853e832924694b51a00fcff98ac16bc9433383684eeb1ede184a05ea9febc39c

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba3fb36367d2621cb8321af9c270ae91.html
Size

3KB
MD5

ba3fb36367d2621cb8321af9c270ae91
SHA1

cb08b05d2bde7644069c8a1485d81c7469cff237
SHA256

853e832924694b51a00fcff98ac16bc9433383684eeb1ede184a05ea9febc39c
SHA512

8150b08d7da0609b1759721862e41f7ff45bc37a56e3fefe4e141c1276cfa738133c066bf88871f2e68e9865140392087a21f8aeb4853699f4e95ca4b2ec7a57

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000085dc86683613ea19464a25ca0fe29909f04eaf07744b718eb338d2766012476a000000000e8000000002000020000000441dd7260eb961c718f48f0bb74f3a1284e8602897c861916338711fb8f220b590000000696543fd8d57b6497430829aff34189e3bb583a40efe84c124536e2078e0e5396e2673973e95b1ac21a996b2ae43752ed9ee2b46133d69195eb4efd4debc9edcf44106f940490ff3736bd429967ba280b1c5838759b848b5863e08c44bc4eddbaa3d3a4101839fe15af9d6aac68637882ad37e3ad7ace65516a4eec75a5ff03e7f7c1537f17d4f4bbad1ae3c40565c77400000007c51e8fc0f916a42f297f308a55345c299054d7b30a66fd738d92fe74146e35fe3d60869c78f8c5dc6096ddfb5adf262756242da6b50071647c8ffe085f85647	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000007f39500b3a34f1258c7bbb6d7b0e008fa14ea532d326b447b3aeea5786757165000000000e800000000200002000000072b0455d791c65309c90ef12b084f5c051e785dd1d5a9f3b35eb3d3efd5f80ca200000003255bc3340a9269dd9adb6602af6946147f5a3302b5a0f10ed6dcfe297b3b51240000000494270bea69d6d40f056f3159a9c54728c461e498a15a84cdd7bcc0e41c92a13f9f8d5701f12220305f7ff5141a2f7df78ac779e80ac95c17adaca5ada9916b8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903a7e85fd70da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416025533"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6A72651-DCF0-11EE-A008-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2692	2504	iexplore.exe	28
PID 2504 wrote to memory of 2692	2504	iexplore.exe	28
PID 2504 wrote to memory of 2692	2504	iexplore.exe	28
PID 2504 wrote to memory of 2692	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba3fb36367d2621cb8321af9c270ae91.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b88d8caadd2e26a25623304a3910315

SHA1
35f84534fa3b4bd3f2320516f08f99884b5c9b2b

SHA256
ee53a61700b04c7a2b41a0300ddb9217aad179ad782d4b88f23c6c4d30149270

SHA512
31cd77992c439f05f45bf540e9188bea1aaeb0d4416e8b3bc13d9af1b3aa54bf37c8e03ee1cf30f98cc3e12e25593754160b92d8a80b3f92c3777e949bf22bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
966d0e336f0bc35960c3f34199bb8bd0

SHA1
cf5b030c6f05384fcafb6862f30658d45388b981

SHA256
75c3282788e1b4fe607377a726840751c1cfa5ba53c71e03e9888067f73010a3

SHA512
a44fc75fc7cb4746f62990c6563dab30ab05335b09c5cb8d1062ba8bb5746744e1ce799f7268a61580d8f82e1a8f49c6ca8e1665bb7787414c6347e7feec7be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd9d044f93762edb672651343a009ce

SHA1
1da347bfd43511c84d9f9301d62b73bc99f5bf69

SHA256
b6d8c0cb196258049eab631ef61776154d22e74b06a6965462d2471b43dc82b8

SHA512
adc935442bbb767f8aaf4347867b8fe9e9b28449c97a16c6c3e7c8b42c1e9c0c2cf61bcc9a93ce3e46cd82bee42ef23be5f5102ac5941bd8c8a4a8c25a2b43b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a023e97701484966d0d26f633b4d1f70

SHA1
402490ea2c8a4b07f42aceec6800b068dd4e04e2

SHA256
576e279349983f654a7c7c281880dad7a83706bb4b52e0fac9fa63fa4706cdf9

SHA512
354402eeb8893d7f6a34be9e7939721e600d9fa8f538eb531acf3d9b5f89c65e3c3d78008734635c3dac0fb0b7901c882c1526d823660da4ba7cb47b68003550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a250b36dbf93bad1c830d21d291b8113

SHA1
2e5a7af535b4191ec6f478e95b1c2c4ba6464f7a

SHA256
1fa871dcd4c652fcbceef4ed90e0e6be72b1c5944392d9e31ce986397adc2d30

SHA512
d7ffed8fe39bdc80468eba72022bdb0940596287573ebba2bc1be6fa37f50b5885d99746485fdf15e2895a64f7cea52463e1f0285ef22ea6a89c82a3df4be051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c7bf5a763a52db2222f1f77a22c1930

SHA1
a861c71f2067ead127ac734bd8b681e982a6b7c5

SHA256
1b58b44937d6b7690ac0517d3a6117018c4158d9c6aed454581a8dc7f397d72f

SHA512
7939049652556db6308154fbf6b6353424df83a2cd5eba2abef0540e49175dbe76a507eaf701ec24ab8b90662f0d2aabb4da50b5cc7a05a7409989e68ece97f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29b0d73737b1f34f29298ceec0d0896

SHA1
2da182e179c3415b0c4042125d22fd6c70b04b8a

SHA256
a92c90be9efdcfc5711786011683f3e09b219e209cde2b8132381d03b723c305

SHA512
8fba6008e26f226aa07e3eb479fe35c04872f1530eb025062a868113ce1eaa3106afc6524da2eca606f52fcaed89361bd56a72193bbe24178f1c8a4e7c5a8d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8bee84068b3626c10b1aeb9c8239906

SHA1
c38dc99a90d5022902b4dfa5fd352e8a85642805

SHA256
14ce135abf54576b81e3dcfbe837e6a62809ee0301c4e0227fcc69de16b8d31d

SHA512
f63e1db66bd60d63dae4ec8bb85d525b8d39bd4985c115032d11a380e499fcc8f5bd34b2309631580902a773803a8e33d6d6d2f6ab760db3cd032884fbad2cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae7a1a4211fa225028f481561d926f3e

SHA1
c7d6ce3fda0b15e980014a7fc4929e9cb04a8ad1

SHA256
fde16e3b4d5e7e22fb059cacb3d36ef43e0e29609a0b0682f6927f1daa5bc3f0

SHA512
f10390e879d28ad6adb1b22eec25a3b83ebfd6c2b36575a60d271b36a980d3c228625a3e1f4fda4861fab6ae7a723c71802ac0205ef5e42cf50ca3115eeefe3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9983.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9985.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C59.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit