d6d021bdc1c1c056f0347f35db03fc977ec15028c2ce919a6d769b0ab1663e41

Analysis

max time kernel
122s
max time network
161s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba65a5bb60b521f79d42b4c4d5e68ce3.html
Size

85B
MD5

ba65a5bb60b521f79d42b4c4d5e68ce3
SHA1

f9f34150dc2561dd1b42921226e3658d5ac9af39
SHA256

d6d021bdc1c1c056f0347f35db03fc977ec15028c2ce919a6d769b0ab1663e41
SHA512

d179eb89ea66ddc3f0fe917c8a4093fb3222d27190d6c381860336fd41ab5c30c81b56f35a725fd036c374e9f012d6c7e877fdd566c6787c76af59ceb1f3c659

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08b54fb0871da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{198EDB31-DCFC-11EE-BBB0-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000001fbc9541872c06ca17025d0e18eecb118f28f4fc1127e7b7d9ce534d8d5336e0000000000e8000000002000020000000a6608a673ebc5a7dd809c658f58a7aff935761183cc18a33c8c3cece5cb7228190000000ffaab948eed0ed1d4e81b4443c90ef6f6052561a9a4306630283fc2e6e9d37e31e20af7fd430a9ca1e8521dda754ff4c9780b062b292eda7d0ac60fe6d9728d6b5f661317b50d875a45f8225bacb2a465ede91e253d9b01c7a327911dce11e72580ba1106c609badd63b8b37913c8237cdc0c41a63548c06849ab8f081302525cec692ffe8fec768d24b1a4a816cd6f140000000e69caaa4c08c14f6fe265e978e69da417c0bb838ef87b25bf5e96442ca3ee129f6cdf49e167b5cb10046f9b162a5aa132edeb82c31e9d977ebd5c49422c35691	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000c0172d757d4a3ecad1b48dc7c6e84e3ec5f1271a8ce741cdfe9fd27d706b6070000000000e8000000002000020000000a8496445ec67e3c02adb3517e7b9b64b0687f4dea3a1c4ca8d527f851b15a6a620000000e3c3b9f8e89ab8ab1efcfef540876b53efc7e84d1aff4fe03dda3a78acbc08fc40000000f29856691d9d6dc7b1040492639a0e4c5f1a594a501ba2fad59935a8ca608b949e7ceff077ee37c4897f69d21c3d0c6f6b29dcc36ca32213f5cb01622e635a90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416030452"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2492	2516	iexplore.exe	28
PID 2516 wrote to memory of 2492	2516	iexplore.exe	28
PID 2516 wrote to memory of 2492	2516	iexplore.exe	28
PID 2516 wrote to memory of 2492	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba65a5bb60b521f79d42b4c4d5e68ce3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8bfa9a574b19018787ffe68b697d4b

SHA1
3d4d7030a792eb9f7785bedda32f51ebe51e5919

SHA256
be021794ebd63ab4d0afd401754fb3040733ef6eeb32054f64ef1d4c95ac06c3

SHA512
0af66b416e137de16ab623e381bbe15dde60fd8fb37074c4f4c8025b089db2bf2968cd706e41c06fbffcda81582643c2b9971635fa09fbc902c378c33eeded73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f433e3d93c358a6f4dc8e2049149aaa2

SHA1
1ad2b9c8d3971ba4bcbc67978967ca96fd48da69

SHA256
bb5491945c0093536fa23adbd41cbb202b4371f164ff94761359b2178b412300

SHA512
d2fdfdd0e3454843c42fdc4f28761ebe4639a361a1548cda70180954636a8c606407c931ea0e9461e37255400ee7f4d7069d0b0617a30b4b706bde0d50a3b67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a004f89de0c48d8b79e90480771cf4

SHA1
51c8a4f489b3d75324d9aed6698b0b553c51c9a7

SHA256
bc4aeb04b9bcb4cdccf06f5de15aed4d3bc2166aed4796a4845cf6426c9a81ae

SHA512
1a9978c6099fe0f886d55eb062a4178aaab96783c656696cedae89c1d846a68051145a25ea27a8095177f9276bd75e4fbb01e7164560ee5b952e697e125181cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdd1ee5b2605eb09160e0d74921eb482

SHA1
076a4c0485387df4b79233be14a3b13956ba8b36

SHA256
272b354be821cd8659b339af7b1bebb1b214aaf7a500e185ec34645aa9c24313

SHA512
a304e9663b75f5c734183879d986244c373ad2fa75dc3d2e782480eda6c64d2e6a6d167000256f9b2b32b747d6aa35d8e9d39399f16800f2f2c0e07be8228c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6ae9449923b4ee44e89b53b3616fa2c

SHA1
109b5db41d83c599d549494f9b46622c7d9bb5a2

SHA256
e5fd27fd4a8ebee186cd90bcfbb12c8c194feb6bf3de494893cc45b75419335a

SHA512
467291f5d294c97ce95630f4ca61713176c087cd37c8585c9142f9532ceffe5d170065cbd1785200b3f27c66217842df8efe852e41c7c499721f8ee1ecd0a870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83d06594b4b03f0170dfa0bdb6b2249

SHA1
37864500b0b9198c441ca7b8615d8ad75ed32eec

SHA256
4de8258164c79cbf86353c2705c8c51ed8c27d99bf5b906029db4abaa4de6451

SHA512
326e2d6ffa2eb4eb7caed14348fd0f08580399226d2ebbe35423e6f97a8c68eec5c761cfdbbe626e2821b073b532d3798c4dc9fcaa53ba7da2df68d3bc02e782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe202fe45db59f64efc4630c53069bf

SHA1
625ef4fe64f4fe3ca8b5a0a82d5c3703b57816f5

SHA256
a25d1b8b700d47ccc21540a542138cd8032710b1451e8934fc561fa63b5bc385

SHA512
919a63b9ecaa1922353c1df69d0252f04694ad2c72bba316da6147d36c277d2dc60c565f168abd548a7bd2bc3793fa100e07a2228a5fdfe5fcdab725ecb98d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d09f1daf1b7a63625ac562f09a0621de

SHA1
985dc1c70fadb13231eff2d0cdc5a6c4fb511d3e

SHA256
10aa073d9be91fc32f6601ed098b6ad7d82c0a12d814b754406e0c16e1cfd823

SHA512
53339b0544a511f7079022ddf7ae0129df728d908f4efa071dec69bda0d6c199edea4ff4863ed61fc703d9ddeb39d1488f2f50f2c96abbf021b57b00e09687d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9900934e21c0ba077973da5f0e6d6829

SHA1
a7f684611853c9cd822ddc5bbd53ceccac79cd3f

SHA256
84f09f97e632deafc28a3409e073587fb3886a2448fc8208a388ceabc898d890

SHA512
e26a2506361cd3b2774a40b3288c18055ff4f344b6d15b66944d30afc139b256fbff014f80095069803990e25009766b7da4f9dbb60c3560fec5b2e4abb5c6da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f30f7e9ca5c781c9d439d126023b2485

SHA1
a6bd10daaf7b07e2bf70d9b4d8fd64a05ca5847a

SHA256
b10de342f5150e747d8c84be9bb3d7a4987af45cfe228174efa32628a73c82de

SHA512
5cfae2c36a65a1a9cbc642dc1cc6614248f2e68757100099b0d659a4a1de4942c64c5dac13fe099e1ea5227093783fe32710e002de769ee461a42ce3de1486b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8654dab402b78341a3e5fadabaaf2e8

SHA1
c6e8de8de500376c3234f6ffde05803fda88a715

SHA256
186dd5564e017edc8c761e35741e5f8bde6bc47b0a1a7f6612dc9b5a64f868ba

SHA512
33c425deb0208295805031ded6dceca23190ff647ae9eeb3ea57ea143cf09c73c38fde2d460c137cbc0f72dad03bb79b2a4d67d7afcd2dac2323549f355dd532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a85cac705e5f14e6ded5eab8b8b05d42

SHA1
1b2bbfabd0abd70875b83784d6ae8a2bf445e2d6

SHA256
82e542c772b55711a9ea422ec5e949f4c794fc59a5c2c80d7f8e981f9af375bb

SHA512
fd26d691e90d7fe233d9c36b42f3689ee882ddf89257c2e15146fcfc5e6a377e9c954186e08fd8fa91a276cff2ae131f958232b3f51241b2e2023a7f0a7fa10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b79f46054218f525e67613454049bf1e

SHA1
879d33dec647f27c60384cc10a2c0e7debc51408

SHA256
f513fb4bd1de21ae092e8a4b677ad0e208deb2424085c36f699da6c6b47e0efb

SHA512
f9f1a4cb2e141190aa9d94a9c291877fa769982c0603f9ca733f918e9f4262a15dc25be644b4fd579e2d0d10f8cb4f1096b5a94faf3b0ec0e49ef1957a76ee53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1802e678f2b6a130aaf9e8db7ae4c99c

SHA1
e81135cde7a869d904629bc89823597051ecdd69

SHA256
1ae9b0f76af570b4d79630615fdb7cc6f0f480483cf8256c63b62be5b2b3c682

SHA512
e68fab6ce2f0c7e5c0f1c93d994ecbd9ef1fb934c4c7554436f423a11d50dc764c61a7a3bf3d33886ef94375ab6f5f5cf48bf247df71d890f899768b197b49f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d95110fb64b157b81b6a12cd2f6a58

SHA1
97cb92e627959593cc395e5e84c0f99e4c585fc7

SHA256
f2b1c9837acc3eea663b9191a4f4fe7353da898ee036085ba2497cbc6b6daffe

SHA512
2388b6d400cdd7add73be4fdb54a012d07b48eb25b72698a3a53848e34c6305fed35fa603b84cc3620810eb0204b89b5389dd489f740cd3b015ba53fc6e9079e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBDC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD2A.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E7.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit