11e89532f297a506801f5b6e607e6620deb7c1ce40b5b570f01eef095adf503a

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba7d3e9ee280871a438ecd4ef64a0518.html
Size

2KB
MD5

ba7d3e9ee280871a438ecd4ef64a0518
SHA1

fcfe7f9dd8b181110cedfae54fdf2276a00a4d1b
SHA256

11e89532f297a506801f5b6e607e6620deb7c1ce40b5b570f01eef095adf503a
SHA512

4228013652ab6e2399e3d137812dac15568cd9808e89bda29a8e2ddade4f65a4a64ce71dce9d580866d11444e8aa9903f255e20a7c9a39e5e61b5f08a06085c1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B54E59A1-DD02-11EE-8A90-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000d17400c0660a86b3a9f75e3bc6a576a559101e527faafd488bb8ddf5d2e40042000000000e800000000200002000000001f688775f4e533f07e2408531c5b87a7b60dbcc3822abb3ad7172790805f9b7200000003d1d86f8ae63f9d7addf18c7cdd7955fc63d3b6ee208dad915fea674eed6365540000000303aff1bb5bcbbee5c5c93502aa52deebda31d21d6c7b7ba6d89dc507e7addac8cc7455fcf00bad511b39c7302726ff92dd7d8e59b886f531eef1bc13d2b71dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0406a7b0f71da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000c667258d9dc72f298837e22b34bed5533346432599985b1d6d1b276536a4f720000000000e80000000020000200000001520b78ed503b0e56703d4fdb5f658963403055ef4a134208da8118b899f7f1e90000000b4dd47ad92e0f8d3c068c762d96ce49a800fd7616364fd55c365a1848e9e3d6e2033c5c751630c317d2866f6fb757de04bf5fdbda0eda82960afda05f23eff63935faae4e604842125ccfcff2bf56b8d89d58672097315f625921484b2b16cb8d20d1c5e644bf11998205a552a23cddfe8240bbd34880ee046c73b48c2894f4b90d3daf32037db0aa80363d39437526b40000000e6ee5ab40c4ad32619b14c3e91cbfcc61520e0531cb0b8313d19de4d3eb6b05a16955fe43f92c761218999d2e8789054668cdbe895268b2e189ae5520a3b0d37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416033288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2388	2748	iexplore.exe	28
PID 2748 wrote to memory of 2388	2748	iexplore.exe	28
PID 2748 wrote to memory of 2388	2748	iexplore.exe	28
PID 2748 wrote to memory of 2388	2748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba7d3e9ee280871a438ecd4ef64a0518.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c94dc106e45a82c6f78ceb425d0e95

SHA1
a33eb3855805fbc190d87c9c3f35c3eea90560d6

SHA256
3d61e5ceaf4a9cd10280adf4a66f1532749d178649cfe5adbbc9f2986e7fc176

SHA512
ef04a21946ecb83870d1063ba78e5da700365c113aa1c2f4bf16bbf2ff03cc127581e2ffb8df1c60a77c921f4bef237675e1fba91f2051d0c3151bded2c2a40f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70fbdba2380cead1f889bc30bbe29dbf

SHA1
4be04830c20308b626f1f1f48035c3705667aeb6

SHA256
756db3d910fdea784666a25770773138efe6c3af051bfb1ed72d9b30149bc65c

SHA512
ad6c61e1a9dad4978f817536a8509f40d29717aa36cc97409fdf27aa8b542028334829d0d7a86d78a90469a7a8ebdfa220f600b474e5d27172ea11baf8372568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4713ed26becc5b93da6f9d576d45bec

SHA1
0899c7ac3a08b12534182d616fabf17755f494ef

SHA256
970b2404e4427f29c138b5c99c84e4deec02035f296ba2f67e8f832824e7adc1

SHA512
5812b82ac37292abf45d6ec27bdde05aac06a589ba57f52b0311eac8578acf89dbd63398bc7da1c93697d82bd31441ac252caabdcdb2c2ccac38e868f3e1ded2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b41ac71fba9ccba9b1ce5a4465196a99

SHA1
1a4f6f1a6d837a372707fba047dbff5de94a78b1

SHA256
fb2a47f2c6a807837ef706619d2d8ebc48e053fca8d17c93fccb4f9d55f4c4fc

SHA512
a247f9b1ff0aaea6009599b70b77604ea95935c522c409b1b26eabf4a2561a4974e86eb5713300cd55dff4cae8e0ce07ef961c76cceb855b402af29b8ad62695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d2a752d60e6ba6d2f68608927793b4

SHA1
2edea565161a9a20993b4333310d6c30596fa81e

SHA256
0cf6a4a6f57aa7424b2e708979f32bbdb1221927e04b91f87dae6d9c17344397

SHA512
cf5d14275f5893f1165470494979d83ba71211798d758fbdcdc5d11494d2baf55c23e86acda9178e4cbc6d2f5e3c77dcf9fbd2790fa7040f339e38dc59dc8795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce52ce5e0b72a396afaf198eeffb9d9

SHA1
9ef7e5475d8e7e82dc20a3e375213e017b48785d

SHA256
e0bc9a50ae64baabbc1b0210119cb8192572d8d3db9394fc113a83639483f367

SHA512
9b005dd2314ee6f26fb9a4d59304ccd5380400b8fbf0262d1b567fa1f877089f287d4b898c55eaa5b81977c3818f131dd462437c7c26f6c548dc5694cc6885ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e07118e2b8918fa783c1a3eec8e9961

SHA1
4f2b5487043e71c43aece394ba89390692bc0a9d

SHA256
4060e64879bba6f4723b942585159612ed881a9945f1e4234f397feb9c16a091

SHA512
37f665fc1d060f755a3ce1c9622595688f19b18da80c15edb689646a98d8d1a97f1077fa47614ff9c9f1232363398f587f1cfe27ffbf3636bb0a83011e3c37ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8fe14d1ecd76a8882ef236322747050

SHA1
a2bfc34a67e1bcb0d527edc6cf748ea9e4596ac1

SHA256
b57a246d4f1126d170ab17c2ed69ee4bc3136d6e30ae8e778c42c42e4d8df1e2

SHA512
3ce46b722750468eb8e5a35f8e4f9ba12167c95556f03db2076bed25b3e7d7b647ccff10b9eb796cf3ad0403c02b24702ee7125b226bba5a56e7eea783bfa67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37f2e51306e40bc7b720fd5384005674

SHA1
c311a678a6d6826c0d52b2d2da15eb58d3e2c3fb

SHA256
0cbe12ce4f7b3c24b88a740cda56f5037e301c9c97ff73db61bb93854f07f659

SHA512
3895d8f529d711d7c0a016242981e902a777ed1716d148463f1ef1fd1e168f002a5b3daaf4120f5364d176d6b62fd294b4494f7eac9715ce9e336e0ff2648ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ec307ba0a4a1e29b8ffffe0692783e

SHA1
d5760bab348a912b0c59ac172f03ff5d38d07635

SHA256
6006afeedac6f8687b0e11ad12649d450bcef6e31e130cda8e1eec45d95f7422

SHA512
ef769a164a1e484e4d579c1ae1fa6da7a8f588da6b3b109ab4f7a2e441da50e8dad9edfa70e6c2d3a914e907997f853f7cdc2aa66825a8a744ce9787f76b3484

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A49.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit