59351384480945b6289aeb1eba8fefd45ad3830872a1b1ff5a638ef0302dc0e2

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b73c9714dcf6c5403a6256664444bdf1.html
Size

6KB
MD5

b73c9714dcf6c5403a6256664444bdf1
SHA1

7395bd7ceaca73938ae7fb39bf781112c49fb819
SHA256

59351384480945b6289aeb1eba8fefd45ad3830872a1b1ff5a638ef0302dc0e2
SHA512

0abad80e58be1c1d84c160f8f30cf2716915cb721cf05cc89abe6f1274309bc92b74ea3933abec24e978e98e0e46689657f58b1a168971a153e9e394800e3af2
SSDEEP

192:Zy/O8yw4RlDEvHLgszgAEPydXDChxiqEuf:8/O8yXRiLgszgAEP9iqEuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4018410cb46fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35B96561-DBA7-11EE-B9D8-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415884040"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000002bd94ec0ff61eee50ba4c913658dc4a86e01f8201c74a414e2f0b5cac91022a8000000000e8000000002000020000000c81fe08ce1798f959a1f1acfd23ca67b576fccdf47f48fe99e334b634e9b073f20000000877d5380c14fcf7c3634154649db14c229c41a1fd07883ed2a0aaddf0662368f40000000932b14bd8bf11d8624616cd05952c0e854750bfdd3060660f4ee7cda3e2da26d1df4350c07f89b22290fedf08662743b7c26108203ea8457f59ac1ca1a551e2f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000bb020213d1a8db47510f9c3bb86261cb9e11e7f5a34f78e892e8a87f2ba30cbd000000000e8000000002000020000000ec47cbca4e5834cd70f7a6ed4b576dca4e551bfb1f7cf0b65a6313881da03576900000008c18b3cec18f08f4df3fe4460a1fd9019efa5243994b6de63b93cc54de36413844d00025da43b7d67876629902f300b716984a04b8752e2f2d82d94923bebbd643584b21dd8103127acfad863e7fd842a960ebda000524021d872bfda07da164aeb56e1b4d04af5a78912aec72412ad192f5adbfdb862d8ef9ce799c029200ab26e2580c55013817a41c1f371d8acbc440000000626b97930f5b949a84f4c8074e6a902d065989c20743c257d4e26f22b4c3649eddb399bebc282d2e3dc9d44417f62ef7d049c1b8d67d1c484d5b62c9fd5aa283	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1124	iexplore.exe
1124	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2936	1124	iexplore.exe	28
PID 1124 wrote to memory of 2936	1124	iexplore.exe	28
PID 1124 wrote to memory of 2936	1124	iexplore.exe	28
PID 1124 wrote to memory of 2936	1124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b73c9714dcf6c5403a6256664444bdf1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e44d9d7538f10d6b0ff99cbe056a24

SHA1
306a738c2913c01bf1e6d8a0486fe146a645da6c

SHA256
16a191258671241f18071a9993221b1feb25bb4b3eadcdf400cacb99bec37cbe

SHA512
26438c042605c03c239d90bf2a317a9683b910e846f02b63cf1c688c21507bbec3e65139ef45b95139b3b96938a3554f28be9b27fe83a33df4527fd40661970c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95f01f50f02718a7111a0f7d3cb7f585

SHA1
b1296ee7e9f24f5eea33f30b2539ffeeae5a7b69

SHA256
0daa6e5d1dfeb041896429d18ac7f91e05f73b7b8f257f76b971be246abbdc35

SHA512
7ed63fa22e2e20434dee3a22c43258b0b5a94c665fa2ad950e55d8c1a609accb34e68bc750d060ef6135185bfdbb1080f78d0aacabda613c2e31cf67e1c7cb70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df95af3e3aa1bdf09a62acd7953e1899

SHA1
685427cd06ae2284e1dacb071a06289d26248342

SHA256
4d2fb31a09bbefc4adb8072a5438950d4776721a11527d694904db2b5c66976b

SHA512
310a872d4a43fe0c159ee9133b02fb51084c5eb10d8b00d41c04c2d1980e41f65a2e0b3d38b53462e4b0abdec9a49eaffcb60ff34ddc7447cef054b31102843b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3560092c7648ccd5191e39634337ee3b

SHA1
76c63f8d33f2a033c6e6c555bd7470a7b04ca87f

SHA256
836a4f3856a8557bcc6cac1b3a5209765e27fe525e15c9e187132f345704d0c1

SHA512
b9e05248b212bf37fb3b9e08c249a2a7dcf2e51e24f3b5a8d2593e09252965a55aaa5044a4938b3482476094966093922f3bd5267e81427f25b72f000d9cc444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
896310c6d493889f36ae384852c8d992

SHA1
e7bd5e14cf6b6fc9d00a3721d18dc36679ed5577

SHA256
270e257780d3a9ff5ba936ee53d48b7836556a8464b57c544981170497902516

SHA512
15445ebf46863bf1c0bd754a94e183a4fee40a16814551b58d3dfda6065e9bec6c6e59b3ec97c9f37dae3dc2a87fc1d5376379cc1ba9e940e0a0d4539bc9eebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b83364f263cc83a410c2f5a1ad158eb

SHA1
1861cf3936016dc04c2eaa3f9aff9bb75295978d

SHA256
7dc1f0fe1c002f6740ded22aa4faa97599e9c164c02c7a6b27cb8f8fb7d3a4d4

SHA512
092611408f21e3f028fab6cd0ab5d67520a0f0c1aceca8645482f6e3f11270335bc48e02c2ceebff17373a8f05c9548c897b112ab60afd03ad8619e264866b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
929d5328421e2d2d0f25e0d70ec78b8e

SHA1
894627e6c8b6b3d60b85bf22850637960c29bdfe

SHA256
ee880a1d58b367c4f2f26dd7c95638b21c8f55c76f31a6a8a4ec33d5884a0497

SHA512
c704a4545f6ddb27bbe5b8a8d01995eb409e919969859c2bc6d9a6a4f30f44ec82bc3fec71050ccf515705f587b8d5726679414a60203327c39e98cc10ee4b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0160704f1f5de3a8991a6c1ea37fe24

SHA1
af3ab733ebc2836e73bcde96f15835ecce76c609

SHA256
b259fb0fe0ababf804a1af6905668962cd544837130a2bdc5d4a454716d4d62d

SHA512
96f53708084a7f313aa22d9db425371f1c4e8b4610726c7d3213d267de776c2c59e2a275c0e077d38051b20d7374024148367356ed1474318643256e25f2ed2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808e1e48ff2e221eaaa4931ee3da2881

SHA1
8627e53fa83824a78346c1507092be53229e8884

SHA256
728eb44f5879d649e35326827eef7b2aca5a6be0e162d54058309edc3cd2e8d6

SHA512
f42a13cbee99120d38422dca95d963933d01043413951c2a01c073baa38fdaa2808c9ac28e62c0ee4c593add7a92e2405fdfec40915b1fc5ee0dd7d1d30493b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43c77cdab5df19447c65f3a1720fc055

SHA1
a844a4492c9f8f0f047d7c84f6377fa710b46e09

SHA256
9b83b7478b137cbbf3a6e1c92d97703dc75454402bd2413d460ed6e91ff55a94

SHA512
4608a184fc3d562d06b8adf2a142ceae9c63ae2c8a6d0106ce85eb12f9cc776909c5d71c818ea34c435a130f566874f302b976d917c1445838261b873c491137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b83f1e2bd416dc7414a5e358813c55

SHA1
644e198c5f4112fa855bc0f97f43a8ec52f45aff

SHA256
4bece507be0eb58a275ef4791ddaac3460ed1fe53758b7ca04a1d9ba334bd781

SHA512
78b37a3252019c7d41cbfb4ab5e2a56eea5b5193f125387d97e51f97ac13e31b0baa400e36e64abb30e0bd597822458794eebc4038f1b88f66bea5500b585e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8abdd4fcdd5e075fa4d1923c96aedf07

SHA1
20773af75245822a61884cf87224456d607eece0

SHA256
0a9d591c86a17073fb48e8cb71343c5fe38bfd970c415510bf35e90c686519f8

SHA512
ef75e0e5267bbb81a608cfd12efaef58c62ec7a638d428eec398d3570fc8005c05f50fd3d24dce67edf6a87451dfa93ce95044bd6117b8e00bd7778604d15871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9823.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit