6c962cdd0bc26483a54570fc50f92a85dce5212b09c45d35f1b9ea2e110c0f8b

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8a1d8db1c72174ad70fccdb6ea41165.html
Size

31KB
MD5

b8a1d8db1c72174ad70fccdb6ea41165
SHA1

63ff1e7c895b6214e6f33c9ec52cca3ea1f5e005
SHA256

6c962cdd0bc26483a54570fc50f92a85dce5212b09c45d35f1b9ea2e110c0f8b
SHA512

e3afa7cf181fa9df96f7fbcb5f20e639897b5039cd26b8a7138f5ec680dfbbdca02f1a6263ad1c40fbf026f79fb15f843ac9f7e458e705f6111424ae01131be8
SSDEEP

192:uwj3Tb5nJmK0nQjxn5Q/tnQie4NnE3InQOkEntHDnQTbnBnQmSVxa6q9AP2Ed+XR:DQ/ubqxa6qg2E6BC0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1546EF31-DC76-11EE-9B4A-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000b51fe1df969aa6c68e3d5d01b1817b33040e2e183b691281cef6487d0e9b2159000000000e8000000002000020000000fb02358ee68a452643145d5a3efb5388af44ce4b967bcbf243a932672b21731620000000b1865845076cad9312786bcafd7d8bd6bfa4787f13800bd4477069762a72bb9240000000ee63d71f2439e0400ecb86c4c37a43e56230da3bf14d46d336895eb1f3b4973e4b0f34d6eddfaa375bb92d5f63f9bd9c7e612955d2969e14094d285a8e973b0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000867345e6e5b60ebe3c5f250d1c90e583be9980bc8a51a38e501253f9a820cf55000000000e80000000020000200000004fde9437d63b8f798c1ea6e0e32b37b70ca31faf00346b8ff13d235315a8af5b900000001099f239ba51acdbb187e81aceebaca996b8ff13f7552de79aafefe02a6ae5cf80ae59476a7f5d19ab23c8ea8f8547d32993d57a7c8c4d8caef2a67590d6a9260567297cf8eb9859a4075028d4798ae227f05b2aac4fa6772c3c94e5eeb1eab84f43e88c200d81b7706f9f1c7b3cf44500b173de8956db52271fce2ed92cce5d5aa46ee8f566db552516ee040f733ca140000000ae668b0effb0f25f4f79f4931542b4399905f5c190485577b98e1ea76679212de729b5d990bcc5c694a581c693629170681fc459b95a5bd2a6f72564401d7b32	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bbafec8270da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415972902"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2568	2292	iexplore.exe	28
PID 2292 wrote to memory of 2568	2292	iexplore.exe	28
PID 2292 wrote to memory of 2568	2292	iexplore.exe	28
PID 2292 wrote to memory of 2568	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8a1d8db1c72174ad70fccdb6ea41165.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
877d2b09f8a08476376259b1d3327532

SHA1
f4a0f157d91b5ef02cd2c99e6e9f0177f2bbae06

SHA256
61f2371de9a2030ad695d2f2cf61779a93d4c34fb66a955fa46fd39ba42d8430

SHA512
bc5860d6afbd5ca3b42228982d19d28f0ba5b588b07e45df9d5402cb8880b038cc18e89f20e159030c93a9636fc6de99b04066b9f2328d22af1d68acf9b71d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
911a1d2566ad81c407cdb1c3a33fb460

SHA1
6fbf9c4a44f6b5956e38adefbdbcaac24fb9d9bc

SHA256
03cba0f43bfe1f191fb54346811f8d863f38b9e71e77f91d8238a632321a46fd

SHA512
84fe054e0762928c12742b9b4719d36c090a08004218a022f418bf833d6a27df18038d61266ef480ad15ad285c4cb5f51e47d71acbdb8f96b34d91ce1fcf2632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3ed57c21b71a26287f493098ad66da

SHA1
2049d9d60c0a523e9811d42a4a8731d2c164696b

SHA256
bc29b1e763e636e5ec9cd2eed39f544e62da6b027359504a6a2748263b2cd64a

SHA512
1079061d1abbf3095b9aa1903fd1f37140d24f9ed048de9784f907eba3f43b42ea3ca4236fdc4b886295cbb88a35f590e8f406adc8542e957036f5d77b70b319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c06d6aa7579d56489bb75acc9013391

SHA1
261ad02f5fa02828c73915c7ea19da4520cc353d

SHA256
e3b9a6d53561f8804be31725cf2b7b244092eba0dd509c2ef697f47c5b4ba022

SHA512
a3d94868f0768e41c60c17408972c41bae0e3d3a1ad61d9dbb4f6d2c9edb1e16adf56d3f29ca6921e74b17d2fa4398d4a1254e2f9d9e27ee36dda861266343bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b4e224a835bb8f20a588a1711a10796

SHA1
4553d337c25e11d3d732bba1bca73a18b2380f38

SHA256
b5b17d2a9c4e2d3365e8cdfdc67a7ef0d8c8a01ce1a573fa8d4cc5caecf2d287

SHA512
d30e1c7d8debf4e154d5522cce2a1e588e06be354a6d654ded12b1df20f0d5ffb21c1c9a70677e7053c2ad9a80009d824970895fb54be1fa80459f4d5e3d7221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb7960e529ca27ccc7bc91942ab985b

SHA1
c6bc57cc0842303aeaa9c81ef88367627397e388

SHA256
9c78db1f32c2a88857da901cf54942b3ec49f7f4dc7f0f99db827dca83a0ebe7

SHA512
4b1c1cc33443363a806bee969a2ef870a3948e4c8279318c99bc7fb15dda4a66e60036a5e68e60abb13d9753bdb39db6e0e28a130db2392450ce93d997f91f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5ce411ad3f65bffcaf60b2d1c687ca

SHA1
823268bc1c7fdc5ac5caad3faf00fc4b0a29b512

SHA256
092ac2429f9ec0dbd8f62af6ee6e392aac912518bdec9a756279198049423a9e

SHA512
27da7d57c14e6e5e8deb6445d0574618811d7810498a15c9b2c467ee73b06975a141d8e91f6e74da6d06febc5087189301d1b2939390d2f092b9835d2a2d2fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4ec00b374e63fe2f0e213461620ed80

SHA1
2716f00e7cc248ca8385aa2f094a36a379155c7c

SHA256
d336690619761fd02e3b3177574805e89a34b2fd8624426a111ce6433cf7b1f8

SHA512
58fc9e2c0a67e141f40832ee04cf6f92e2bef27d2cffd6d483289f7ae01ea52b1b56bac1b3ccb131ae77b3c2b937eaf16c9c6146b72be7e31455c3eb0243924a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d2087b8168c0f2c95424fac0ca7b1a9

SHA1
2d177b9e1b218912125146e9a03cd07bdd3cc9c3

SHA256
13c0f7a6a0c764f58b257a4777cac97fa03a3f6462aadcdd03f651b7ead71f00

SHA512
d26448f4be8ca941a7d359bd26cf20c184ed37aa8e5b01faf45f0c5f4e7376536e0bc8a63c979ae85c51920124511677ffddc63e1bbbdd96f5ce6cf5294c0465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff53df6816e925e37a1249a9d3c0828

SHA1
fb7fba923942b4ecd6987fa58c9951477db3ec92

SHA256
c5643f57c42102634955dfdb87ce54e5c2e43ea226f2df373e7ebf1421823304

SHA512
3aa7f027be238f0defdde1f1d9ca57e8f47e6bf4975d14046b24ba5cf2c2d6c79afdbcae4cf84545377da3e85eb62362f125b435945b5acd498d78d6927187a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a702cfdc9911d335ba8d2b7ddf2ab5a

SHA1
40ea3cae373eb2b1c0cb5541f221d96cd357da3d

SHA256
073632e0259cc7140c6dd181f46c9d0df8ea9698eb7f2b69e5d1a3bb50c21f72

SHA512
a86b41e5b1da6a3c76205882e15ce84201ad392bae35b4e2d1db994b52920a7a01e53ac2e1e1c0a8320b639375fd2fb5bf4cbf4f47a3c5feb087619a14dd52e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA94.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1AD.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit