ca0cc8d7c57c2d53473ea92034dd2e967aeea3692e585248b856f4a1774e3798

Analysis

max time kernel
137s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b95a68c2fecbad390ebe15a062900d2b.html
Size

5KB
MD5

b95a68c2fecbad390ebe15a062900d2b
SHA1

8ec74a4e8feccd8ba1a9d742f255cba5dfcd66d7
SHA256

ca0cc8d7c57c2d53473ea92034dd2e967aeea3692e585248b856f4a1774e3798
SHA512

802e026c8c208bc57994cdcca20d43d4f7cb4edede8c6a903af92a4ca05d51e54ebbbbbb1642b29d50a65e0a08a290238267f351d9f921e0aee9018842764836
SSDEEP

96:VON29ZBfpOs9ihbpvpHRsu0T22JzGxFvtCDSUlrkytVND4VGHe:VO4DppiJp2ShtCOsrpVsg+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d5e244bc70da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000dbb066906aa6615c85417f83f66860d4106487fc3bc78acd853988756a339496000000000e800000000200002000000072bc5bfda328a08d57d0aa2a8259f0ea4a127d8a7bf9e5d6e07fc9cd7c44432c900000008c378242b724c600a74c00ee9409992ef57d782e3718c6f8cbead2f051a5911646cb5af8c9e0109b21e67f9dfa2ecd836ed7f68ccc3f5e4c2ae62854729bf68dc8ae7e63fd648424eac662d6ca8a3bc9fc4177cc7a9f675216e9937fe8c706f9ff5e2cc099c1838a03de41c68d503b83a59ab1836bb8d3ac12d14f00adf21a926105f14af19658913def14e952dbc5b1400000009d5deb5e32eda45b65e1adc691a93fc81294e388e2d8442dd5d1f57665ed21f553b1534abd5ca6eb159a886f1a437b3defd6f5f344434d5d92ffc6e62b316b9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30EC7B41-DCAF-11EE-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005f88af23cc1809ffb6bb5ab2eeec91c729477a91d9b8fe6f535037272f554b09000000000e8000000002000020000000a68502a0b8317289f5a6cf5c9f4ea96bd14c06ab98705568ba38bbb21f8d8e6e2000000054bf058aca69ab82132c0916664d264385141491ceda9b4a9843be6859919bd740000000f791d4c1ddcbed7906986bae189bf090996c36a2919de7bc5762659c6fa05ac305fa29ceb3cf895e8457f9ba7d62475b9c1d9b623d634e0e2ddb6d21012b8b75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415997420"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2928	1568	iexplore.exe	28
PID 1568 wrote to memory of 2928	1568	iexplore.exe	28
PID 1568 wrote to memory of 2928	1568	iexplore.exe	28
PID 1568 wrote to memory of 2928	1568	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b95a68c2fecbad390ebe15a062900d2b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b971590402d191edd0a8b7e46241d75f

SHA1
26d35c686782e4ee5165991330089d656adfe824

SHA256
a4bd71f305edd65da955b075988198207a750cf144ace1dce15ecf9f86203bf6

SHA512
4faa8eef2bf7c13863da4f8475ed4a96d47d7ad6582b28e49b36970e5a64f668f108f01c5973ce34f02355bdd4898d2e40c4750e7d0b42ad807eb022009ccfb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18de88755140fe534796e272215f211

SHA1
8a45d822fc5a5ba6c58b7e75089e9cf66852afee

SHA256
56fb2d18a06567afca319722390d24c808d43d6dc4211d13a4ee6a54432e39d9

SHA512
4c78a0cac8ff8e16dce8163998c80f188f322972216c59f9541e2f321baf343679e8b2e18066144432c7354dfb4664ddb881ca6b66b25eb53af991df0acbcc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5923ea3355d563a52509cca1c035df22

SHA1
f02601994d60f5190a6a6416460f2ad01bd234fe

SHA256
3041ff4255e5e10b49d0c205c5a54dc0040c8d3aafc48da2bcf0651d059762a0

SHA512
25db6978343e7be21ae5f37444d9d630d56c3fc5e7c9a3d42f96ade4339ae8172642e121fb0f08e8f4c13c8b877bd24e100a730ff473c6b50454a0750518142a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efabeaf41cdcc6870ae3f41ec66ecf0e

SHA1
55c73bbaaabe989760a24e29a788d20f91b555a3

SHA256
ef69bf8d642ecfc229efb19bfd9bd8b594ecb178e05d7790f66ff14a13ed4e23

SHA512
129ad52f21aa3e2a00fc60954e436adf44da0c18ce676dc5820edd8c258fdf8f9d6a5cc92e20b506dcdaf2f7594f5f9f889d19c1af25c707d2ae093a3c340922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5ced08437cb81af55b8a3383216fbf

SHA1
f0a30b7d5469ba0d7171fe09e2cadb898af6ec13

SHA256
decf0f259a44ade65b14918d6b63df1a7e49ab3c8dda6f0791fcfc524b2e3c1a

SHA512
9f90ac246602778376fa4c91dd5e4123987f2dc2561ce05000d9ec7de2ab193cebd2eeb65d2d6e4d592f2b34d712a6419d7a581d4ab0da3edaaab14d175793e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecfed31fd5c94b587304bf680e34a6bd

SHA1
2e9ee394e4490e32ef37d3db2a53a2cc27810b22

SHA256
52be8cdd4c75c08197c9102faece07ded01f0ed5fd2d508966b1a5af94220aab

SHA512
3f7b00a2ea15dfd88e6c62bd9ac74d9e832b1e64b59a238dd011291301fa409d1effa9566477b228b70e775b57bf4a1ecfb3db61f3c65be005d33a1ccfdb3b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cae8e21f06f1725e0a0bf1621d12e7d

SHA1
c60d4a902a5d45ff46e900762b496e5db5427b9d

SHA256
29c3603d9f6883c7cd1670802369a145c81b4859db26e362973d4c0983673b96

SHA512
162d44c4e9057e955fde7e9e22e951c236e7d833885a7958a1a62fc1ce0b4a6eb039dc4ebf8f5d975a83fade7f9cab076cdefbc2fa92d72133748f7d54ffd54c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acd77d18d761df927be8383950c73bc

SHA1
4eddd4f3b13cc1318f5c1587615664302804adb9

SHA256
eb6d2d03a1cb9b38c0feee18de815c62532999a993dfd80245c9b50f2c618b1b

SHA512
eb22060a3381e6575118c35ad7a93385e14e3799c549f7979c326b90146019b1a3c7e6f5354ddc1831fb536e8df33236fa73ebf31e30645d4e6aafc75f44d593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d415925cb4bb23ca061ade1cb73481

SHA1
5836d2eeb04d456e2a440eb8ab6770b603bfb5d3

SHA256
1f5ae2510a4060bef9bfae69b5e9f9828aceac24b2759ae4cafd514a328e32a5

SHA512
a82846585bd6dab8b01f51b683ffcb2a39d3e8947d59a10038715ece81fcc1eb4b812ddfc615a2ef46881df0818c2fcc35e8d837a736fdfbaccd6a967f7cb849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754fde49286dd406a7846a23342afe31

SHA1
265464a0a82037fc22b3d04bc201216260b96f8b

SHA256
ef9390d8e5ced803b4ad05d92fc9082ca5d672efd98d7151eafaa1ad8af66ec7

SHA512
ab4fce2a4b90d76d3ad270548f1f6a78586f2d05bd24688cd58c96128710f2ac58c4be79d7a374310be3149a3c2af685352ed8c43325ad71cf7fffb71f9aff74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce8e0fccd3ff0862cd6647ed40721c4

SHA1
d01dac1f85811e513fcec7ff5c67a88e3e9336e6

SHA256
5a747d40afeeb7a2729616dc07b86d8cb3be33e8650319fda884a798e7122a1f

SHA512
c7a763c380e5d684cc2167daed4403e4a9d89981e9ce4f7f0e9a7553920a264fbedd7adbd9f859a40a1e703df920928d064c60750343dd2deaac30216f6ac81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eeabb3c059e8141c88dabfff8b1c0fe

SHA1
065d9813dc9bea6c4f723fac382e3452aa28a675

SHA256
b29cd52d1a929676facfbeb67b9619d464363eaf0d6e222161c29eda111960c6

SHA512
94c90d11ff237fab77606688c32f47deeb1454adcce3ca3d97898a22777a6f1b760b98ebab90c89f83a2fbbe952d3e2c7d137f552949930a9e1b6631ea175ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6598d786ebe392d9e2bf8358b3efd1e2

SHA1
26f99ba54e2bc57dec5d2c6f543d3164caaefac4

SHA256
84f92734024c67f85bdea0ddf777ddf5d9ffeb45c9f93684c0335c45d7a2fbcf

SHA512
19742538ec448fb3c6b56eafe0afc0f3776930520cf1b48d392f54b7f736fe347032557c49ae8bab24f522e9b4d3b17deabba22213df1418d59a92b5774cd9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92203a3bde1c636ac40fc201da56d292

SHA1
4189b5cc0c2f9cfdc01c81709732e7857dd0b07c

SHA256
037d20a2f3ce506fe09e4904b42bd7829900e407452ce1a7849fa8c1b76f577e

SHA512
2d2eab6863e9cd85de4ab8aafd9a3dc83880d148293c0ff560cd5a7a6a7d1db20b3cad4836c1fff5e5d1961fad6dabd7c2e43c9cedbf99117e30b3bc251857e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit