77dbbe76bf68fa70f5ec719c389c24a1e52acc23ce79478bf2433bc03f3df83e

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b82ce1986a58f9aa5ba32b4e61e58f5d.html
Size

2KB
MD5

b82ce1986a58f9aa5ba32b4e61e58f5d
SHA1

d62064af0b166619ed46c00e555aa689c35502c5
SHA256

77dbbe76bf68fa70f5ec719c389c24a1e52acc23ce79478bf2433bc03f3df83e
SHA512

1f9d3cec5baeecea7b11afe78729bcfc50956cc8dcdd3f9f3f26b848c77a1b0b49f918f12a997c65fa6be5be1d478fbe151b1d9344598639c911d225c53bfbdd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000c9113b2d3cbda0db6304f2dd7b3cc2d6bca870d725a17dd08bb8cba094dcf08d000000000e8000000002000020000000b0456ce4a8a23e3b35f4339fb8b5075290f1f10995eee577e0b4ac2eabd015fe200000004fbbd7a5f84178889dd98912e2ccc5f333801c2818b5f6a62e7d0c188bcd1e0640000000a19c127f9213ee1531c246f00db8bf33fd503316c6ade0345f84396c3d3e4fed94a2b1ff41673aab12f2f0db7664a6817ac841651547557bf5a9e53a7e0f175c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd0000000002000000000010660000000100002000000070819186fe5b1a9017bd9da3b4779d747c61847760b7db2e228e251a436d95ee000000000e8000000002000020000000b6b9411d960b7949696d16c023ca78a2d5783395d37eab8fe3d295dfb3f931029000000090227d428a65ef341da98c5266ed5e56223b5d504c417365cd7675584e3e1ec4729cafe3fa8a92dd7290793158beea0cd46395edd8bdfdd72a01b814cf83ad1d9015737f8bb47219294b520d9a210bdc1dc921168fc2c483794775c920c39898550488b573a43ba9211822ce0f7f87a10c3b43abdfd9eaa8a075488c5435828af231bf231bc33af1c626b41d1b4fdfee400000006d3ac0718c6353637e734e45f56aab05981b444a6cbcba7130f19314f3423bf8466ade537953cf32772417f9fe98204646ee43d2c27a641e8885d68e7fc3b08b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7093c72a0970da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{559DC2E1-DBFC-11EE-9288-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415920601"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2036	2804	iexplore.exe	28
PID 2804 wrote to memory of 2036	2804	iexplore.exe	28
PID 2804 wrote to memory of 2036	2804	iexplore.exe	28
PID 2804 wrote to memory of 2036	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b82ce1986a58f9aa5ba32b4e61e58f5d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda23b7055b9db0d4bb7c96bf16abae6

SHA1
6d2acd5474586481debc97f1a87ea5effe9a1067

SHA256
5b63077da6511866e7700cc72808705e270c487bc3c27fdec642d7e04688947b

SHA512
578dcb431f4eb689b1824cdceab3f295ed003d01e07effda4907201bc0fe81ff291b5a1d8c11793b0492363e8e95ce30df5baa67f45cebba5c5ac6874ffa689e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3c9ca4445352c4ba22f1436ef9c3f57

SHA1
f26b02db3cbfddbd65589555629b6843f85fe078

SHA256
af9e32de8496943f22c390159e8d99c2104ba8180ba3ec65b668ec3e64e58291

SHA512
4be723b84f08f6094a3d839567b52dff0063f584685ebcc37f1b6e4d544db97667d56b1097ed63934a7e9d7f752ccdeadf02980226e8d7161c5339b55e12bbd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
339a4330386f88bd83a90520d0e19860

SHA1
179ef54d7cdae17e34bbfb0ac6a87d5c8bde7262

SHA256
51113d7106fd456ff37065d5ce3117b1541f7638b145ed1967804be4c721b186

SHA512
21d57e91dc0681bd116866258916f7743897ed405bc105c82356d8797638542bb5857d98360cf35468310aef4d105f64b7078ed6526dfe13aa266b3e7cec407d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc816cb67f4014e4dae0db6b737bb57f

SHA1
010f418f218eb1ba1baa6c765f4d6c49512ab793

SHA256
15278ecf775571bc0683b5d617647c10e43ba389a0486ddfb5b36222012e0d92

SHA512
aa47c7a03a1568ef4f636ae67f7a20d84af3552f01694352f72235df0822144a25372c47faa3efec4d4ffe594a7941e10ed1a4a71705197cf0d67c387b018c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49627c46f6423b7dc58caa9f7851779e

SHA1
893394236d10163f8b5d53bc73137c04f4c52403

SHA256
727e03e41746be2b6d44ea91b81e9527c3c2804e5ba46bfd0c1641a109e161b6

SHA512
664e7120d494903eb4b96c19acd649ba105eacba4f0f048b3e32883d0153c829d3dbe22c4444ac9f68a9a72804fc0de30ed67ca38fa921544e35ff16c76ff60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3bc0b756138ffd4805096540f2f051c

SHA1
c5d92aa7a6973d49e9ac8c5091e13e900a899387

SHA256
187f2bb49413ea99980112298253933821592f1ec0dd9f62a6b17fa78ffd0b2a

SHA512
e5a2b99a1400920052e309d5b3977297dfccef8bf46c580a6e8f68eab346da2494cc0ccc3cbffc592d98ea18ee5f84fe853faba137726bbb47a12d38a71615a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0650673c6922cd252a0b376741fed8b6

SHA1
12661c39c7eb80f6476d223dd4cf6e5e06e645a4

SHA256
991580e33c97a341b3f0c2a73702212dc6595766721db44b31253c9da498c9fc

SHA512
6f4a7630993e9093f0b33a30fe15f0570ab54975d83b01d2f344d90e91502954daf586715835b767073aac3c3bb4766419f332a0d036d9e1e908714b0d1c81a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d9b25d21d89b15aa62c2b6754890b30

SHA1
842f5aefa19824de9fee1ab597a38e3a1c39fd77

SHA256
b5954ce9cce10ebc3b16d96943842614cf61afb2d83868c741923cb7708fc0f5

SHA512
8543c59e54523c9aeb920558d32c98b994d95548915f2576ec4e224294ca75dcba73a7f71985ea586db56ae5e238ed824b431d3624f98c330c3937f4bcca0fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aebac971eb8a70c4a1076719ba8d6356

SHA1
877562a510b1e247460ea13b674f86ff163c5c34

SHA256
d322b61ab6e745f56343c7ae59109415cfcf5b8bd52b94080ed7821f683453ce

SHA512
5c0824c362481760bdf86e9036e74ec5bf7b6cb2ac6822cf4b2a367c9b0cbf6a1f1259dfc3c4eb3cd1a18e41dd974b954c5e25a7bffd7ceeac1b236b23aa74d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E6F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7125.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit