21324236cea9893d16558c57105f3a796469625a1d8e969132c5c50dd8cafca1

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8a8c415873b61b8d7fe8789c1b14fd8.html
Size

25KB
MD5

b8a8c415873b61b8d7fe8789c1b14fd8
SHA1

b9af0cd1b9c57faf07a5e1efff9727efd321533c
SHA256

21324236cea9893d16558c57105f3a796469625a1d8e969132c5c50dd8cafca1
SHA512

e46e4b26f7623bc599054c60f47da2d1ba0bfba973b13e1b09eb1a1a87721354b774c12eb460869181e7fd2663993627aae5bde0c5c374ee804c1de5bbede8c5
SSDEEP

384:8dg2H8oJ67GwzfkVqOUtxKTeBfKTpjt3L2XaRLTLgWQQ/U4yhoy7jfIWrYc51IlP:Wg2HlE7/ltITe0j7YOTNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59039001-DC78-11EE-BE09-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000005502178bb0ac5d2184f4138a7271f2cc87ec05ae90fbebe1c54e3e139c75535b000000000e8000000002000020000000baf3842979b3733b1dca37cb5376109609cbd04ce99f03f11bfb5a010d60b0212000000030b768e7e85e6a14d3ed772a4ccd64c868710c2167293e7bb09c1cb568b2fe5440000000b1a710c3a71c817b101554a14ee770dd185067219e9de4e4461302c58335777ebc05d618c8a78f1913cd1fb18470450edb1259a6c418e67c82c7d3a7c4abacc8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000059ea295e0b771981e90b31adad1c4d3828eb3a5416e0c8d45adbb0b4074f630e000000000e8000000002000020000000ef350f8d7c3bfa5f35bbbb16885d9772a9191c87edc6f17f044a6b77d0da2c8b90000000f8cb6842818652309d179ff4880fb277886e6ba65dac74022384107f541a378131cdad66823288056f06bd2f69a0569f7f0930b420b2ebcb6d77144f1ea4917f48ecc9153dc7a30df684886eb7d7e33fa64c6b8fdd01aa0e20a620aac073519dab98f0fb676dd95a0838cf46fa2395f29555cc443e1e80113dfc977b1dd3bff54449401280a41aac96432f1d6136311040000000dbcde0f16b92fca7320f4df68e50f547d21bf13aa4e3b0c3c1d5fbde5e1e74d6e0f360f6037a6c7db0ae04d257b76ac83cf3c7b3599b24ffb7540adfab1a8148	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b016702e8570da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415973876"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1184	iexplore.exe
1184	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2680	1184	iexplore.exe	28
PID 1184 wrote to memory of 2680	1184	iexplore.exe	28
PID 1184 wrote to memory of 2680	1184	iexplore.exe	28
PID 1184 wrote to memory of 2680	1184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8a8c415873b61b8d7fe8789c1b14fd8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a4eea834a523d1d3251002d95c14fa1

SHA1
707b5a44cf1e21875021d6e1990fd0a56f34c777

SHA256
324b578c2493c68e862935a7f9e860733a9703a076c621f9c8d91c8952bae2c2

SHA512
1e6e026f87b7736dd5f9bceb12bf4b3105371b75aa0c42131dbbecd69c866ee6a481bdbb3020ca3e6b22b05f50e59119d78ec836cb56ec399116a2233b608280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
908cb94f2e34e1f838716cce307357f9

SHA1
d085bb45a882e1198e84a0f2919a42c017fce915

SHA256
e8da28f1bc5b684c125d00c76c909621c3324f5ca9e4a7190f85c9115052575e

SHA512
3b12f422f2cb630d14a1d010d4b29a35e1af94ff0d6de392fbef579e27394367e7a0f49d730743c20d21d5fbe624ea376d18906ce4f96a56c9fe122ca710d32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744c9dab1977dd359cdc81f82fc50559

SHA1
0671af18601c86392be63ca8fc2c80c38877d9bb

SHA256
867c7a9b0ab0f7830985125f9858e6278a32ae7f17a3469d32628dd86e4046c1

SHA512
029bebd5ea4ec52a053882f757281fea5bb1f9885b593fa4f5509de5e7f9dbbb31f2d196b9cb520fd6c6aa7e18cce534cb8aa471a62cf8b315553a7c83b85c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1206a142a42c6abf6795c923c1a0e7ac

SHA1
d4bbeb4188e2275c69007551e0a5768e9a1acf7d

SHA256
e1988b676d0d7d0b43db7428e44dc1190385b096d6e763d016aec2e250bca38c

SHA512
afc8f9d271c5ec737a80b0779bd88d60f9053c73b252fa66c61e6a522b4e2f77c8b8106bfa76e6df8ab5a22a3e61a72a795e7cb49f8207ae3cf17ea8f35c8819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76833f5c107607be173e30186a43afe8

SHA1
f1dd29c04c686e86b1c5bebf1411dfeb16b4ceb0

SHA256
f36503639ceceefe613f844433b525e53c2c3f5db4f3e836d4d7582b331f2951

SHA512
213f9d95a9ab092d727d7903a424556e61ba4d3c5c6790875a7d712d2d7c21cfdb9930359dd58b8d88b70feebcf2d3cb60cd1b2e9765024393517d44e10106b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34aaff6641f0ecd06f07455408d51bf3

SHA1
0eb2c92b35539baf2e367111f96094134b40ea83

SHA256
70ca7210924b55ffae490f0678e666e02f03736aa8190e26777c63ff1c9960e4

SHA512
bd44e4708d8d9a57bbf96dd7376011a3d9592b7e63f6eeed58afff94fd466eaaa1d700b5c742f075d859f797cbdd057d90524e3ffa2501a26ac62ebdcbf5bbe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df0dcc857cda49000793ed769d5ff533

SHA1
ebec3f3f6ef9d60bd79b167a0495b3e9e2328671

SHA256
0b2c329c52ed1f45d04da1a8c8aae434e71408bae92018d8a3a437026b7dd03f

SHA512
ebc9cca0edd6349d8a859493041ded55628cb6e439969a96dade0a11a4f98de10b866f3d6de7f322c026d50ee4457ede919d04854cc9daf5e17861995054d70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baadbc36d41fb07854a77abe0b90eb4c

SHA1
54af24b39d50531ce48a38b77bfebc74f5522371

SHA256
75475f4a841aea598fbed111e38f7d118e9d5a2535e4677d36970ea3d01d82d7

SHA512
4d342a8f9d8c584b8df182f42dcf1770781237feb7bc0c61af5ea81eb32b9ff0ef301c650983c1cf39df506ce8942379aa4c21b6d77b49595895392aedc5bf35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81dd0c90f85fb3ea120028a8866e234a

SHA1
f176e547f115176bcae1736b068ba0293f3a4397

SHA256
a711b584bdd00c81365d82384396558b3be61edd6bcfd30718fd557cc53491bb

SHA512
977ac7d88cc48817e5bf4d54d6e7f4018ae266852979a6509fb84ac3db6fef292c543bd34a01d19a3e5d2fef1a2db2b0d24fc97f85bc3d147a9d138dfcad4ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
306320cf9f6f8e6822578f6f7ebd6611

SHA1
0bb5bd0548198b33e76a84996eb9b271c60ad62d

SHA256
a3d803fc70752a200aade9d30faa3dc5d9882b1a30fa6ae0241b81c8211d193f

SHA512
2d1c5a7f992382436858b567fe572d827bc9c6797c20a3a3065d3ba78169f1fec9d38315f67c8c67fabd8a3b4ad7f8d1214fb7229c74fa199dd501d767a67565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fcd7478f12ccd9ea2bad6b251b37a4

SHA1
725385f90f3487ad3ab216d923c271b912a053b3

SHA256
b497ba5afcd6abf12dd9f56b45aef58579003b07e42d789c0c5465f07a5ffc92

SHA512
f59aaa8ef6d1b1f94091a476b49e36fa8e51832e32cedbcf6cb834b85cf60237bc4ba384d2904526c6a44673e372861da783bbd27b33717fed8810f1dab1c487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d3d023ee328468d1ae9e46c237379b

SHA1
58f47bc65b2e34728215eee3c597476113606df9

SHA256
e7df4a835621612a4bd825d03eceb06e48bd2320bcc2b8d136ace2826d061166

SHA512
979948c7362359731dccb7db6bc8e926e16111add3a432b855a162e47eb00b3c3ee5c74276e6be1d187514f8218af40b3b010e913b57cf384a371c4c12ab9365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb52f74adb79b269c253a88cf2d3e45

SHA1
d6098a2c47e3cf31e6111473bec65314966bc901

SHA256
c3e1f87b1a4f19097cd244a108f5afcc72655d7dd5c6e03c366be0ec0b43e0c8

SHA512
41c3a550a7bec61cb833b618c7ff270d896e8af8b5362d5fbdc2c578f4beb3b343244b65dbe670767ac0ebdd6e1d40d12b382f9865a86e6ab5446af45014966a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar832C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit