521cf55c4e04bd1e980560558288fce8c6fcd66d36e54e3686150eac25ce3f08

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b92527917cb19c2b88cdea46ca637aad.html
Size

3KB
MD5

b92527917cb19c2b88cdea46ca637aad
SHA1

0f97b7cad896101c925499af12bd38032e8e12fa
SHA256

521cf55c4e04bd1e980560558288fce8c6fcd66d36e54e3686150eac25ce3f08
SHA512

c356844b8047c508276bafe6244be0db39c0f68ce2a7b7d0cc45d0b0d3b58185ffb7452a0f02b16040870ac84deb734b9797e1b94095bd0e0e0e1243986cf623

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fac499ac70da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415990799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3FDA9A1-DC9F-11EE-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009676407164a5c8e352f0dc85aec45cb9fb17436f88e7bd889ca7950b5a8d79ad000000000e80000000020000200000008c3dd5c7a8196793ad427be625d8bcf6ca329cb59df9ab222d2ec7d03163c6c5200000005591c8a341a5fc1adcff5871c0ca324783970cd36671b78fa412afe308cef98e400000002792eeba5aeeaff369f762d60be479c4e1493dacfb5f4ea1d353de0f6be78e0d8bcc710a3373afca90dc550d9fdfa7ab9ea18eee27d83cabab4d725c394f2b3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bed7e17e5a95f4ea975844f27101066a286abc153e1e3cfb5be7c09677aaa152000000000e80000000020000200000007cb9cddddf3e97e8a3278e1914c97c0b90cf056ebbfa43aebae44f38146b8299900000003f12a2e4548ec56f231da3544e3371dcac0c50f8579c11c2b27ed30cc777fb37a21f8c1096c15de2f4f0865d3e33bf2229ad4b2978548506fa4509074bd57bc6fb5124c86f079619c913e5d6b2052dedfa7fd679e445b4bd6dd4c637e59a06e4bc03cb96afc21e9060b374b86906407bfdd3ab5ae8c4cd612f0db3c866e93ca06d0324536d27ee6b6fc83424979a4c8340000000c6f464dd8ba316316aa0112cae8294c569e5564ee987f2f07aff76a0f186e13cf25f2286ed7db73e1152c2d7873c59464c90a336d5184594cf9de6025648bb86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b92527917cb19c2b88cdea46ca637aad.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac2f78b64213834d19f9f4cfb270b2b

SHA1
28f0f0ed8e27224d48b9f0ab6d79af51e0fdae94

SHA256
326ea8b6324fc3fba34947807d1b3a3d05b34e923cefdd40a84162a53dadf50e

SHA512
57ee38479cea8bcb2b4043e8d4953c32d4200ac883f5823ac4a8c8e6daf115ac354dd0cc0b8a989cdcf3359a537e9bbd5a6178a56a15aca4f57204efbdb97716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf34a15959f881398c7f70d51d55303

SHA1
31d571c5ebc31e3f40b261ed4f72be62492eb38f

SHA256
bc68c25663f837595c6f2bfafabd42150e061ba3d46efa14241ecc134d1b599e

SHA512
4a0790083a395f64f19e696810e6ca2610cdf2ef0ef4b599ae1798795efaa5c2f1d76d724c9f6e01bd64457cdceb6892003f0a751ea06161bf362696d90f2dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c43b3d7fc02eb219e82f56a86a82381

SHA1
12a28d5ca776268d811a14c8e8c84bc3495dae8b

SHA256
15f85794c26593e910a88febe7085044cca98e9aaeb5a99c5e67c470eb17ef5f

SHA512
2f82a91c219f45953f4fcc6afd22ab8ffde4be13e34a20582cf020c7ca29d85f3a97b592382a046c8240f7c0f94ecf4ee562e44a970a327016e3837890e880fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531820a7f5557b3f58f800fef211fa95

SHA1
fa8c42680e18fca3d0f7b28010e7bbbfc36881af

SHA256
44d708a95603c333102df0d8114597934cbed6c0027bcfc4fbccb0f696e64396

SHA512
8024bcbfba69bae6c71749c9bf4efb58f4fb7dd5bf2f3171b7352df5f15548866b7ad6105351598532df1d2753e2da8ab5883cb141b2763dbe4d6a7c679db153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ce89fdb61d215b6b5614550b055808b

SHA1
74988c46ae581d604809d1b21bb30f3fd82eee14

SHA256
ffc57248417ed957de12c33ed66219fe4a96d5cd6875021b5bc539c513616e70

SHA512
c3080d5b9cc4937622d4b603e3b897622bdd5da54ec038146835a760b786ea0b532a7bb4c7075fb77e4b128fa3319daf7224e7e42f6fc5d8d8a2d643bb897c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e26c696c18b45f9310c2a8ca702414c

SHA1
9bd445f2cbe1bdc64f3a2cd174c9719262c40d90

SHA256
937a774e9f38bf9c0d4db8ad995b4c6d3f7779f9b2ea9cdf496a7572b93b34c7

SHA512
34fe20aa0e307771150d0d625497cbfcc679c98d9ef925f33d7a94c6a1c09bc5f8a8645f007edba3ab509aab1052f53e0c80c377a0996b3df102b11b2a36f13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a398b2f84c61fa9576adbd1632fe3fec

SHA1
7755164451b72f31335b260832510fc6244d3b3b

SHA256
373503b8325e23d19e8f4d7d57c3fd760ee59071e5938a6eefd80ccf84f55333

SHA512
9084339667302e347240ea9c657f2f26e3a1086b50b0b55bb84414a5d4c7880cfdf722df4035e88baa231b84df4f635d206d196df672026c253cbe3b257d1d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f43059279b4fadf2b7075bc91209483

SHA1
d97123fb9a21f2ba37ccfaf142a92cff0a353deb

SHA256
bde08614dfb7786a840228af932136ecb7d2a951d15b208d5734e117ae7aef54

SHA512
5245e00a6bbd03a91978d892a1d7858bd0b93404a3265f7d4caba61bea68e38d5e3bea0544d4a377139e460bced4797ef0aca84660dea700afc68c033a9ed60f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf21bf5914c7f75949364b38fd8df15

SHA1
d473f491c7155f1348266efe7dbb6d59c89f37ec

SHA256
39b2078739393dcf05350d43e91f06e9268a35a64dbc4fa7326d1023e1d08da0

SHA512
5d97283d236d31b8922bcf4d498e44292eb3a1d065f2076c3ff8f2a721d108b06422adc4402a8a92bfb9d1917112879a447b85a64fcd38e2f9167f882f91bd25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c5696a2179af59b6c4c53a397e79f8

SHA1
1a4d0430bae6c6ce1863e35fbf3359ac677ef764

SHA256
9fcd2bc962935c43fe52b32265e0d07b5b5f88e6de5bdc2e509973c6f59f9a32

SHA512
820d9bdfe6cec7805180acae341151ba2c2af9ede11a0fcbfd428328903217d080daae700e50ac2780d8e84a09bb7b515db229826ce95a55ae9fc9c6fb8725af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291103e3e0b152ac5487a35f01b8a64b

SHA1
c262116ba3462761104f55805f8ad554a515c020

SHA256
9d1e5c62d1210a882afb2e6bfe7b9a1552afe46df4e613554f87fd0f06f02887

SHA512
244e24ac4df57094502d37a5cc843f0fea2634b159b50787455860d933d487add74a5af831bc27b28ff41d7cf529a5a619d438d90f9c5ca7801f3cd14f3b4232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
942b68a42b327e57ba1f66d0920780a9

SHA1
4d15e3ee028fffdf2d4674a11b770c4a8ea7234e

SHA256
43480d72b02292e90a944ffc25da8aa4fffff828c169f4e05ac3f026bb2b303e

SHA512
a2823e23b7cfd2ac1eb6c3af8938f3bf624339d8f849af4c55f2518a9781d2685bbbe594b086f62e97bcacf307cc6b5f68523d58be8f89ffd53eecdd3e44c775

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEF7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0D3.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit