dba22c6f3f11d46b9b8884043be6907e5b428d5595baad0a50d75789e5f4f0cb

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

background.html
Size

1KB
MD5

b283e8f75dcc4349e1d88e72358ea3b8
SHA1

b017c920e90daeae106ad152ecfb42a1d8d203a7
SHA256

67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3
SHA512

c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416022280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000094290e6e7dfe7ae699408097ed1a3c4165c8115e05fb50f7e19c0ec19fa72497000000000e8000000002000020000000818733100ba6c7837caf959ef0519346ff2b3305fa94b8371e905dadee68c791200000004ae4adf0fa19442e25b49504a7624034e77273dfa12c61a45dcb4b8a3c16cd5c40000000007ed3c28cd751df90c3831e130eaa05f968eb949181d49ba55fca57f7cc7d939137078ce98a544a3115cdf41abc6a9ebedeb77f5add89e41f32c02f20048904	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a99ee5f570da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000030bd00fcf9d2579d465b776313307f6770c844a9f440c2e712c347d1f7ab5a4a000000000e8000000002000020000000ab4acb736e242930b355fe7d0d525d5e2430d19eef8cdf1c7dc55dc4365e5bf490000000d20e8a0eeaa83ed6d585454c644b4d84f196851bc17b3a9f7bbb7af38b44b5c81f7c42cf2e7157df115197fe1752275edbb56c13bea0669516ccf7fdbe816a7ec65d714ed368d1f6100dd35eb34884f6fa72bdcab7396ad347cdb07caa5f5a37100ad7fcaf2f6de134a25129895fd5b7d9b37b4460947cc3c6a0d26fff25ad5bdb1f37c53dd6b333b3e052c7eb01437040000000491e780eadd189f8b261faaad5e12747d4705b191047502b7f97e372711a9ee522400c0e4098b30011863e3207ff3b5bab7795bc8ac386b78bc8d089d235abc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10549F41-DCE9-11EE-8768-EEF45767FDFF} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2180	2068	iexplore.exe	28
PID 2068 wrote to memory of 2180	2068	iexplore.exe	28
PID 2068 wrote to memory of 2180	2068	iexplore.exe	28
PID 2068 wrote to memory of 2180	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\background.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60bdca71561909970dd6fad2dd20139b

SHA1
10f0a67c5511a7a84b1cc5f9849205e114bc8c1b

SHA256
240e6c69fe6ff8ff0a9e3bade4607460ed72e7db711a67c8d080d347c33a0b38

SHA512
0a582ff07512131a73a600c093a9d97f2563a1aa5642fd0bb8dcc26ff4ef65367a8b5d84a2c7b2ae0c4e03f7dd10b5f6c21423907052003f0a954dee3309a4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6979e0686d4c745f654d9c0d11c45e9d

SHA1
5cbcbcf59f8a89083d81f58f2360a0bfdcd10a4e

SHA256
0e1e2e81e0cb854496a039d3bcd5e1fec6f1d18adfe40f50cf6bba22443134bf

SHA512
115a1b2fe28acd76237cf0ebc59d7086c54e119802b2fe439aed1fa747d9d15e712898fc39ad8106c5ec9c74d99e0dd70df0407b13316ac433e1a1fbad0d2dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88319eb22c8e475bd2fb6f7011cfd54d

SHA1
c09963bdd64e88e98b0ecfb071c965d7b21e8de9

SHA256
7d981a37ca259c4fca8a8084eb330ba04a03ce5f7ad49122ff4992c574b4372d

SHA512
9f2d589bfe2ce0bbfafc4284926a17bfa8f3dfb39017567579bede7c5566e4d03703e3d7b341897f309eef571f9299431e501d3e327ff1e0d24ce9caa6610d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc826134b2247d95f4e886d809fa56b8

SHA1
4e9cbe5ab3fcc1d341783dc9477d3e1275c22f17

SHA256
95fca19ae157d5b6315dc5a18cfd4e7a568eab0a751935aa9f754d5dd8fcc300

SHA512
11ba0823573bd5b8a0c4964684eca0afc30893eedf6d126384fb1a58562750e309bc73fac8bedfcdba8a6e6a6eed5749481751f9e077be50912054ed4abb7a17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bde4ac31294d57a1947eb5a3a24cfab

SHA1
2767c9a7c5cefa0473a216cdff81fee9710ac41c

SHA256
a27f8a0fba7281a1c568fa786fa05cd9c0cc630a5dd6a3e2bbb0df9c4bcab846

SHA512
5602b74029db07daf6bb654ccc123ca3461d5576ce462f0a6d99c0afc911d1b50b16a59dda57624b278f229594f1544acb562c02b0c457867803efebee87fe49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f59a8577792a56dd58c965b244b5c8d3

SHA1
a03b17633ed78ece3133c2563a382cabe5331b11

SHA256
5720723d18cf276c0d26b35a1dde83f17827e30f6275c73420fc3f483a1a680a

SHA512
34794609b38edd7dc56636a238becdd5defc868fd0432ccafdac6aca3900138872337a1f7e96c51a72a15eb649fa41bf8625733118140025564521f3eef7d07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42386d4c4a899fc4e8444204a5bcd14f

SHA1
85aab1b2695791d18295fdc0597e7359913391ca

SHA256
b8858573293d0c938a6144c0debe5ec77c18f655c5629041cf2e908bd25ffcc8

SHA512
84ad9b935ee7cf1ff6d540127044c982e8b76a1432daef8151e7708bd2e5bd6a46229a1c4df6d12079bea58d55e2fcac9c9bf3ac96dc4f0ab154122a6b1487b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e26473073cb0f56aa637ce6d036c542

SHA1
56190f575e84571b279ce4f330ae1c2ec10cf8ce

SHA256
727cf713b014588ef08cb84b367f247e4c089f0dd384be9987753f7297dcea77

SHA512
9bef9fcd177bcf5e2328d13f85e8930be2b3b9b98c1e6c377d24983f944f8a73b7b99b42e1fa798f264de5020859ddac377859c4aa455641751fe81358401463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
893966ace050722a2f62856525577a9d

SHA1
f3c02b1952f408e3301e5fbcdc2e55db66a7e1c6

SHA256
9b3c7952671dfb3ae25ed356d2e2c7f7b2c60ce1b959a58419f1c45b407e5a4d

SHA512
76d6d3f8b177f73463b7ce4c708b06c7b148897c284c91550543ff3a7cbfb289fbafb6debe4b0d463f113ab8b14c9cf84d417f6e57b4256d7ca18b8a80093968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e13d53145c4a386a85e9622f25c9ec3

SHA1
f106cc7e361e32c374494155e25af928e81cfbc0

SHA256
c20868344a8c8cf9f0f6620d4e1864aaedd2c49c35dde0e6546dbe4501fa2bab

SHA512
4e3dec601d0e87ca6cb94efa004c3fba3cb38fea9bf742805b3b922c3fdb1fed717f0cad5f80fcd87ca45dd7d3ca3b611b66cf9bbc8f566ef57f7bc9ed74497b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bc5ce90d9360948bb8ba0fef28b90d9

SHA1
ea9ecd0e98e49e4f12ae344f885d0db3e800e129

SHA256
6da7fae77edc1ce45840e69f468d92d242483e8640244f05ab02fc2236a70c2e

SHA512
2edc3568a0ffcd1e53cf82f9ef202b22dc2a406d94d33f9d5dcae42d45343686409e71105b87157179dd098f6db7e5cc677ce83069edcc9586887894480dda1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
526b49c8dd50790699717e343bf7b950

SHA1
70a3649ab57bd40574876c0ef4b1f9d1df0a9cef

SHA256
aa27a458c190c3cd2d6f4b588b8a35c0eced0e192622f4cebdc950b3bf16969a

SHA512
e606821c7872c06991f5ba9b0170369dbe7cd096c865630298c1a63bd0e3384dccd3b659ee3f7491897edec3dbf14558302892f9443ba4266a208d26d9527852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f435c07e7cf58bd7ae6f1c51656817f4

SHA1
441b50d1e1f2c6ee0c1a3819a9302323034d17c2

SHA256
0e1c89bf617e03fb9e0021ac1f362ced1ab80e14a630c69da6caa70b74169a8c

SHA512
fab90ca4541d01b51d734bf6bce21d5a0b42cf647ebc63288af36765d6f0903b18a4f46a6eeab829b0830d190f996ce559bd57738f928b2c22f8e7b659c7d90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a2816252874f743e25b577941ee16bd

SHA1
d8946ca53d763e5f2594ec98c757047dac2b46c8

SHA256
b3400f144c5104dba68a916beb13cad078f1e9f3559a311fc07b94970f745a99

SHA512
f6ca622ee9153418bfc4f4e4172544ed05611b64dc19f8c027ad57a4339ea75a7a8549753c2b092b0b454972e12e4dd9697fac89002e59ca45c6b6d145a037c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
922d6f41b5acda6af07d608587ce2f45

SHA1
3a9254948b60e653cce90271595fdcdc335d7cfb

SHA256
d4d161116e6ad138a2deb4372e5a0f3d70d999e7e32ab75ca33c9abb7f45f146

SHA512
6ce3f9668c180fe930b93df34017d9c231819c280cf61df66c0b15f2a62fbcb2b2e22155847db025096c3118af8a1f5555579d75b68bf850de1e6a7faf414a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05b15ead23c3661948f2209923fc2d8

SHA1
f946cd6715a34c634bb0d5fe477de26c7d43b82c

SHA256
6886778dd189fd8ffe2c1f7b50d6d1df6f7943dde69126cb64549bcd8622d8b9

SHA512
e09fb40fb82f738e5f3684b6b0f29c56afa8978158ede9840bee6ba9bca571e41eda4e745e29026e60d7bda95d654fa61cfe4f67a7d5b1c4d9da13d34828a8b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8096.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89F2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit