e29f7b0a255e390be2d2b542c2899a419f83633ef8785135218d5514a13eeeef

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb0b5999491ccf3976bf299da9f01cd6.html
Size

89KB
MD5

bb0b5999491ccf3976bf299da9f01cd6
SHA1

3d291997af4b7d7a40c7f9cfd334cadbf31d4771
SHA256

e29f7b0a255e390be2d2b542c2899a419f83633ef8785135218d5514a13eeeef
SHA512

2494c188fc41b1a58d5f61b8251fc10bdf6be457daad89bf2f430c089e1d27fca571aa9f9f6b6ccdcbed05d1ae16a203f2ce0858a1d08fae87517032f0be6885
SSDEEP

1536:gQZBCCOda0IxCWQgQrz1dVCUeQ9HoOClm1p1MM68449+qnGZeWGfPxevz0mh1k4t:gk2M0IxDPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004af161ca5ccdf54f4841f833e7e446434693777f15867e7f5af6e071c46d99cf000000000e8000000002000020000000d87ff289d516367199a16b07f696d67e0788e5d20a51745f55ed4f582e38f3f32000000053133eb97d4e942e5d00c0dd7ef593016358fbb769c3fa8d9650d8f1d202d8f340000000e0e7bf60440efe5c25b81a85186d02cc2568f7453feacaa68e9957bf9c6bffe332122e03610810e25a2dc2f71ff243b1a560a09d349febacb88c36bd02a89910	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB60FD01-DD37-11EE-A01B-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0521c824471da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008818b5e59097f196fd86426b07f27d54b12103388f7316b03d30bfbdbf4a9f47000000000e800000000200002000000095538f6bc4235adc4cd1c87dfa1ce27fdd39a03cbd6e477dd6f4de20526c5326900000003575d927de2a4e95c7a2bab6c8f51c3b55332ee6d6bed21f87b09057193d51645dbaf1d3fff59d32694a5aa6457d0f9f37f2d1ff43f9dc16cc8fe3b31bf34ba97adc58b1366eb33218eb45f722f4521760820148f366c71e9ec933a83ef7fc1be328db664698cef40d3839a9b02db987994fcb944dcf4e8c1fe13c5c4bbb22f81de0601c4e64e072b608a890853e96d34000000007d00c7cfde38595b7d766a1512d7ad52bae7a042248142132bb87675bb027f740bf375cbd14e388182a54a5c8ef28be4d8e4dda61cc1dd7fd5aac35339feac4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416056039"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2936	2264	iexplore.exe	28
PID 2264 wrote to memory of 2936	2264	iexplore.exe	28
PID 2264 wrote to memory of 2936	2264	iexplore.exe	28
PID 2264 wrote to memory of 2936	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb0b5999491ccf3976bf299da9f01cd6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b196aeddb7dfaab0abaebc033638f8

SHA1
6876c046498adf3e50f537349002676952673bfa

SHA256
c4bcbdd73ffa8cba17243e1631d65eaf8b50fc12a99bd3699be0ac8fc37d4bd4

SHA512
e178d6c81dad33c9f61a4a340038073b428a5aba67605e1f5495be8ffbc29cface6baafcf1f1f04efc492d550cddd545f55929b3687c9a1ce6de5373a980e371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0517a0b9b8e1cb87f75aa55d4ce7df7d

SHA1
35173ce5ce3de08c72cbe5cf7376ae0c550ebb14

SHA256
4020c940efd0b939da9d50f319f411858cef3f608f6ce45b13cb3f156f3c45a6

SHA512
c1c6d2e13b35b6cc665408928d7ed664c0932d05ce8e8a635b210768463eed4503f21faa4c29646af09b45701f051f0d0aec9fdc3324d4ca16d306070f210f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727d6ef3003dfef5d37b7395e042a3c1

SHA1
ba2d3c423a91dc100a451caac120f6db497f564e

SHA256
78ca8436a8c81df24a7a361759881e5d95897282b288dec4be247e1b78a63f6c

SHA512
5f38f19ca6433710dcefd34c98d3eea5e5eadbcea21b504ed96d21141c3de493dee710582fefcbdf69bd0b9dd7ee11cc3585a8d6eeed7f3b6885901388a0de4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd77d24d5adf222d11a9122aba95fcf4

SHA1
9303099cea2a624cbede1c281a23cac5b698ff6b

SHA256
38b39e2514e12ae56049599e7dcf77a222494f12e66306515ce7b547ce263756

SHA512
ff8f94f288a5389000ff0061600f599e5ece9668e81b8528eac2949af3ea2f88df2e0243642ed6578611133813ca4083df7ba7100c64ee8adac830495ca25e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2dd24f246467f16c178aa3ce2b59e51

SHA1
65b6b2c96dd1b096880b82dfa1de5dcae5cf2f55

SHA256
7e2f98fdf9a7585a01b62148be3aed4bbb8991bf8a02fc1ef862698ff133c856

SHA512
006666e8896856db53b82d6137a689ec953c0151caf4eb5c2aaa429fb68994ac1b03b4252d68e32d6d5becc9e6e003dd3ecf4d1a37ab4e541de3c32d44e59e70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97eb7ab5bb2b8a24d7d27ea6f2b5d8a9

SHA1
3961596b64cdcb0e33bc503499937384cf4f0074

SHA256
24f8c6ecb5b01a960b9651ba76492d93e9dba762c793f8419e923ec4973102a3

SHA512
f649d0cbeb73c747c7231d1f7ae8162c5e089677c17d7b9a11af3d96d2131db0e14eecc5d33e4027f9481f718314e6876e0ad7ca73f345ca439d9ea7dc505191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b41c304d714e15550f1dbdd53e82caf

SHA1
bfa8017199268cca9ddd2ddabcbab5ca4d416d34

SHA256
4e1129efebab18156a4b78b68aebc91a901f5cb96acb4384724a869022633ac4

SHA512
378c716dd87a644077305b962608c2ff52912b84bc16356e9e435adfc05173cfe792db420585b975052957742fdaf7219a6f890b72c0ae8c7b013cbb0e00aa4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02fb74bc2df0f669fe89cc9dc35c4d31

SHA1
7088f36b489bdf55def7a7f0c3d9a23ea56fb96d

SHA256
dc0032037ed8f498af571a34ea60b8e2560237a194aa00dc0db800f31ac88d75

SHA512
2b00b2e7d961ee157ad64f1da44780743bd77eaf0d72f60c653a3cf36c358f45220a65d4d65d246318d70f57f3be97245a3b5e95c50f7f0758cc93f6fe759ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094811d19194df237b4562377d052e76

SHA1
2562c5c6f5f9fec077b749952386914df9ee2bcf

SHA256
03a0e61cb12af13a5e04920d9dcf47ec86ae7db1f0b70d75cab74e1911d34604

SHA512
da9824f0f94270d4db3b3e771d43704731f2412b9fca89cad4ed7b205aacc268ad3d163447f641a09f463324dfc25fe6d0b5f6de50eac1fadf245ee33419dd75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eba44097301b4683b5ea882c9a3d7b0

SHA1
ccc72f02bd5e89e70ee3ba7ff941a28cc10af361

SHA256
1d08c79c798318f469e9699d2b51a033630600847dc7e3e4d97584499dd5e9a5

SHA512
3d1cbbd8f23918cf5a40b099d668054b8d41e7c0e28796cb16d2bd860900f1548a43a0bd087d0cbd65b2650238e093da5a653dbf8dafc7c0da379be35920526c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7db9ae0427da8b65a25a511fc68b73c

SHA1
b8bce985a573ba5908f61bf9475d066d753f0958

SHA256
0ef918a9bed38c627095c8707b83ff534b7dfba81b68adf0fb16830b6ed3a6b7

SHA512
2da858a0c8982952cdd701f63530dc3962c08620d950761dbf5e8ee341493bf3ac6e71caac0c315c71cdbcfe0abe7df632e2c6b2a733f76ebbc337763a00af4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd5f23c7b246b38ebdf5f192cd796aec

SHA1
8a7ebd800ec17c7e7893a1b25c0175f556a48a04

SHA256
06ef6d1d93cb2114b25082b95e00caf3341925fbe7c0aa5f570fdc5342309160

SHA512
bfb4d3836ecd6b2a53b3de0e86f7bf9957e556e23e948e048db4af61077a924d311d90081e6598623a8abdcdc0b22353534c1a666fb6014711b87d9e1aee2d3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73194d25669ffb303fe07f4cae953c07

SHA1
224c7bd063393c15f7c1288a3d1005820397a722

SHA256
3e2c9e10ded38764b98b1a6f4f1c9475b61f36950cf96a38a905ad7956be7de0

SHA512
897f33ad3acd45f926266b57b6412ec1ad77ae624a404eb7987dd7d0765582d7ae45174526a602452c707467c662b8923abfddf7e7bb4d1ffb5a30bbd53fb79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e44cef9737dc243ef7348119ac528f0

SHA1
206b68ec352899ac3b27ab6e86974ef0e44e6067

SHA256
d20759fe1d12d7982e22d860cf9d53df58bef9cd527b6c12a9d537f77766c63e

SHA512
8566f1e4a2fcf4b607f64abb5af91400a4772fb88117f43bbeac5d5729ec049d20dbfc2f009964d9d975abff96b41ed197118aa175bcef92cbb692a42f05fcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46d3c08fdc6b27fe7a274fee8e0edc89

SHA1
26cad7f8107dbc130f1ea6f683a4c1e82bd62f2d

SHA256
8af485888853bfddd44a9aa3f490f4caf26cb76ff20b8abd7fd12177adcc5e39

SHA512
16cc694f1cdded0367799973f234a179ec80b996b9042defeeb60e3d50506ad27a8b86d233ec1f80da6bd10dfc7fb553980077afd106a6f109ec7bb928612e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3298.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar336A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit