66cd28553f6efc29c9a41b4e24d41b082ff61e5dc0bc403826969b5d45a70da1

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ed8dda9d14bd740aad93a3f8e5c71d.html
Size

123KB
MD5

b7ed8dda9d14bd740aad93a3f8e5c71d
SHA1

0207aae46be4aca73273e73414ddec6008f6957d
SHA256

66cd28553f6efc29c9a41b4e24d41b082ff61e5dc0bc403826969b5d45a70da1
SHA512

78fcf077d40b30aebdf9af9052dde9566ab776fb3e5054cf44ce14ec1dd201e36ae1669671a55cbca4501945df9eb5816700a4a84211900d3f30aad568ea6b61
SSDEEP

3072:A1ezWiI99hbEHhbs/n/vdie1X/bVFN1GXbbY1vlS1xhlRV90ciZTe+iPCb2dawl4:W9as/n/vdieRvlS1x33lqn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415906747"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001562dc7519c37be6005a4b4de2c5f0227b6486f1a12c00d65546dba57dd2f143000000000e8000000002000020000000852853a5bc259a1678b18f62c7d96afb2c52395c1b224eb6510407fbf538291c20000000f741e0c5abfe16c506023e74eb50596eebdbe20d6d96c94d891483139b988fdf40000000dfa8e1caa8152a652b34916566e52f9cbfe0fc34a1a5967e2db52dca0c4d5bc785cbedba61a79ad374eff5a34160807960e220639f0dcfd9d9081e65d5a62f48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11BCBD31-DBDC-11EE-ACCC-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d038bfe9e86fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a7f30d8a10c9a0167ba8c22155258b56354f2fd90db69273b4a9464c9d4177f5000000000e8000000002000020000000360cc64253fa2dd9d27df1398ea6308120b55b00ad6070ec55df79dbdbf4640b900000004e5239b0a3931e4f0eba499dd06174087d014e72ab30b34c729babca7c10dc29499cb0cb5bda5a04db895df0e0219457757021ab0bd966df99ca15a2e71d1688c7534e3bd2f3b9d997d8acd55fbe1232e40e02d99c9c826ab357cec20c9247720cc2326c3ef187dc39e74045fb467ecd41a6f957341be4ee821e3267b2ae7da1ab104f8a588841b1a29f8d3a6f8abf7840000000cc5aaeddd34ca4db1dc3426dc28bb18f56cec46eec8061e1428de654a4a836a749727d48f33013bf8754de4de2937c42e2de7cd4e6fa7277a5babc47527e5fe8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2940	2020	iexplore.exe	28
PID 2020 wrote to memory of 2940	2020	iexplore.exe	28
PID 2020 wrote to memory of 2940	2020	iexplore.exe	28
PID 2020 wrote to memory of 2940	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7ed8dda9d14bd740aad93a3f8e5c71d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8210ef621b166cd379d29e6cecddd4

SHA1
2aed507c374856badad5475cbc647fc8ffb69def

SHA256
16cbe7063ba2496f5340b3d64753b02ccfecd34fb3829959dde3843c26854243

SHA512
c8e3c8d17313e298bec2e4c7154ae1a4ecc33419beebfeb19d9786b203e5e39d3854788e095364b42e43ade4b470027d796d74599cdaa72de203ab06249f8a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceea1aa4a94b0339716d9d8c02b44e69

SHA1
5eed4514a4f72da91ac97a48d81fd9a8c73b7085

SHA256
033411ea2057cf3a61d80ab79a61874b11aeb1bb988a9ea585a891fa790eb3d6

SHA512
b7307e01298e8e906a8f9607e37a825def48e13143f9332b3749db1958403d621424c9433df7ffcff4088ea7ebbc622c9e207d004aa9e47174407f086b075f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
918834236ed645b6b2f2cda82d9cf8b8

SHA1
a52012df115ad8802de8760c7eeb6bd6ae890f06

SHA256
b3f19b6988ed77a8e1bacdf71aad3571dbeb8c06190754bf508d5a85dfea2055

SHA512
6beeb7b893d73a740a7bc26e53c098095472ecf3a74cc6ddc657e927aa9594933bc8e0c53ed44f7c39d60c512119eb1bc33e1302c41016ea92aba6f731d40600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9cb57782ef8c777ec26cb3ba6b13fe

SHA1
ead82b4382f344a00efaab5f5725b4cd930c71f4

SHA256
d399fc08ff33a7f7f85eded5f96ddf359d3f974104a127182433a7c113fed9ed

SHA512
8d195e3b6ed28e2699ca4481670ea661a37bad1b3666c2b3109acd0676d452f300175f966f52647dcdce74c13fbdfe1167543c45f70dd7276035fd8faf0013b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d089bef4f10485dee3f6be0ce7c11a14

SHA1
b09d3c6e940e209d972d61542b824db026332a24

SHA256
26e1e60887023a88e3ac2bbf3767b5baab03ba522edd36cd843fe6aa78404e37

SHA512
d96b2565c6afb9f5379a8745f3aafbddd42df27b54e0df93b5a73a49d6b62c1398290a3f8ae3a89bdb040a52a2acc35d131358af7fc5040020163d0353a0a3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df4a5751fbbc3ff8390b94af29531e5b

SHA1
80008c8a8ab3380d75ae3080ec36e87f007dc4c1

SHA256
d3b36b55e2146639e4bcce3e948bbc3f5461384188f50a46f67e893e1ae1ca59

SHA512
e4b8c8bb6cf7fc2840fd2c31bf3d005ac21ef6159c1e73ee623b1114a79024e71f1c760004de9acc75abfe19cd9f51df8c741fef749fbdc0f9b3aa2a802968ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef50db76b43c6b29dfd293b856bc510

SHA1
76b777a685f37aa38570dd27574aca901d149c8b

SHA256
7350f9104dd7510366f5aa45899f5b50133319625ef37e2cd27e8fa9c207db47

SHA512
4cbfe8cd999b368edf85133cc5ec4135ecd1def04050e08da6ca05cbf5cc4554e3553884c02b75c8e19ae2dfa16a9aadea5904d20c58148235ed624edc731583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c03b570a7a34f0e11c1ac6c855b9602

SHA1
7cb81aa95edc0da5774ed29807cbee44869f37bc

SHA256
a2bb64281dc8c88ba75b6687590358192ea83d3d6eb7739fac63e9bb3b430129

SHA512
51eff4e339e6251a1860b2c6bbe1b6b0fa95a9ea493691b8355cd30fb7af7bb654cdd45992ed4744782eacecf26d0f377731a024169745f8abfa7e79bb2d8ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66f313178b1a452d4bccdaba640cb51c

SHA1
5c4ca9ee18d3a4867dbf6a8f5d23a4b45f7fa730

SHA256
4d907182490402531b01121d3a843b43bbdf530e184d4a729994472b172b8ece

SHA512
6d4e261f413ce2ceb1332ae07478cde68cfb3f9013da04b2e75cd8055238f5c9ff638afc3143a8d2ec83c45e69fc5f51a2a4ac8c1982b64ee50bc3574e1f36fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d2aa8a8583f182fc432957765043129

SHA1
e81fe4642fd4cff00e514b623851f6583ed5cd34

SHA256
18cc247415dab1ad32fc07e4dab400ba565a84e8f847e1445031187bc674704b

SHA512
0880148cf5a3d95db65151cc4d0ca9fd2d4e208029f4cb70d111469fb3c645c1ed6935ba6cc49f23babca695374e4a0a6231dcc7d940a532f9ed415ca919368c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b2a5aee46840f9207b0ae7b489f3ba

SHA1
623ad2660528c5243b3d40784f4e97ccfbf17ea4

SHA256
9b3a42d9651b66f3f3041f74745748108a9984d9ccc3db93e3be746cb736333a

SHA512
33d14c9ab4d2a06531179c7c3703b71d61b2666d397c6e44d245d73f6bc92a1b442cbbda6f70e62a4d89c6249cb152256eb4191e94ec4f8a06911ed8abe280a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee3113f37007c8361e47e9260aafd651

SHA1
15d4af2ee190d08dbfd75fab4941e3f6c11ac446

SHA256
ac2d419ebe158d8785a546fa81b17fab5a2f6c89f2c2493d391d66424f6870d0

SHA512
00788067b8e04d5f23c59f6a790bab45f7076c739b926714519964d558d50c2c5bd7b928c737f0b739c4383344184b62123a921a87d60cfa5741b19c94564a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7012e617140627b7ea887cffaeaa9957

SHA1
f958f6b8a58bd39abc21e9b457f7e9fbcdee56c8

SHA256
0111ae89f45e1f34f1353a27a6c444b9d19b82932235c714f82e9c78fa992690

SHA512
3d183b3d8a86550195154a80f48def27002e4289752c7e7e4ced9bf5bece6756e0ccdd7540e0e01a06944ff0a97d55727d3f23825baa80cd697d38642de2721e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d736a0dd11e9d26be066ad8a23340e0

SHA1
8a33d32422a1802429d74d05da8bc9b604ea65cd

SHA256
6acc6209b1ada8c6289dd187fc443c5c2aac27d04ae0a87c7017e4b8097094fd

SHA512
3a8900d05301d0a3e708bbd45a05f956e5b57a87b1639a2907e7e695005df9d37974402b8264a700cd9f3ee6e2ca17adb5b199eea2151a25b3569ff16ff09e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\bloodhound.min[1].js

Filesize
12KB

MD5
8c29d1c00a6eafd32e76bd228f04719a

SHA1
b8450dcc94567755a144e6b4c201c27989e5f544

SHA256
4c17e833d4316fa1e5dd13448459e6bc1316171b8031179f0da82470058cc0f7

SHA512
902ff8197eccc61b25c4357224ebb23158ebd2e73773faa9f52fc4d8e47192db44d3ba5d7889a2e4b85d45ce5a5fab319e116e456fed42b44c8d39716580bc49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab958E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar958F.tmp

Filesize
42KB

MD5
0852e9c7899d4ffcccfec24014eb82ea

SHA1
c0f7c4d0264c71c40cd0202bffc29c71e5ae8088

SHA256
a6a0c5aaf49731342a8fcc643e3d94f5a015753a79de0d8f2a0c467756c8eff1

SHA512
3f576e2a4a7788b4cacc30ac67148aaf5ad3c82be77083089ce25ae8dbba74b7584f7a3df5cb68c85e3d95f5285223b08c98e661085d347750277062e92c5d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96ED.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit