a8b276ba585d8a9e091eb74497600d3998d6663490ee77f358c7d6c8f5b56d49

Analysis

max time kernel
149s
max time network
172s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9dc533b0084fffb6655586531480f32.html
Size

122KB
MD5

b9dc533b0084fffb6655586531480f32
SHA1

747ae52c73520485e36e1ddb2c3e54e1c4c98e5b
SHA256

a8b276ba585d8a9e091eb74497600d3998d6663490ee77f358c7d6c8f5b56d49
SHA512

5930149ae152f68d841f84ae667794e607e2144a01063d24dfd2731bb67d48b487453a19db29ee1631ae0ef0506e76c66978b45c28b838bb483de2f1a81976de
SSDEEP

1536:jujTK0YIeNqKGL+tt8Lyi/6b80fYSjRTAWE88se:YTK3IeNqKvttdkwvfYWRY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416013684"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302c8503e270da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E2A2D71-DCD5-11EE-95FD-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000c14b7e81feef4c9f3c179b5165f9e97c9f9071c798819d2cb9a4e46dd97d8137000000000e800000000200002000000054269c74b746cad2037be7ab192a5bbb20d9c1df698ed011b1c3832152b5baba2000000077d7825e0aa635f16d1f2e941ea9d73f233aaca30a077303d59e25e38a0d609b40000000b3970ff8959dfce96224af5280a5d3dc50e47b5f2c648e5fd2e72c7e46d0e6d4bbf191fccda850fc9bd8126872a7daf999fa6f7be5948b1a0dfa7d895ca16548	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000007842bef165fbee32dc7fa50ec82c1b82f6e8fe210fee41fb5653daa0a994eced000000000e8000000002000020000000fdcfb364979dc7095ff01beaab0ac8d7c8117d0c875dba130c7cd3a15fc0f72190000000c004a1167c811ebb5293bfeb35b22abd559b56ce4aa769e91d8c9d1cc279dd5eca7c06e2e947b6c98f4c0120a8779d67338602ad5867ad198e5acf33dfa72212a2f54e039c5d93ea0d5c77ed7d51ecade0fa244c1137b5d1743ba4666fcc6e043057dde6455603de63ca95bb55171e759607b635ea944f631d562f684052c40dbb3741f7f35326d87295dd94af9a8ffb4000000027178ae48f10a94be7c39bb060c665cd0c74451098dc3b3c8c1894e14e2f6eb6aeadc8016b8c15df909e7d7a74909aa8e23f51529c657149424a04cf02086ed0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2612	2848	iexplore.exe	28
PID 2848 wrote to memory of 2612	2848	iexplore.exe	28
PID 2848 wrote to memory of 2612	2848	iexplore.exe	28
PID 2848 wrote to memory of 2612	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9dc533b0084fffb6655586531480f32.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24c26814118136f4b7715d607e64936b

SHA1
d3cece7a047ad7394239566b264ed16bac29b018

SHA256
ef09f7f4959f49576425239eb3d8c0bdfaef7f226b3c9e7ca82a0230a66ede00

SHA512
28cdf77a1d733dece5c909b11d427e7fc2c485fa07bd68b0e0dedec9f74a53737ca0f501920aa45289276c41c202f8ae38425fe2ed5a0bb0dafbeeb1f6621a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe50eb996c3ae2f2bc7fe9511584c15

SHA1
8ca691dc584b0efb78803df4675b3495926f3c50

SHA256
7c73b80d77a5504d6307c80806974dd9ccec1ec9655c658abf4a7b792e476671

SHA512
5a4d792cae6da01f03d085b15f93135ecbbb19ea4b23074e87cdf1c63ba5a3147f78bdad022e7fae02e373c89b0ca14aa712d98e4aff88179b70d27cdb8c11c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec89164fc23de9abe3788029d141bb3f

SHA1
dcf0ff0e3394b6b46a2a0b9472cfcba567dbef7e

SHA256
ad0543576f8592ba0edca989d3aad20721f794100fb6806062bd154b84ae525f

SHA512
47f0aff933e6f6a6a6922adf06a7abf0ae0b2e19394e428eefba10ce5e71881e54b371c2ba6a424cadeee177f77d226c563527639993ed1088528bab499e568c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
009f0531d906677aecb74f1a0d1436b2

SHA1
9cb8e7f19e32c6ee37bedb90c300e7ffba5c9901

SHA256
5cec3df355b7bfb0d133746495979c259323fa76f197c392b007fa0d371fedee

SHA512
d8c0ed7747a389312ff5b58efe032af481fdaf304d62ba6e562520b5ea7ff3b8a26fe252d6c265dd9daec0d12610bf731a47a9e1cda1dc1d107cfb01773ef6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221549750385dc706764f85fd4782d39

SHA1
cca7f2e583941a8efb72c8530e397455a94b6a54

SHA256
cea0bed5e0a3d71a7c3bfd936d6dfeb19403597368498efa2e55d68ff752fcf0

SHA512
665a969a6dc71d43e49ea094b15386c990d88c513f56000fe4112360e11eba127520aac6419d0cdb94fec016f8fb73c7f834a3ad5de08e5e59ee8a45edb66d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f05b5b9b34991b35029ae8539829a0

SHA1
3595a3def7092d414ef5b8cd47203196057d9279

SHA256
d007e2443d19c1faabf5a9d862d271be66ddc280c3b188d23e9cc93d368d12b3

SHA512
df5f07b080c51a80f30b832d0e9091e181ed9cd5e0e92f85f17f2dbf6a8519ce535a389d335b9b24be6c2cb30afbad8c3ea4322755a56cc0cebfe717e8308a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c1e4d3a99c7a7adf1a0a7db7c0c7cd

SHA1
a5b63098cf7035f0e7c076c08b2f91f7902999d8

SHA256
cfd17b407feed02ae852b4a55b52975c05f2cb16a4ed670f3e8ac92e3eff0a1f

SHA512
d384fecf9f3c6e09184e6b6633da95ff56cde04d0141e58ebaabb6f486be296af8b8a499e221d4f6d4e02733c9c9c6c8d47bb3843ff7fdfd103471a5f13c27a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
395cd4588b054e233ca780ab4b987a4d

SHA1
ce3e6383f27bc3cce303956b51577a7263928cfe

SHA256
9ba4565c8dcd271aa52757090f0bc2edb02067d43ab1bb3ccf1a1dde89fb1d07

SHA512
cfe713c7edd36795a1c32e955754701ae2e95ca3ff229408ffe915f441c17d605c2146d2d6ac4908f9537d7f01088c633673a4f05627d9d622f5904d05874ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fb85e54da12b2d56b60f6be278d424

SHA1
176e1e447b5495a3a23f4bf25e0e09865c1a1c94

SHA256
2d77f9d058f597575217f47503a37a26d0780b9218fd985c7e0e5d20c2879600

SHA512
c5788c0f7583a0ddeb95588ccf91aa947ca7e26456e318011e5e1ae6dc58816f6830336ec1169caf8fca9ae488a136a528d0d4caac20ce4a60b8927774e57167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a24561f0a3bdfd948886b3e3efc860c0

SHA1
606529d5879a9e812b41e5562e1a0a36dbd41929

SHA256
cfa4e1be0c4ce51fa0aebe2e23fd40ab19557a139ace9937d4b4b5d8801ebff2

SHA512
558776ab5f638659085e6a8e71323805c77e4ef9040c9d5f7da7dfd62fb6b83560073ed959076cc46698793aa31877b51e50816b50db54b8ce1dfb40e86e27ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a6762406acc36987da01b7b4b56f1f7

SHA1
833769b8f1c6f3b05ae70b48689552496649fe28

SHA256
91f1c72c097fa51deecd4ba17fda0663a7fb7d4be0fae5f1be44138d255bd6aa

SHA512
4946346764980f329fd00576e26ba7a24ba690aed776a5ec3171a1623e90dd98cec504759f1498a7d033f1fd1de44da524974064b0cb4923c3a1f1e25209e74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac8292a5e549c010d61aa29e66759e41

SHA1
665bf2742afe848416ef70ce5b3e56770eee76a7

SHA256
b04a56152149d72995a5862e09406e0321dd3dea5c6d78b64bee5c2b608be567

SHA512
2ceb9323b21759a39364b5d334c9c98a62d421a3ddfcb9b2ba8f3a424e7a0d31712de44e058e9f50e7af229c803dc3f786e8482582061cbb36236560ca422d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd1f618e6079169f04d47c3fb647854

SHA1
c0a65745a55b8095e93252751cce0569af326a46

SHA256
9f49547a734a53e578a55a8580d6fba82a43b2f6456e0400fe458ddff9476fda

SHA512
5a03a08acdbbb3b2739b228e4396d8cff0339fd3b244a50c329c46d5a2da9c6cbf05a4fa7daddc8c32cc49d102d254c7ea999d27455894ed9f313fbdaaaa521d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790aca0f1158c7fd133526a7feb10d7f

SHA1
de7f194bfbbfe44da6ce99fa3f54c3eb7a4c2276

SHA256
fc4f7e1944804120db24562c51c33018d3fca2df27b371bb247b877c5c276c16

SHA512
d9640505d12f02f20de319970f03951a11d13cbd064385e781e67511db77d24421e968b01c8d0b12e1c6d31cbcf9566e6d8bc8d4136e9e27f6f9c1cdc31fbab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79d3aacf4faf71d16900facaaa4e5372

SHA1
195844f2f79a1068d84dba5e31cfcdef89e9c1df

SHA256
f93ac21bd2876b4e1026b52ba0a55e56708acbab840828e6cb5d9726d151f3d8

SHA512
cecfa7f369744f0f64a7f4096dce540fa087adcc1fdce86a5a993a6e91d05a300d5b497121372aaa5f4c8bf7b839b751f9443620fa545018a415d0419a1095a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48e5d1c1e08c806e4d7ef71fea223f3

SHA1
4546b519c2c41a82d47099633699b68a955a4545

SHA256
8dc08804d0f069342795a210056e523052aa82790c287d75211adb4fb978ace2

SHA512
3c6efb1c873f90a2a52b7e8b4e2ca89b1d09577b67604713c52391b5f9d64a68086127f8fcc321bdc5b910f714cbc07972b41e8440036611b5925137d20425e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9609.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9783.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A75.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit