cac35e556b171935b3e07c761cd4544c489da08de9a10c9d7d346da1737be7e6

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6714f1206188e14c67a693120ed5a59.html
Size

34KB
MD5

b6714f1206188e14c67a693120ed5a59
SHA1

72fbc1007df890a7ecd2e3ddc50dabf679596c8c
SHA256

cac35e556b171935b3e07c761cd4544c489da08de9a10c9d7d346da1737be7e6
SHA512

64efb35e4a8297816d905b656971e323b9cb9b6301bb133007ac7aaa7629d798ca884061d7b45b2e42cc394e12868349ee73166a4b61402da971ae22aac0bca0
SSDEEP

384:E142YnPz7VRNeyul5Fl1QX43Yim1EzDmSd4uEfDCQnD1OrRFVOprxxnFO:X2YL7VR0yalWXm879IOLxnY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415859003"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E807BC21-DB6C-11EE-8795-52ADCDCA366E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d065e8c1796fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000cc2abec5db602f5ee777e76631aaab17036f961a422f5f1bc0ceee3f7e16f324000000000e8000000002000020000000ec0bce30805e55b8f85715c109f1c9a2af1ffbfd9e4c8f122519337450eedaf6900000001c054d496d74e40fca1aa126892931f7a28dae6d85698c325c036e41bd9a47dc790b4b748b7d135719301e9dd45a36d1d4a7547b37900ee1a77887a950b6bb8c00811e42a60f52f04e3b8bfb85d98c551c0cbeb043c53b1bc8029a3739f1ea87de7cb2b2e50a80d97425eb04541c71bb9b5e4e9f2351bcef8f055347b8e4b817fdcd9c59e1e747eae7819146d96e3a3b40000000a32b61a56f6affbd94117f430581ee2c34e7b3ac9131d9b903a4d1dd7c1352315adb50c1afd0b850f3373e3b58637db5ab6a31d7da6750f01209eec014c9f032	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000098d2c62ab6c94b050e4fee96d7660df0ecb2edcfe32328cd21e155b8cdb9a4fa000000000e80000000020000200000004657b85e30aaa15768248174a1136741d0550f6997aab2418180baa8fc48172020000000658a8a8771162115adeece702e80b43c1b0712402542864f95578bb85d5b120f40000000795c65f98031491a371ebea5cf61f988b3c30a9c0ec0b63380ee297d22508357b476383315529bb65281c04eef4d94124d12a09ee2215baad63c44c7926554f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2344	2960	iexplore.exe	28
PID 2960 wrote to memory of 2344	2960	iexplore.exe	28
PID 2960 wrote to memory of 2344	2960	iexplore.exe	28
PID 2960 wrote to memory of 2344	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6714f1206188e14c67a693120ed5a59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ca6f8efff6e6df4282a290f9a091133

SHA1
a43b592260660c39fc0f7ec609d9a9ccecc9228a

SHA256
4c618fcb7a942ad4584696aa47d1716e6062646fc431f03e9ce07924889f6d83

SHA512
6f8eaa9e9740e044f45ce5dd8685165242d2e7188f60fade15bb4d66693a66cad89f4da42b256a18bbc574d1d19743fe46ed286d04c1ddc9e6ad867bd5e53cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9007d9247ecb7ce6509c22bae32444a9

SHA1
3d9f919c6b7494975a1e1797f7a897409a4f9415

SHA256
69f2aad3fa0cf6af0a9d40869c99799655b18b21cbe7710042dc7c9fb81e2fc0

SHA512
24cdb8173f7eea2f982bfe76ddd5ca6cc90e84547da1f3bd0f6977e1d09f4c482e3548558b634172e2e8b346b4ad5857fb09460b53e6e49036796083abc8e15b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594cf4edf796be3b231d031542fe24c2

SHA1
c0fe25d54e942f7ecece1d5ac5c2f3e20c2fb3a4

SHA256
6c8e92fb4aa67168cd15c11c23da60a8c0f8d53fb85ee9ac3f8e10dd4ce0dfc0

SHA512
0064992e802fc99293172f79ec3fa1571b67388b41bcd379c416f93b2499cbe492311e9147966beeb4b2abd67435bc66b54cb7a3858cc8725b947c7c437a8ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98741b3590148a6b80b11629c42148e6

SHA1
ec981c770e6190e29788920fc9d3e31d1db5d1ca

SHA256
4e885eeeeb7b1f9583f352067cfadb7d79abff91532cf25896e652f759c9b13f

SHA512
a6bc88bbf8e7f3e23deb2c79783e2d1eb5103ae4099582251c83c6c223cf1484c9d5d36ba364700a73af05b8f0ebf85871b2bcf7796538a12abc5a82202ff030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdd5081d822bb362e653e1eb747a3f85

SHA1
cf87aa4ecac1a60f7bdc5dd39c786a3192320b26

SHA256
1bca24dba21aa7462655d086c34568a77260098820756160e150bceaa343474c

SHA512
62568b4d63e5672823394748cb4c29aab3972ed09c08e4a3b9f1f818c824af7034b3f9476f3e6d12aa7fe749330ac4fa974cf41fa4e8dab398989acabf503cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3cb980d6247f96775b0bd305fc15c16

SHA1
4734bf605ab556b707503bbd4f5689ac090c2761

SHA256
57dac36d4a184232138082244060a4fac38cc53121ef39c6ccdbce271fcbb2c2

SHA512
3e6d00a6210a2abe0e1ac00908e146b79d8452e37be0d163a34d3708ddf587b8e3aadc0721dc9f2cc6da2fdf130232136e1c71e74b0c61474e0715b620b8e7a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5185fb6e5f8314e526a065900ad0bf2d

SHA1
fbe5804d190579c23674264ec203bc9f2136842c

SHA256
f6552eec69e9834362aabb1c7e9f02415a533a22868231c22bb316f0a7d1e0db

SHA512
11d0691d0e7ff26cf5723ffc429ce57c716c88edc9fb57125cbed9714f7ca15ddcca9534b839a0fb367f29ba846faeeff0f0d992b6fdf33b49ecf09889a2518b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5def190c7079aed95c91207aa0701925

SHA1
86a4f5ad35a5f0879a0cff130c7b9c934f3aec34

SHA256
fc1908e7787008f0317b740c1756d528e051adc57c04ee3a62ddaf9b52128789

SHA512
86025f4fea5ffaf5caf9520000ac57ec9e196b0cfeb64e925707e438fe9e8f9ac600c3bcb72ac08c2156003f101aca8a229e3d0a936a8a7806f676c45be4f793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
115e2b1e50268db7f6b1657522af0c2a

SHA1
8b9320e34ef53a5dc8d7566164937882d8e0999b

SHA256
027bfb807bc84ae7dcc639682d1e69dd64bed1e4937c3e3f06041e29fbddd3e5

SHA512
46e95eba161c27e11ee1b74874543dd4acdabcbe23bf59fe1ce3c6674e78e8aea7ba5309d0f2dfd109aed05306719fd9b8c33f02c567c8c391e835840e8a8a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
274fa82330789188d77529d430d8322e

SHA1
4d2d846a8f2505bd145f49aa7a0ccfe238310621

SHA256
f925cf9af61549cc996d7fce94a524e8166b3e32b130d5361b2aca681d0a9610

SHA512
f0d8676c58f0c8dc7532a91e182cee7bf375d0fe408d7eff05f1bcea0315880083e92548cf519467f94fa208e737f27a98e81dd8bff98f7b3ea8113d94872993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a789d52e7d9f07e5d88ea0677ec2f56

SHA1
7c9a0e21cf57a4c0cc6fce1e73e68c043f499879

SHA256
3635c151e05455fb1a2579e8bb97c716e22c9f3f9d354bca6f9ff589ac812931

SHA512
006b6ac486b954a9aa3e16c1fdb8f8a5ebc4d106aed8f77b4ecd56dc9e67f786964cbf4f587c96291fd0f869f06d4ad70db0da01bc9f82d52eb53cf369b7382c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284abeac096ab6d31172c1c015730c35

SHA1
ea8ec872f8e427dc47d01b8a0b2391368a86ad32

SHA256
919c44657bdea7308bceec4262df4a71f88052eb1c65df23d7abb5b949b35382

SHA512
306ddf14352242e7c5c96024547b01668c78339011eee9d596e4d3e6ff06fa14c002c1b8134a33c42609544ab738f140a63a4c001cd3d1941d5b7f3130674519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aefc45b1990d401da3efd896ea7df45c

SHA1
b05a0f3bc12a1af15fac1f61ae9f1a290d9e2bff

SHA256
06904974772c64117713c4677f0316d460d6229c41329bb28cf0c2aa15f386cb

SHA512
70814edcff65bc20eb04e0f68c5bd3e262196dfa5f3d7b6cdda5c728a6534ee1f973e1113491361eeee087d93256f86327becaae3ebaae1c1d080b9d88371dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab849C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar872E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A40.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit