a98dd6c5d225e8f7db96d0442929edbea55a835f71599d88fa5883eecffaec18

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b954c56f90ef1cbdddbec2b0912f03f2.html
Size

13KB
MD5

b954c56f90ef1cbdddbec2b0912f03f2
SHA1

b013fbd6e40c5c6119d0f0f3d2981bbe4384f9b0
SHA256

a98dd6c5d225e8f7db96d0442929edbea55a835f71599d88fa5883eecffaec18
SHA512

44f17d6792f1b48bfb3b33f7aab2c145a2e8824632ed0cf362bf115e8b3134644e457fdc77d637ffda0eb4b47b23ac7881f55937c3022ec2864ea8485bf59a24
SSDEEP

192:PCmLlivdf67X2Z427qyLz/IVudrgwKZ2MnPG6TBQ4fg51GvXr/TU:6mLliv87GyMOuWj/BM1UXr/TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0045ea9ba70da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415996831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000005df7cb979425a029c525cf4c13a14fa7446b2d1191dc2e0136b22a387762dcc2000000000e8000000002000020000000707e4d7c641ab4436d1b844039b2c50b67c63e9bb5826c959333db4bdadc612d20000000c5819115dd46c6488ea8e9ee9eb6fa95cce0e5c2f1dc25a728b315dde444697a4000000002528d2e60397791d25d0741e30c48ea4991b04fd4ec0fff8f15d0619ce4e33481c8d3ae2d31ea3705cf1573dcffda1896b3968868fbdd24ca8ee6cb13219676	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D30B8301-DCAD-11EE-8547-E6D98B7EB028} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000012f2718ba79b702b14e7f2881c135941b38856e24103e742937ac431fb71a476000000000e80000000020000200000002fd9b6266b729f76e6621e96e80040c0913f3c4a877129f312162f0fd5d3593b90000000224522eceedb96b7aaf42343452db8e1b6bc86fecf1c794bc5a06d9b366417a64dc365dfbbcce38e3c632337feb990a31856db1779640287c286db620b129f0f16d3fec496a95ba3ddc3830ada19a155343af5e991a169f3b29eeeb4fc5121595300f414abac3b16881c31770d1b85d8c5fc4127778dd3fe52e499637697f6f969715b3e3f68e0100d7e65ca9ae7d71d400000002581be613a53b5dbfc993020c01da3b797a9d2dec75019b4244c816982f850f4cbfe09d5e0724bca3e13ce6f4bde3f71cdf6da7d193d80227e11bd82948849be	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2504	2704	iexplore.exe	28
PID 2704 wrote to memory of 2504	2704	iexplore.exe	28
PID 2704 wrote to memory of 2504	2704	iexplore.exe	28
PID 2704 wrote to memory of 2504	2704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b954c56f90ef1cbdddbec2b0912f03f2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
078f8bd7b86f6e4cc07c3e99c9f55cf3

SHA1
1e667461e638ee768323167ff7a06ab0684909e3

SHA256
28f2d048735e7b64b94b1c7c60a3b75804d9ffd6ca12adde667cb6f107c3e9a9

SHA512
71674a9387d9a3a15025d90842aa1725877ca9684205b87194d41696f187a7785e728cb07fc239b0a437fba6935d736c3924afcfe58eb5dbcb57fde7625c5f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d10047b9a5c8e1e4bba1080f919ec780

SHA1
168a65b35fd6942f2b528cdd38997e9ebe6711f2

SHA256
d9081adde240e96ec414b8258f75c1358703bfb02d53eedf0ec6cdffa1d881ce

SHA512
4f9c55e63e663b0a09c1ada0d9e24ed7ce86fd422fa17284fb1df5ad72f8b2d108e5c6817c33754ef25bddec0fd46825a4f644727861a99800093616fa8373e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c1539474630f2d43d880f7681fe6cc

SHA1
9ded769eb51213844df176cec287aab684201adf

SHA256
ab45e2482808438c5c2e922859f7477ed2601ef58c22fb2a2b2495155160db3f

SHA512
687b1be4280e74b621d5be9b6d6718ab08cd0904954682ebb34ea7e447af3ef031300b917e14715ad55a3f334d2252fbbe119758e14e5aa1a81aa44d416e22b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ebe80b0c8c2d96d7869729ed4e5bd3b

SHA1
68bb4aa82259ab09416bfe80dbafabd862949b8a

SHA256
5526e21c941aa68a0af6f26b72144d42daa7f40734e489d6b9c59634e017f321

SHA512
6d4acaaef2e28a642c1f61e8f90ff439e8031746dfc63bd7010ed2746aab3ec914e1808d857feac7ee05f41ee23e09707241293617f4dcec96cfd7a7a9525fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791b88b5f8166e386d483e5c9da99d93

SHA1
de404cde0112f7fb491e040a75ba554f55ffed71

SHA256
e100fbabc506469dee9e115454697cd2451ff5d9a79366eda432da6a8f47cb83

SHA512
d2ece94f6fdfcc72b67ceb958c807d346aaed39c0cbab6449739b9442eaef0344441a2aa1efa6d9cb20f8c11ba23b59220fadb449d2c06954e92c5924706555e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cf2d041fa514f7fdac30780d14392fe

SHA1
e29e4043a274f90a789b32982f39b01f7c34dfd8

SHA256
1b08a63c4ee79e974fe06496b225dd0223f0cf6794310065783caafbfa222d64

SHA512
23ff89c0617b05cae072caa76d43c31512b87f00fe65621f23f757911f4e9e3292c71bacd49dabdf502296a509168091207f6e379034e09d56813654802106e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b41067a4c3a4f67fb98c9e84b1613cbe

SHA1
cc445b01e14adec6f621c6187db9955f9eed398c

SHA256
2ef47b7d0e1a0a208ed4930d42751921c77af5d9fe49ea8017654d9b999d9919

SHA512
de56c985ce10f39aa373c13f5cc0b3e7793bb52d28d4c2af0a1fcda4dfa1dc230a031199037b0bf4910c3fffe4a0c59c2b3a67bd801d5725c03a5716d5d822be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4de798867569023359871233a97a38b9

SHA1
0a19af6783051716d14a87724ace2bc434875c52

SHA256
162a176ffd675e3fc0de6e91b2746ea3f61fe104c5d96c6fc2fd83ed4f8323a6

SHA512
36cd2af0a3d872c226cb27369d4df28ed7e01ded90c0afeefb00ffe60717ac9ac14d9a46226751a17b957ed2a4b91f0125a86c1271fcb9dee664ad6dee46ccb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d78c7ad6068d256c4543e71a62b7b0d7

SHA1
6a48350d39194c0f449951f58347c03fafa50e26

SHA256
0d839113810f1cc9dbea3226467a6d5d063254838aa0ac66ec202fa89036e9ee

SHA512
d7e8f62cda628a96d021415accc983b3aec97d00b40d58e6ae5cd6ad11a9d28a99e6cca1d798bd81a5c0b241d20f696f52ff3328871085820e14bd61ea570b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eaadc6daf2de931336091d2e125127d

SHA1
ba2e4fb082893a2bf53c2c5e598b9b60606a781a

SHA256
6c406d96f1b6da193b0a2afc4bcd8bf78b6b08f631ab60810c40dee7cdf4c570

SHA512
6d21835c70965d73904954683230f74b1f608007b1716bc8b1c18afd0bea67f9c3cebd6618bea3fb0163282fea6a70b4036f94809043a06c3b9b2f9b542d4b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa46eab5912a5a698bbf5f14d934960

SHA1
c2973bfb52e0b02b9d1d5107686810ae557c0a85

SHA256
2048626adff3771799fa1526f083937594e903376838e3bd5a34b71dab63c34c

SHA512
b389667e0e14811781e9bf3c4296d2c140f8be68105ee6a404c3989232367ed4f2c3f93d06744ac98c82c18ede889ca0927a754159c3318c3114a770907dbf73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9901a6236de2c99013aa2c302a62d623

SHA1
7a30d9bbf237eb60108a3adbaa9fc761ecdaadf1

SHA256
aa51353bb26c381933ef14ebf7df3a4537c5eda3bd4a7b70212196d07bd3aed2

SHA512
61c61376f79372cc32f5d34b3dbd09ca30768fa196d508dd6cd1c0101ec888b326f771fe157b34f7ad3e98db21915a9eeb5094ee7f4f98442403d336638fdf6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba6f4ffcdd3a6ed54bb0e2249fd6b1e

SHA1
19e3b8b02958a49ff99699da37f624403e2cfef5

SHA256
7b4c2787924a9c1d800baee2212f3ffa4d6b426276dfa9e49088658ac389fb9a

SHA512
d27538eb5bffdf261247d376a09026f165f6edd396f4975ad28eb6c0801f2579f7a942bfb9bbfa7aa02387a3c7bf75168e5330e964ec79a65b28ed852bb02c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d3bbd4703e8ae56fd43533740f251c5

SHA1
7a8035ff20fac5dc70785676f8b4610162c84e9a

SHA256
8c4650107a154b9bd34b6674845b6f815d3a6cb577e6f2d125c3bfaa131fd487

SHA512
c9b558a8856f85f170c05701fdd4fd11f22686f9aae629f224ac7d993e9a86b1fa9fb1011886486396cf2beebddee78d0a6c4c446a8cf3fe9a50eb43826b36f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090a74c4bf826716226c0f02a7870ea3

SHA1
4e213652824cc7ad0a4b060aaf6436d57b2b04de

SHA256
a731569ca8f49409eead479a04a79e785995a096db36e8d82ad25a737106efee

SHA512
f43627fd5fc613b3d6aa7691c3893fc4fd113df7a74721708e130fc232f5b0ecb5f2d22d0ec841e059643e65d084ecdfa224d291b0d6ddfa837b3011b044c1ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2259.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit