbf4a78028f76996a169
SHA512

cfc35303cb26a92594ada379f8fe705ae188da31ecf86f40e533ed815935de6acb81eead8e16b41f74e192079f564c7d2ca2bc255b4e9337fdab94aa752b4a3e
SSDEEP

384:3QH+gX3FpEuxlgZZH19mHix6lwTw4mwMfgtxK+CR2FtvW4n4Kws7:E3lpEOlSVqwTsJU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000feb96a9807c9290467f798c35b998dcff458e3e3b13d7e8530ddb6f026cf96b1000000000e8000000002000020000000a66e10c5eb9ce7ced3082c3657efd58c91810ecf48c4af2234d4f580f88050ce200000001c2a3cbb366921be18e318495df2862c3b50442f4de79cfd5c9d644005bdefeb4000000057109eaa993c2b6d8268762fa5abdc633141107f691a744ec9d7f9e5497986ac2aaf3fc044532d75932d0d87d2f997fbbaacc82e99c7e62c2304c2f84afdeba8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109d1bab636fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000cfda706f621fe2c7c9aea3e2b7ad7843e41f55fd98bbba74e62353690552a936000000000e800000000200002000000047dacb1d35eb62dbdab1a4e3f521b447ef8bd3f946f064726ac8b0a5a2f9990a90000000db422bd5c712b4c37f249b822d695f83cd2f065fe2de72c8eb1514f31b576019dbd965869d26a1f2e465ac25297be1f670cff31cd07ee7569bf57517047379d2ad2a471aa6e62f85d4db70d4ae2c05758f1f528eae9968f0872af185fdde1b75a946d0cf84d20bb3dab49843140e6a8d70e2cf8cd3e1fa8a93c2b39f9ba80de359d7aed94e696b2353dc87003e719dd54000000057e54298d10b1f605ecf9e62499a36af221e5680d849bc148d66c0728179e3da94597057ed8c5b3f59d5d25ba0e5b4e70bd224ab5994d80bc6d646c3819dd09f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415849531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEBF9321-DB56-11EE-892C-6A55B5C6A64E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2640	2688	iexplore.exe	28
PID 2688 wrote to memory of 2640	2688	iexplore.exe	28
PID 2688 wrote to memory of 2640	2688	iexplore.exe	28
PID 2688 wrote to memory of 2640	2688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b624e3b747419520beeae5b53c23a33c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a6c7ba0e5f88533d4a7e7026b2dc58

SHA1
9629b396a915eed302fb2158b4ec0696a198141d

SHA256
da0c8408a3e9c0c694df58bf2bae7219b265a75126cb8b54f33341998ca282d1

SHA512
2079137a913756770d4d49623a25bd93ade6982b77acfccb120e204eb2680f6f51429ca6b45444d0d2076fa2831c75f977f62e5f0557acac0faec7ac2f78f25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8661eac3bca7477ed445afb77aaac091

SHA1
634d0db80ca76b58ac1f401f6931b73342ebac09

SHA256
2a22d401cdec820e03dbe78a1f82e928a4da60b3d8e60f16fd32650e34bdf82a

SHA512
2536467607dd1fd58df7a4906516af0dec77b04f35eec5710a3d14c6aeacfd034e3b61611bad7cd7b3e2ad7b98f807828d81f5ef3ef324dda5c2e99a8b9f8860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca0e86a5a7a416654886d0df43f67e9a

SHA1
f9b318fa97af8f1ad86485e98659cbdfd57cb549

SHA256
0988a6834577532aa61be9571869f63ead3d4d8fe0cc5cf3702f7fb402f034d1

SHA512
c5f820663ae311994dfc4252743cb38cd00bdb6a4ba9f90a6724ac6c2d77b6e03ecb5e7fba86ce9bd3bb806f1b1dc9564bec6e1c0f9f8368b9c3fc3b51f45b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af04c7a1e7042cdd7f52c5b94702f44

SHA1
5f6edf217ccbe5f16f081cdae69e48a3f8f7c3e3

SHA256
e6b4c17103ace07dc1b07ab1b6e5bbdea1a45619494ccec0a27b89fb89501e79

SHA512
d6288903346cd1d73c2c02821989e6298a66c9ff064967f26ae1393d4227d8928f6fa9d7fcc9d7146c5b627c9d5a5449a9f787467c7029d04d033b3597bb8e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9592d24db2640d6c78dee5d2da81e85

SHA1
bac4c1b09dbafae6125b83950fb2abb08017fcd4

SHA256
9f8198b54dd867ff05d0dbcffada7a125d8c5f14ff0f10d741414fd0f68b5735

SHA512
ae075c8e7130a16daccb458220c57a1dd06505b492e96201c4ed0bab97e7aa4ed5c1b2b6a9145bd64b9c80a4c355b32a628b374780202135c10f6202d00f5db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2523e13886c70246e4b3a39ab0de83b

SHA1
6fec3396ef7604fb5238ce0d56561bec5ffc7ee3

SHA256
3a367b308141d6653525a7c9b5fd70303bcfd77b753f1533c8819b06d8dfbcc4

SHA512
c2462013c75df0266979fbbabaf9e18b3b7e1084a6076295f43983801b490837de53d94a92ae0843270bc9b391d19d39a16011c7104a2b209540005f59c59aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58b7473e1752a72c5e445383cd6d8e5

SHA1
283638f59c8c669553732711eda2211fc32a32f7

SHA256
e09836b7264d7639d1eb9245e3228a36a898b3aff358ce91732ac58905beb00b

SHA512
815aedcd0abd12b7ac973329c0f60e9fa2eee9695e0a98342074c2fd93d5e2481a5bcff35985391a74ae10eb25117a93eefc628cce3db681a32a11ca04b80643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aab2f42f1825324fe48b1d4ada96269

SHA1
742837e425d05b9a7cb540f8d99ac315a364da62

SHA256
c0e21b7c158230d763bac06a0113fac8a3896eae5df9dd245bf05bb9b768f952

SHA512
72ff8e33fb777fdd3253a601dc68f0f72bd4dbd5607d64b92c8de2b7287cfa321c1f60d24d99c2633488763984ace77767cae682c00e23f02e103678de53edbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7954005aa2a2ca9a3d16e12fb73bf4d3

SHA1
296c33be0b0a66c741cc1c3d7d3c5d05c1433cd0

SHA256
4314cafe3b80bf4026be7a7af9ba843b58935c57f5627aee193d175d4da05058

SHA512
0227275bc89c87a87a19e2331be6cccde3606cd36f04bd8685c72b42e8b8347858c6c6b926ff601a0d21ff42cf136e8fe8c3c37368cda9dfa618efc975b7039f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46af07397fd879c170cbe0b875af5163

SHA1
f91fdab48dac921cdd6d5bc8525868a0739af5e4

SHA256
89557244cced86266acdd6e9089776b076a41ddcd0b2e5dbae6040a909ee658a

SHA512
6177b9e4628a8167c8898b7e836d7699e978a58a500c478ae22bf2942ee9d64fb8f31783d6afaa20c6f388554df95d009b207955fa2e3b2c3b2d0655acd99793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c4c5214ea552e1efe733e54f43f479

SHA1
61214beb0970e8d268eb211f7161fb5120b9205e

SHA256
94b50438da968fb5a370ae1da33da13bd5dab33a73176d36ecb97a03aed905e4

SHA512
47b679e9c792ee4ad8f59649ad78aaaf8ce5aa3c4e2fda7f1bf785bcc3661eaebf84e861986f07e6e8c245e48d0a4c8981fab8c8fb26177f1a8d265df4c49032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OFFQJ7AH\gantry-smartload[1].js

Filesize
32KB

MD5
bdbdd9668ebd9cc890b2cc17f773c47a

SHA1
3354cd94a2a80147721af24f3e489f2ab048d000

SHA256
dc4a268a148c2cd8b23054a6e1783e16d8f84cba818e4d1be594f198ea125f1a

SHA512
3110b8db22fad5725d0b2cb8ca2f73fafad838b26ba1ed448a150dedfbcca5360a8f0142110a1095c19b0f5e9c5807e095df7ec9a04a5c0d3cdbf0f2829be64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9296.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit