e54c6de3258a151308756fda5990d230b095762eb49b0b4af9988f645b695f19

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b86fb205afa08945d3c068e34f126bf4.html
Size

2KB
MD5

b86fb205afa08945d3c068e34f126bf4
SHA1

daf7cb5b145a0799cd3269acf9b2879f9d3e88dc
SHA256

e54c6de3258a151308756fda5990d230b095762eb49b0b4af9988f645b695f19
SHA512

5455950b29cd07d40ce2170a81203edf1406d834255f13c76b08780d7d9eaec36e436564fc780d38af34ffc429491119d1ebc02704d23f5cb77221be99ec51e7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEFCBAB1-DC67-11EE-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07118d47470da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d2097b3abbe17b52c090c5fe2966b82003f77f71bd32a54ddf2b472a388ff7a7000000000e8000000002000020000000c4f9c3a7829039fee4de2dd29ff7000b562d9b3a8a72ce8c6497ae94c8e11ad5200000000b368f4330aa8f16a24c3c794b8571a99b6e0318405cf5a3ebbd99b527e2aae040000000c87551c9d579ba6ee6192175e57a512e1df503b6273176ffb15136440e805e5a47e69e6fa67339df11f4ab7bf02b0b9038d951cf4c2b6794eaf9c3369c6ebacd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415966845"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000025bf2e7db9ffe8bb70a6373b6b9fd43c32d2fe7446a48980581d428df566272c000000000e8000000002000020000000de4548b1405b1a7e177015424f914d197e06189c7def939f6c93bd1e2de4cfc590000000a74da9d2dc85ec473451efb324a50a980ace2250fad9ce022614663557b6e62c8f0cd02287e5879c91fefa8773b1bef750c9a5bbfead1fdb94bd021a50570e1a108cec017d97386a0067678fc5e8d571527529fbfc63a3eb228bd16bcf9bbec458a5eb2b010cb9c591cb27be39920a0063501097feaf60a0ad05d9d6571ea4b433e9f0295d234d8c3023b07082bc06a84000000047287399b41975dfc7783f23ce98ed21c1a00f90c42579714717adfc0295e0d9c977fc78cf60b236716f9b27646d3a4bc1a9d71ab5ed4e627f3d98b593e62b0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28
PID 2368 wrote to memory of 1408	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b86fb205afa08945d3c068e34f126bf4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bab3a4ec7e34bea0900f1f7fe713c2e6

SHA1
895d5138e0cb40cbc2f391da9ec095cf52222ea8

SHA256
26ed0361b0db2f529acd0b77bf84f557a5071b9b39e0aa21a4d212b759de070e

SHA512
db8f4aec9fcc1540acb8ce038bad03ddfaf0214eed08e77a6f53dfac32ddcecef6253c4e61b10e9029fdf5e67db85f608f9d5d568bbef268b34f7c3e378349f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f0352c7390872eecfe932e53c67b523

SHA1
d5e67e76ef7719453819e4916030c7e1d6e68655

SHA256
1a98ed42932aba6662cf19d50e8caaf2853f5f2fb52a621eded8a4c050aa451e

SHA512
90b280cbb555ad15d4e8f8d43a47ccbb9bf8a9b141da69883a90c1f8967bd3e20ff7bc543c9f3f4e5d02f1972a1ce9b3e98cccbe14b97b9939e38574a884b3eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
89a4609bef1bc95a23d8cc88e8717416

SHA1
4f1ab20cd8dc0ecd83d7ee4fb4d56075240188d6

SHA256
09d59ce6083bc4d2781699bf53d17e488c6d8205b19e5bed82da718540c216a0

SHA512
342c58fe5b9d18479331e6611935a4d4f694e44eda678ef42dc3e96c8f2bf53f3aa790ec706e7c232c0a89c3cbba6a27343de6e609fb02a20939ade2702263e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3bd40e2f04e47a84b30afb6ed13d693b

SHA1
79ce154dd4817a0f28ecfd764fc4e4c2b8bf9afc

SHA256
89eefaee0bf8522f00768b117e08328e9117d80a6efca3464a3976ad6f45f25d

SHA512
1fcc8e742292ab22fd5152a889508d4b6488169d357907f2c081700d9a86152e0aefbe4ef8270ae60ea1538b5245eb3ba2f9712c8d476b5fe6a03fbcf58ca3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7cb6f9227c6d978363b6d0757c4dcfba

SHA1
ddc7a1e06e90f8be41fecbd55ed73cdbfe73f5a6

SHA256
51430412b5a5e258ea54339845332e0802a23b0ab093939c4c0eeeeb7690453a

SHA512
fd169606d4e9d6514fe2d79321184770c42b364a50d0dd80e850de04ca9d35049565d660ecb6a3a5fc0eefefcaf903318fb0fc02e7865d14ead4fac82ae0a753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cab32ba2af105ccdd10a79fc495cdb72

SHA1
70617e2ac800f44874c8151b9519566d831de963

SHA256
08ea0c13f2c4cf77cd1c422213e4047d00753c9d12805381f7a6df8cfb0de94c

SHA512
72077aef39094ced5170dd001aca48a199c0f04a4086a28e2045968f074969068c1833e5eb1a1c98b3d3bbb5fea5d140d1daba812020fd0829150db38ade53e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
95e9a1cb12cbcca7516e4606e0a5ccf4

SHA1
c91e553d118abf3241d289f36a3d0abdd56cd27b

SHA256
84f9b3de1bdfdba05bba2446dc8bb1f4e5375c3f37cca26ef56036aed99f0e0f

SHA512
dcf4c3f53f19b95f367f4e00f4a0f21fc5d0acb69a38b0cc4baa011e07361777bc2c63a1aa19b160cd7fa807ae8e093d4461465f42db3d9857b62853ce5e7b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f2e9fbe6ad936985149f1066fe51b3b2

SHA1
5abc05a349ed3db044ad547e4bc32b200a49d639

SHA256
da555f934608cf737debc30ebf1f76c86541e5198d7a76c51dd9ef90b712b5b3

SHA512
538e0b086a5806f18617118b18b1224f424877de23f73a73a9e30d445731775b334f56d2cd9a66f4129da59eca4dd2698854b2617fa3ceccb418fa164be04a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d9f0438569a1d7f6bc7d8d749913a020

SHA1
5d6be6ecc136555a166603f5f31b81ea44ed42ed

SHA256
5eb0caac6f30fbe446e0d6a092301e8154f9e1e98dc89485ac943df015c2352c

SHA512
06de9b90f5271c1c3739adec9ed2ace70f5a1dd0c8d93f6cf7cf7f3e445747a4050de1891c9c867eb3fdf950fc0a92c91fbe6d8be20e5e29920e200ada8eb17b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
815e2f3a322de806d527183a7fce2cea

SHA1
a8bc9aef21c862a0621cdb9e2f412192999a8bfd

SHA256
8aeddda279e33e7a6932fb4bef6c2c6b9ae25bb4fcb52d13be441ab143ab4fff

SHA512
9004eebb8af22c434ccc5484eff711aaec32614a02816e39200eed4b0c845cd8e27120506352594e2dde4156e23ed545d04d68f90d565f1b295a8efb2a2a609e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3cecceb0790c7a9148b7f5b9d8f18723

SHA1
1a0b5ab553e14c122f3a0be97ed497ffb32a080c

SHA256
33eb3b3073bc5e6a854b741f49c67931846d51c5a468697e7781d5418082c5a9

SHA512
c0829212b8d6248082db406665024b285c59438a5fceaf67dc02e7d8eb147f7c98c8e38d924d8e054dd6d2b7d4f061d219998d7560a20e3a269e12da56f919a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f9fb6bcff6a04cc20312fe24ab54668a

SHA1
72224ba167d1b686e5592e5dab0fb759284757c4

SHA256
d96f16e15f7a58a1f300b88d93cf70a0500104a74ab9d1625aa78f553c6b1a5d

SHA512
3e333668f0061502c0906aa6ae17f34ee88592c44a94011b905db092f0690b9ad5e70e550acdf32559632425a17148baa00ac67a8c5b153912e02241eebbb012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
16d368ee679808360bfe895533015848

SHA1
1bdf12c9212baeb7f2dbb0ccc809f7d8726fa20d

SHA256
a6633c2f4b52cb9b6215d7d6a16427335bb9ae16e364ab9c35d84dd6302eea2c

SHA512
ea1b1223355972c8fd56518df59ed02809ef36a1a11b2ba6996ae47a5e60672f0cbb4b51b360e931001b34418acbeec0c0dde7ff0a602dfa24c317f107af7ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31D2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit