a68d46a8a67b6c8977a0194b5eb035b8ec585bc3825e26bf8471d035dbaf9716

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2FsZXNyZXBvcnRzQG1lcmxvbmVnZWllci5jb20=.html
Size

1KB
MD5

ef9b6f617425ad856e7a208eb9857072
SHA1

66473ca25ddeaa2d6bb0ac658be23404dd576159
SHA256

a68d46a8a67b6c8977a0194b5eb035b8ec585bc3825e26bf8471d035dbaf9716
SHA512

029e2bb0197ad993924c787ff4c96e47b59aba4b76dba3a8d7e9700cf67e079acfd5fba8199440b0aa8cda31f69776be315b3a0158c27bf0a71ac89e4836f426

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{461C6721-DCB2-11EE-BC03-E626464F593A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00eba21abf70da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415998743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008f64852869390c7225817b07fae185e037f1174fadc1c83d0d44e01d34884e07000000000e80000000020000200000006c57f0a07ac9ddd46a0343e1da69857c3f2a52c848780634bdd93a59d149d5aa2000000027ed80b8ad729d160e3f5ef7627742b4dbe791fea29093c47711e2cec1268d95400000000cac164a49d7d326512cb3103ab5dea7479e908e10f85f00ed9b5318489c9f6f46e5f4a2dff33cebd8b153aeebe2db1168cf18adb5890f29ff9483fc529c196e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e53cfad54f13d5e1585a05b7dcd487752deca574b22a0d90ffa278759573faf8000000000e8000000002000020000000b1ce906f07492942e9cdd3da7af0c3baf7fda946b6e97e118c5eff3845424acf90000000393962f66ebe93e7f2bb17a8700f561ba7268bc0888c57932ca8cb51ec17c159b29e5aca79188a14b7a873f5bc5c25e8606a606813859eb062d97c2ce01d360f06dbd7253526ee08994ce04764bc9e660a1d71ace628769f18c50daa633a11a0f780c090f06e626c7e77d85675fdf2020ff0961aab6d71e60581d6b194d3224db6ee268b75fcd2ab766aab8d5109eb2d40000000f4cac2acc01854e13c0425c56ac393a4399130bf8b982b03ac7f4ece8ac031712dc7d0198d0daa15405130fdf5b3c31f56dfa1fd9b32c81fd1774d582f89a7b9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2516	1888	iexplore.exe	28
PID 1888 wrote to memory of 2516	1888	iexplore.exe	28
PID 1888 wrote to memory of 2516	1888	iexplore.exe	28
PID 1888 wrote to memory of 2516	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2FsZXNyZXBvcnRzQG1lcmxvbmVnZWllci5jb20=.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc4906934de61048def6c3a1421dda43

SHA1
b23b6a852fa44ca18bc8735a38a8cc48d7a74c99

SHA256
8d005c33336a9d9363cbd374cb3215dd14b415da0bf71f9a6329ae9fcba592a6

SHA512
ada2f1c99970b896ee4cbf31f7c3f862b9b6b3aa767cf82b18caf4f305e32c6e42dac9e9f0a9712f50594c0954d8f4cdd6f9d773699830551a14c8e8d969252d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4558fa0f3ee0a0c601cdf2ca24771a42

SHA1
734d1df8a742849b326475dd6b4074d0a948634d

SHA256
3179cc9032ca54d93e53cf2c59c6aaeb29854bd29d5dc08567c47ef2a5c9c5d2

SHA512
e1c3cc75f19fce83d21cd8add282845eeb4cb4211dfb054773ba9d95f2feb902e91c3d4360e828c9bfe4d2695e956e6f4eda4f09de050a4fd16044bd9995d5bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f93ba92674269ffc8213afc0b63783a2

SHA1
ee94d89607932a069958a042786d47f1a0503ce1

SHA256
90d5c0ec4725802a014c2b05f28653da182a2e3b718ff117e39f856522803dfa

SHA512
44e5a96e9bf7ceff14138e62f4905851ac78c490be0cf1a22399b0b447641c81b3f2e66791a6fa48d129841bbb1f2d9be84b362ef6c7e0434193e1f06f55c38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a7dd7ed138ec27694dcf041019cc6a

SHA1
dc7ffbdf97309b16b2326bfa4795aafde397255f

SHA256
2bfb99df67535f6f0be9ceb5f652aafba04b47906bfa663d4eca2e9faa7a7ec2

SHA512
2c9bf3e916c175cc8c9640e2afa5a8fd86a3805268e28f84b1ae72908b5c3b285835701c3b4a673953e201de336c4cda3c2125a4c2eaf50048e74f339e3555e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e698a1dbece0dc1bd34d0d35bba8bd2

SHA1
c000ddca0ffcff34b248608e5a6e78008350e34f

SHA256
0b49e7f75820f9e9e262f521a88aff2a7029fb7488b6a0463c8eb07f01d3c55f

SHA512
4efbc0a5e5615320ed91dcb5a6422bf36563dff1378fe29075e38ad16edc4f1a0e4d855b32c3394a9c509f387097d53fce9e35a8ae07990739db4773b8d1377c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f5e265385126df0dc9f29d1eeec078

SHA1
bbc9a9ddc500de233160ed47662cfd11ccaea90c

SHA256
e741811e6228e0010ed112b66d3a7c3c893d37916a12d69ec9046e493049ac39

SHA512
379731e605421f1f569ecd289e4b71c60bccdaa49a19fae2b672bcd5a73b921ad5f89d102c24288edbb2fa43b13718e4bdaa43535e30b989efd07ca3c57f53ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b71911178c7302d12dff36e41e78a06

SHA1
f82178b74f9da3c76f30f845922dc0a6f10a597c

SHA256
bfa9bf6dcf117c23414b898e05847d5a140bbc885fef4a4bc987676f89d2203c

SHA512
a3224d7a03911bb0416d14b082de32b3ffedf94fcd985c2b42cf73682c2d308253892a531b1970b54951a7bbe3269feea370e5d57aaa880b55bd3ae76ecff079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ee3a4764e32c4a1a6909433c8f353f8

SHA1
ccb9e96dca5601631064e75ba9b8667be119297c

SHA256
95ac10ebc08ce14c4d734fbee5c00db7c360557056dcdbbbe835e8bc63f8f233

SHA512
50fec29bb2fb9560c50c7cee4b9b60157cc01da2b49a5db09690ce54c3d7362aad30b9331ba4755b20371e94a97163a0fcd0f3b85c1ab5a9b664b992c093e6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb467dd78eda71098c4c9830efbcd1d0

SHA1
b737156001427e370fd55c00c5ae282f3514dff3

SHA256
2e83f77fac4a2ee1ede922313d716510f65e88125b4ba9644363ceb6ca284a92

SHA512
1c030b1e50efd031bf0c7b3a4486563bc4eb079693198c56e36d502a905792790c8ade9fc750526712eb3009d9e72bb700285ffc82dbd5b0cdcf612b336cc750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
143a4f14007227c057646f061c5d1550

SHA1
a7bf8a3a86e85c8ec2b7e8cfd379451c291cbd79

SHA256
f28c8d14be51e0ca3acdc38b5a1500127e9a631fc0e52fa66f72010001911115

SHA512
bf347649fcb305accfb22a1c6d8ae90b457a4aed1e2641916070480e83655d4abbd0956e47718b6dd18e261fc97f89be0763148c4742fc941fce05915d5d41e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f5b769f1d625e54fb519b3d4e4259b

SHA1
b7262f84c952e22a921a5211d01ddd12a014fc83

SHA256
46c7005f2b6f361687350473b2a3b0617160da66a908f5699a9e561de719ef03

SHA512
4e2c38c880ed493f138da6e7f3007211e367de4e1b0e7ffc27c09036539edd482e81a99531f2d4980d6157a8873003c293bc26f75c341c0c012994da0a6e1d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f4d8680e5d5797cf3e34720e4d888d

SHA1
ba1fb357792004fb8a4f42a334f7c6671a3763ac

SHA256
b5fa5e7dba4db1e280eb6f1f05c608d0c69ff623428b3138366d73b84d7e743b

SHA512
b2a9e407c186cde3eb190a3520d70a12aa52918e07b40987acb21a9cb5f57ec477a81f525a00d4812bda24d7fff94242e5d211f380798a3e9445efdaa9a9806d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cdf406555a155b6bcfc36ccd68a8df4

SHA1
c2e8f345a619f38e80e64902c3cc16aed75f8548

SHA256
b1442907a63bcfd939e1f1b92e65823839ccc424a00756918ecd662079ca0518

SHA512
6466045b3f19b4136b4c642939234b357ac172963b76c14987f0438297bde53d7eabf5362a0b72a0eca215d96d8a431f13423081e93037c6e0f0087979514c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e530d0eca05fdea6655c5b7476bcf73e

SHA1
d2ecb672098ce375e96b01265da207bf30153b60

SHA256
edc2fbd4d310ddc08f658b101cec9c46f92d59f4500b2a5a51e1993f90cc912d

SHA512
0ee13a41644e3f728859edc3e883a4e607eb7720cd1069c4c3bfac336fb7d8ae223958c2e4962b28cc616592975235c27a5a94de5fdb859584a117ad8dfb0548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35F2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3721.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit