8331217b9229c7deb54f05f49c37959af2555d7ebc6b934bd4c6d668b80485c8

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad2eb74ddbbbdc57a4ce749c4269d58.html
Size

12KB
MD5

bad2eb74ddbbbdc57a4ce749c4269d58
SHA1

e05ec1da6c3e5d1d50bca0172874ee302cb5bd83
SHA256

8331217b9229c7deb54f05f49c37959af2555d7ebc6b934bd4c6d668b80485c8
SHA512

306b2d655c4fcddb67e0f6d8f7c354011f8e414992d54f48cc670158b361ff278b1d1e2ec3c6b40f7d183a40c7cea62b4637807582ceb50d0b2409411598c39b
SSDEEP

384:9Ig0Eae1eUe5U1EejeSIe5eUeQeQaAemeTeLo:9Ig0je1eUeS6ejex4eUeQeQpemeTeLo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6052de3b2771da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416043466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000a699c18e39cd50a307d8bdfb7a24d9dff0fae22882110ddc40a3df19e0662297000000000e8000000002000020000000609e3193f7ddd7ec0e2de86b36d188826823c0a39858690907dd89718742ee4f20000000915b6483e6249512c13a8eb4d7a5eac59c58e4dc5183712957d776795d0496774000000020503430e03de7eac4c8290f39eea3731282efc02f20843e25c2647516c4840ff71f4031e23fa0d4c8a333e1e4987f10474469726296a254bfeb18aab783857b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000d6b87e8ea84bdc84559482a8336d61c8571fb0a701da60b8592b7b1eb7320fc3000000000e8000000002000020000000d2eff6989925210ac1ddc0a1dd765ce8bbe5e68bceb4dbb070f348ee65d42711900000001887e78ec906615346c193c09b2182c56e4164110db4b8620e9df4c5be6cc85a1696b56a70ba6509f3513f172eadb1b90034442685e7f15bf487d366c3ef935a931d53796f632aeb66260a94ec6a5218f2e5540b970d2485550dc5e853227c50431495926c3ab48391e7deeb3d7b98fb23a5a9fbc4d1a253e427f391a1083036fcb384f3aacfe42a876fd0a2ba7b5d93400000006c80855cd621fa321e0ddb182c0ba8c8912f4b43de1c2754564c9ad3be1a69177744d3f4253bdbfa30f942460e67e0dce4bc25efdd214da68cd067d908d0d0d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{671B2B11-DD1A-11EE-A531-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2976	2788	iexplore.exe	28
PID 2788 wrote to memory of 2976	2788	iexplore.exe	28
PID 2788 wrote to memory of 2976	2788	iexplore.exe	28
PID 2788 wrote to memory of 2976	2788	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bad2eb74ddbbbdc57a4ce749c4269d58.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f9964a7227180c2b99d36ef5e582fe

SHA1
e0ba16eeb916f76766c2e7a40aee9930eccd5249

SHA256
5790a1d8be9c3686d28c5272332e2ed58f91ecde2cac425bf6e4e5e545ec75d4

SHA512
5ddba2b1520b801edf0eaac27550edc0ff553ea2c295b6ea47e9505e9b325ae0d985d62a16ed8a646bfc5de6ea251e69306b6b5897e40b624c60400470a8f3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e5172bd64e315274b0b54b9bebb6d2

SHA1
70ba5d47bfacd31a6bd637e43487fbb1a066d97d

SHA256
820ab412eb7a712694985b0186adf9a57b2beb5b73e635f4b14d76c85da013b6

SHA512
c3bcadd47620e75665da57b65ecb9ef3bab02ef949c0914ac4786e415bb029f1b160ca95a9f19e5bfb98640a004d3c376957687884bd6c07a521d26a87e82d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f1979aa80d413c99264e65eb10700e5

SHA1
f14cf3bbf218a4c3e53b3e066b7a575340656f0a

SHA256
af2ef59ad5e58f041e6a42ecf6f8b388ae41a89d7cbe1ca1ae324abe0749d32b

SHA512
6d9f2db3456006f658a4c8f5877221569160382b20e2b95503927f9b6f6bbf2de3bf628c404b63ad9a6bb083c64268ec6241904b9b1bd0f8e51d22d0c2193495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39aaf8509bdc38c6105598d7e4329ab0

SHA1
ae8ba0b2d44bdfb0359ee052e8ebb41d46344ffa

SHA256
1c1c1b1772a380279277fdc940b38cb796d263f8efdd5c19a38216d13d9bf69d

SHA512
1ccaeb4a462118a4b272da1e4842fe3c65d4a85a9e0f27ee1e4d695f5ea586777a4347c16bc46512e2b3d51e22836c13f6575d7a28c14eee5731d2c4ada361f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4781dbdcefb167afe5a3b14a06585c0

SHA1
6475bc53abeb012ace1ab0cab178e983ae651929

SHA256
15250ddf0c8ba4c3da19eeb6a7f08e1e7e472d0027323f63401cc576c7e359e7

SHA512
5b18a4fe7a87a7b7aba2fb560029e01166da986cda960ca06ba77d7c2105fa843426df3325d12b1f82861c1a8367ac404565c5427fc3c837b3a8fea5d404eb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb55f0af8f649530cb335bf62763d97e

SHA1
7698e334f041ccbf6403e0730c5b219b34519be2

SHA256
2c80c9ca5295fe898b87912d98447da6c15b87cb67a57f49d9c4cca73be0e35e

SHA512
0f4250318d28950a03cb74676b8d6f2ce3a9c74676db551889fe705d708bdea3b320042fc2c6d2e32905383ec7aadfcaf772474e689d67c8adc465f03827b084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6402c95f9b2ebb38f9f78729c741047a

SHA1
25cf71ad9e3344b2a6552312953b4cb5c4166657

SHA256
e86dd044f31e70901b3ef9d97d333b51d27efee271d3a77f66fb30f00cbe5e58

SHA512
3d733aaf633040df928161c5634e78a0ca84568b8fd1613f501e0a81511e490b4ab3c8bafb5d9a21b05eefe48f37e8dd8363e75d9621d5899049c2545614f89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d72fe3b76674fca48821c5391d1490c

SHA1
37b2e9c3e4e584f18f3048ba7c681725f17b8b6d

SHA256
7c05a4fba9ad0ce3d7bad678685eb1c54d2e91503eac8b9b43c40992ed22ffcc

SHA512
23224056e9cccdb8fbf1186185f0365f8485886c4b150e1fe22014e2a4eedb2305958016416ccc36820d7b3255d05394cddf61861ad80a47274ba6e1b58a4869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2622368a35b547d6f9a71e792171ee6

SHA1
4662e2bb3dea2d47a20dfe42cc17114a27f96ec5

SHA256
1bc97e0a7e622007cbffa69e8b54842bcc3d159df63589d3a5f7f3f960291400

SHA512
29f450ba9709c4d9951319f014c6a068ab76c6c65ba83c653de6780952cf58e8d66d1be180724dc3283788b0d1b9c8c8f28ad686ebe539db90e238ec327f63c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
975a3322af2a352b65a141f05df4bfbf

SHA1
e659896dbbe768d0f104fed5c2e9301e1f0c7e99

SHA256
7316c00a3451a00ca8ddacbd99ad405a84a59054704f3346a0d85c0302ed5679

SHA512
e7641c629ccaaf9ca1d00ca8c1b2d134a62fff62452c2d5806566d8791669427cebe0c34e4cf84de0fca0e0572d0a4d4e0d17243d3fef435ecccbc9a0f2d2e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee740ca36d8f7a0b2d6ced4489b0ab2

SHA1
08ea883e5c285da6b6a7c93104110d456eeb4ece

SHA256
86673e0918bb59097ab1a13d4fd9743fb6f3c7aa371d2eced93b5c7a58964ad3

SHA512
97dda3256274f8a4c420c5a9a581e1f9f677b427028d8909376636b6735a74073cba88ad255a2df50df9c40ebec1e70a569aeaa68ac84661d61f0e28babc12e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5cf960ecf430c3610134219feef5c0f

SHA1
36cba1ca73e88623b2b8e9c13bff3802748ad8bb

SHA256
aec845b5cf49077516b10d7e4ba94ef53d0119a3302b83a62339cffbade38d9b

SHA512
146c79586fa90afa90cd8ff983709d5a941f92a4b38a189a3c91f3015313598e684d868edd39dec4c4c9bd5777e3285f70597f08dd7c0f389d0000641a88509c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91329630ac5db75c94bc6aadf0b0b2d4

SHA1
1f051e0995136149206960237a221ca696a46d3b

SHA256
3903a1f80b2c102cc98d84a28acd503ec881d2bd7427d52baf71d5c3d12e2d23

SHA512
6af086f76bcdb59007c374778a1363069fea1d7df1d47ccf5884d9625ad1c028c19716b763f4bab48ab21defe99dc93b3576bdbdbe8f2b75a2e55d2c8224d8de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b1dffa2cb6a33c9a755fa1a0f7cb63

SHA1
52c898a28a5953dcdaf87d351131403701ce4176

SHA256
362f523977bdab67d970d66475cc2e374b14fff1c9865d02f95876f4cd794d6b

SHA512
5f9930819eb0f8f2da07759e7621aea6f99176543f208e6641f31d603acaab2fbe23de48521540325bf92a05a7ceff4a3be83005b44b17f94f52ab815188cb52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b35f77b99c3c252d966f36f4a213cc4

SHA1
069d94cbe58316fe6cf9f8007432af414cac54f1

SHA256
b91c719b405c2302841156b9631194807d46a3a3ebc33a71a9870a58685b3676

SHA512
59204f5eee887c7d759c3c6f72f112e4825d1dc222a1d89d83e496579f152caaf5048e5afaf62816b8a81ae32da29820448bcd45186d83b75d8d501bcf33543c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a63b1a7c60f3bca4d12f92339bab0c4

SHA1
8d244353742f4c8656c54560263d3ff5b105fe6d

SHA256
b5c03ec41148c5eb5bfe7a722931f6a96b8f80f2de843b909f1e11176777b84e

SHA512
e12cf7e8b4a9479750b5fbd6b5f4f5353c92912fa281c5855569ca51370f9a1426bd03cb706ade0fdebef505cde0e652ecbc7c5ec764349ac3ef08d9b217c6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4c1d677663ca9a7280b127539b9e01

SHA1
8f20cf12848fdf83a9f1c942c53206baa4cbd9d0

SHA256
ed613a373609a5fc943f9908f8260c74fda1834a94d115ada5da7548d6997cdb

SHA512
f0a2a8d5d5debd352009ed2b43c98b3e85a34bc50f43bdfd76876d76489237c16971f473460b2fb056095e421bd87017d5c2695ad484cf6e8e10b70288f2ec46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A47.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit