a837756becbd5996743386dc6aa85f0fd3a87d2d716d95fd3e55623ece8d3d49

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb0a8f16876c8bb245453085707f945f.html
Size

6KB
MD5

bb0a8f16876c8bb245453085707f945f
SHA1

48ce2f044c453a9616068c7789ad10a8d24f60f7
SHA256

a837756becbd5996743386dc6aa85f0fd3a87d2d716d95fd3e55623ece8d3d49
SHA512

44b1695b5ae4f51788f4664a5545facf76319bc3440d278e17e61a9176a00d22546f7785732856f41ee5b22d43810b6a7220bf1a22f0a781d0bfeea93457f3b1
SSDEEP

96:obLBu5IEIjVaatJG0TYn7G11MTCFzQWxK0zu1vzKvc7OKa8Ug31ddIfA1Q/1Rz3x:opnadOOezvPzgx4bPnM29

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000012007bb8dbe04104e97a243962627ce742bd3af2a08374a5a73f472ff89e1d1a000000000e80000000020000200000000dcdb704482d69ecfb029abe72a6bbb3a24c121729784f24a89cbb3f89c479a820000000806a8dcfcb885073c03dea15294ba7e8c81358d06eed58d25a9a9e69c85ae70840000000f554176e5bbae7eb2a08163166b730d1e2ca9d0defee1dc8dda1798bd399139361a2aaf38e890733ef17c79b6383f11ed647d8372ca226b36efbdca594b8ded5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b2504d4471da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78B2B6F1-DD37-11EE-B73D-E693E3B3207D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007b3410d507c4b343d0d40ebe8b181af6d33d20a69f1ed6e5bd9ae2feafe1360c000000000e80000000020000200000002466c3869b3e2118db566de81f5de0b20867f27bffa447a4cdd19cc8f36b477890000000e7dd90035eb3ea262f345ee8158ffe91d94a3f7c629ce930435f6faf640cdb1adc7320fab31c283e664135cb3882706edb2276cb1723bb9ef0230e7a3d1a8276dee432f81911b40e894adb80ee5e188d7aaf2b5f3104327f5ef49032ec0e0fba9ba3d16620e96b699de794c859ae8e675e7aa64050677d52b963f1de46d0fee87fc761c9333edbbf8daa5caf9fe7dfac40000000fffd3d765753bfa7841039d2cd0acf560ebe70d8601dc8c7a4fba83d80e90c719bc4e739b313f266d4fd08d53b75b123799e3f585928b1a86dca375fc7307471	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416055952"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28
PID 2156 wrote to memory of 2120	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb0a8f16876c8bb245453085707f945f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b72884b9b3df95300fc72e0dbb6525a

SHA1
e5db3bf84e5c80538d136659a0b897cbc1a4af1d

SHA256
8e025caa68dd7bb4e0b30ba72d85b94bcb2094e9a9e6d8b8f0976e585a80afac

SHA512
40148a0890a5581b0b12c149c8350083e9aaaa97653ee275e514c0ede967e9d021a0390f575c23fb5e1efb3e8d88192cd207f5ba323aec63bdc884df8f8c6114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e615c489c2819a7c3c7a3ab1435ba61

SHA1
004be1c17679e9ffd9fe082c7d874eabdf6289b1

SHA256
60156b7002a39b4e7b5afb62442e4e3bfb71c6b010762fe1d214662b110ca001

SHA512
c5fddc4a5dee904f08f7a2216a6dec6f9f38621ce38f0aaf31b82a1590db2a38dd672f6b3e907a5a15838c88215b2ff2a34177e23a4346fa18e46f7e3c54d03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988929ca01257ee7142926cbf20fab2c

SHA1
bd265fb1dc54387b6bceb4017f825daf3b6b255c

SHA256
ee58709539d34d2ee6522161c8971eaa01c930bf0989b69918245a796677c6c8

SHA512
a84cc757d54b44638226cd5ce5d16cdee2401f87cc8458cf05aedc259b1551820451a6018f059d656539f52d0beeae56c2ed76c61fe73a990512498082f139a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47e4358598cf3bf30d096ecc06b5490a

SHA1
2c68eaa1e5502eaa8aa346de719323f6593ecae0

SHA256
21f536f43929d1efe36a387c3bc5e4589a0757627b6bac634eab200655bac5ca

SHA512
21ec9d76718f82ecf58bf3089630ca9b983d5ddf088a2fa733241f6a2cd3b9b4f9e72c31139d375601c1344b2345970c4bc21dafd1e398c787caece225e321f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616b6f1b3c7f9dbc0479821ade807264

SHA1
bccb06d55ad53f82abbb98d9d120362c6a643554

SHA256
04822b6b366ebeffa7034a33ffc6ae515d7f45caba1da2aa6bdb79ec33eafc4c

SHA512
a15ab34ccf879533e38863d2e94c230208ea952d7c27f484ba4c21e9d9fb06c0a805a7310d68080d0a53b67e5e6fc3e1fd60d6d78c1b46512c9e1f062078ae61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beca7713917a7b75a037c7b567a87c0a

SHA1
9657188f2e0415528402214e443a8cc6ec6c2206

SHA256
f1dfa4fe720cd5b28a1293c82a1f4343811c289ffc73e0f3cf34cfd5547bcb59

SHA512
aed05e416df9973351ce33fe0ead271eae38286f19b114b23003afe8816e9bed9918ee88b8be31f3c5f0c22df1cd61bc5aec940819bcf43c7344e77d5f503bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2017.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit