dc0c2e91dbb2035126d7729d4383a7f7d46c764e1b34c6b8cafa9b980cb25c20

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ce6d26b8507cb3bafa8116b14f3e1f.html
Size

13KB
MD5

b7ce6d26b8507cb3bafa8116b14f3e1f
SHA1

eca7287f6bfbd6a599205cff6e417451647316d5
SHA256

dc0c2e91dbb2035126d7729d4383a7f7d46c764e1b34c6b8cafa9b980cb25c20
SHA512

92689fd1be0c085d325032db7a6030a5faac30bf65e6d96eb8d9ff80de1de612259f535b93ec391c5ce6caeb13d5dba0892a9e95c98072b96c34f05b1c512177
SSDEEP

192:sjd4OAe46PLmmEsd4hgOcOPKnQ7LK9hjMo4NyfiIAN6Ty07lNNnpAHUnQiCWqKJw:sRLLd1OHQYU7dpqAa8a1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1CB24D1-DBD2-11EE-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000053ccc2c6c6143e9675f6297134a137b23aa4f0d99702b78b8a5ff9366921a364000000000e8000000002000020000000b5692473fecbc220ea03e19d51af260b877a224177af4664931553f4f3b9953790000000ffb515d06d23671151d051d0cf713696298a49a6135920b157d499d942a7ad1872d0c6bd8627d638689fe924c53407342086ab09824f8a96a9c2e1e201c584aaac38599c3438d5984a62731756419f019907472eda3bb36bd08e8f6b60fe1fa81e769ba17655ca945cc426e262bfbdba1d7f91d8397429bb204747babe8cb85eef59bde6f7eecd0722318f8a668f81a440000000c9475c347748fab74b96e954b3ea18f36723ab3ca68249e9c0f1b86cdd59b0fb9a8b9c171e9a659c4c2d71e5f21f92ac89a4c5ee1e67aafcd59454598693902d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808da6cfdf6fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f62d991279b9ef2b56635b4b6cb8a13ec2d1ae0e44ad2eba95f874a7ae99cbb5000000000e800000000200002000000080659fdd62d0581b02bc11a6aee62e44b9a352bca9f8420b04616b9fe4c28c4a200000000be68791d5174d393384e09f4281d860635e627aed9b2cedef5052e442bfb01440000000fc5be7710b8bf1b467dafc649c2c046ebafa46c5b3504e92e4fc42ab4ddb6b9404e3f5a2bb34e13b22655c6c66d227a5f106a952ad16d101e02fdb21928edb96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415902805"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2548	1888	iexplore.exe	28
PID 1888 wrote to memory of 2548	1888	iexplore.exe	28
PID 1888 wrote to memory of 2548	1888	iexplore.exe	28
PID 1888 wrote to memory of 2548	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7ce6d26b8507cb3bafa8116b14f3e1f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f6a1a5b6c9a0a9624dc0af07aef704

SHA1
9be77c1047e221c9aaa6c077bacb06f1fa1b7ab9

SHA256
3d411920bb70bd1a35144bc601e3dd4a0e23d611f1bf2821455b54daf96b8030

SHA512
7b6cd3b88cf0f3f9f43844961f2b362c6749b671bb70bc404f1cbdde80038679966dbe56e976874bdda842f3a7436c305c894f84527793225288c358212cecad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2eac0faf4f5320a356c7242a3e1ce7

SHA1
57b698ab832f1775aa90acf4e189106044dd34d9

SHA256
e41f121fbf68be1b463b32417ebede1c5bd835f48209eab496a74bbb53cd51ff

SHA512
3e20a1bd6235c30e78f562d59b291dd088c75731aebeb9855d7444522bff46ede82ac9f4ab6a3fc6ceb3474a75b51b12a2eb879b353bece5af57eed04c85e329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f773e3fe84f40e472525f04e963ac101

SHA1
d30a00ce1b26f48beef2e8bb8166c41f953b2589

SHA256
8426ef67ff83f3f3ad53bc047026458574ff9e8ab901ca87c77fd66a46c0743a

SHA512
3a9c44ba7b6b5c6ece8ce10bfcf4c2a2bc1f86d6d2668d4b66c158c0a64bd59de86241cf902873e6fa2a684cda83798d9aec947e14db926248be7715f9850897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc892b5381a9393fb7fefa3338743b48

SHA1
ed0dc0b99a6944a6c6a5eb9702d4b20a33c9358d

SHA256
17f18f469ddc8bf01598b950582d8ef04ac01e9f14286a4147802dbdae46284e

SHA512
e8fab4dbf7d26728a8c59b582100bcf5984c9455ef0ec64291248ed9d1701a767c60dad6277fadb9b8be28e8a6e59d49fcf62619764cf6f1b05a84e5afed364a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8594bb8fee27d95bbfe7f8e5fef0084

SHA1
14713d15d72ad55f72240d0a9ee31dfcc8d47443

SHA256
8c200e21d2c2f06564bea43d745274f363f4342feef751372a5551b094a7f71d

SHA512
911670f82098fbe28eed394cdf5558fd6d90fbacb1c8a892a0d66db0d8dcc80ec6857c0903fb46714b094d087179974a5dd82fe11378d68d691a7e4e1ed812e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f338aa83c6ad278f31183c38f6accdea

SHA1
6e01a35447dfdcce9d5f0a04fb0269b9a18298d8

SHA256
131f41da87bbe7b4287f3b0aa64e7e99d7e029693e167e3220abc5012aee544a

SHA512
9889be6d3ac5ed397bd7d39e5e4428da70344ae28da4b74daf3366e85b35cce73f563b3e7c52f571e0ad6ac5daeb17f1ce21ee1ccbaae4191428e81db98fb64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dca2a0f471d714d8fc1bb4e2b953d4fa

SHA1
e0d19cecfdc1ac6718d45718f915ee9059f0449d

SHA256
45bdee4ce2f6650c0171368bca8aa47018a2ca3f3bf3b8035729ebc8197d960c

SHA512
7a15345e8b2d2a9d743ca87ca10687abd7497141164bacf5b52feb7d23e76d771ab8ef2415fd62562d9d4a636b3c0d7436e7878cf271cfb5d8d99796b93cc610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef6dd85dfc330b16fadbd3170af3a9a

SHA1
ccdd524639ed65fa804760ba2aed06cfc1f18d9d

SHA256
81a5acf684c99b4c12b881b3e478a02d27db92069f8d36d088a780f47bf5158f

SHA512
bc86a0f0dee5b9751aa5025d7ab886705bda05706f75ed5e00e136de2e50f993b88c15aab0f8f95dc6d2a4d78344c05fbd9e65af9d21b2850bee64e97f76106f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb464764a25af1f5561eed396c3c528b

SHA1
764431aa5660be27ea4081cb71c3b544d6cd6b44

SHA256
2d28a12c91a8b0d22659eeba6ab72233df73c5f94502ff9bb648dc51c4647c2e

SHA512
affededee784d3b950f45b75c6340194b0fd5bfa94dbf8fe014c2e9b4fb3f55614a640d088ba0dcad32c34d9b5a776a60a549bd70be8a9684b0c12c6ed0f2fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267465efa492d4ecd506240097b286e7

SHA1
12e66791aa1285374835547160b7dfc75955280d

SHA256
c43294bdc0149e3060f57bf2040f93eb7723e9f198d2a23c588be883b8f6ebca

SHA512
0a1b5863a154c6024fc045429b9407c2c251bbebf0c4022021bbaf9cc2e8302a89c417c50743bec62bfba9c8ee0ab4a3bdc69f96e3458ced3e49e26e242be70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de1499f8e7cfd4fa7372f165b92f0d10

SHA1
2c14759c48b655e1235838d1788d5cd2fddf4337

SHA256
47b2da5f3e2583df0c54140f87657f3a044d5655b81c9746d509a63071d53089

SHA512
fa5690c984c70f20ed8a5a9720dd290a779cdfeb14b34fc1ab3f7279669800d5c9cdd9c07b5550ba507b2155f0318449f45c284056a1a5599af5b40244f495a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49e425611edcee9c92f71397a6d1715c

SHA1
85c4ee0075498167f0713c017a83c957381cf0b0

SHA256
9433faa36f4d654787ad00f85c859853b0c08f7b1666e75b81f4de7a977145e6

SHA512
5d6ba14ac97b2c869da41b27874417afac8ee9fbce1dcbd2bca7b9bdf7d3feecc8f65dbfdba4a7e51e54df1d9ffade93e4a6bbe874a2666c5a89a521197fbe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7c74bde3d34135b6e1bb377660877bf

SHA1
711213029aca692b6f64fc7f4039266e350deb0f

SHA256
13499b14a76e1c4a934500a28760f807112212b9405a65d630a2b2edd4a44392

SHA512
47f2f008b74b2796137dd22c6a206241aa6ac09b1a6d15e2e33138aec0baf19ecaf1ff48c7e13e078b0bbc97fab9fc3c4bcdc10917f396619b090fb6ecbe06e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f40cb293001d7938e89fdc227de9055

SHA1
bbeabed3dca77f919195befe00ce2cc3eaea62b1

SHA256
3f4a1b68a843cbe44cfa9f050dde5bc3d3fa6cfd7c9be9e7fb02f4d2863bdd07

SHA512
cff8611ebc6a01a874f70ef6cc21af52a3499788c899e5c31a07850d0225b79f23983d1e36fde186f57306b13711712e86282575ddcf4199dca9abe98905a40c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b8f41962ce341090cc9a68824d22e9d

SHA1
210a6669d29ec964e527444594e296abb00d14a8

SHA256
1ae58b008cf178af5aebb89b96eaa579c20dcbad1e6289bee9ba21740cac6b13

SHA512
683b7b9a13948d83ef054013df176f44512881a65eca530d98ff70ff87238d73b5785931185f597904c90f745b7fee5efca89e1acbcee1769d44c907e124e8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD02C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD03E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1DA.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit