dcac9d94a4db9c7888a1c994f49dce481648c3219ad6799ba8b4d7bcb77cde1e

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bb32680934a233e71fbcccd9553b9c13.html
Size

6KB
MD5

bb32680934a233e71fbcccd9553b9c13
SHA1

44b3fcfdfbe6bc3daf11deb9d064e53080e96110
SHA256

dcac9d94a4db9c7888a1c994f49dce481648c3219ad6799ba8b4d7bcb77cde1e
SHA512

6411cd4d129c901717360519b1813ef0192bb9c1072dad11f056f53a7202f66797c80bfc5a8d915df0840096cb3f396ec97651f73997f90fccd436d1908833b6
SSDEEP

96:uzVs+ux7KULLY1k9o84d12ef7CSTU8ZcEZ7ru7f:csz7KUAYS/zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B64E0311-DD42-11EE-B17A-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000007441774531a384fca3ed4c1d61b037db9e665b5bacb63138afa38bcc06d791c6000000000e8000000002000020000000fa70b88349e837ba761c8e676e0df532b2a811534515b9e7da9fede41cae3cc8900000007dc4f15074ef036d1c5778e5911d064225bfc85e1a27cba6004dd81a4985295dcbdd346f80f6ed15df2d90eb0dc32225d8fed001b8b084aba51ee4afc724820374db9d4015cb1be760b3d0923d45814bb8655ab819b656112ec806c1381a21568984d167b9dd6a292bb26aca6246e22462d86238072cb274b251005102b6d0468f9ab5d55d63ffcc43d7dbdb89af98c540000000a412a78285e4795f2ad5b1d44a7b2b6e80a37d4ce579d9722794846bbf3394755b138b2f3c44cf0f66c49119396175abbda06803439998a71b70a7e76d9e6e52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000007eea0935038b0820f84e5a72bee5249e62b81e08dd621951fa66795a9428b6f6000000000e80000000020000200000002c72d13ba312dfeeef679af49758b5d040dcb49f9383bbff8164648c62c39386200000006f9c8ee584e8b3aa8025c99fc800eab6001d227f6a80aa2f1e2cc5122e8be69c40000000f5c81a6dfb9005a8ea366298377123835109d8eb3e2f9ec9c727ca6999063b4b60c1228da52bcabc4373dbc3d68a1a3a11f830020bd7dab9eac2c0ab8acb8f4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416060778"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60214b8c4f71da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1964	2368	iexplore.exe	28
PID 2368 wrote to memory of 1964	2368	iexplore.exe	28
PID 2368 wrote to memory of 1964	2368	iexplore.exe	28
PID 2368 wrote to memory of 1964	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb32680934a233e71fbcccd9553b9c13.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a65edcc0aa023cc962ff215d42a7c0fd

SHA1
c0e3f3d8b96507a26f19fa29937ed899d28fcec0

SHA256
fa19dffb15a455c9fb31b74783c334aa3292a6d0bdfa3f27dbbf41d09f9c6845

SHA512
3511b539fd3bd324c5f6e3f8afac97827245c8a9fa51178bb8e4b9e5403b60e38d3ed2c89b26fd1248803bd6e80cf7d3de12223416b21aedce45573c1e2d03c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b190936867cd00cf28e30f3afaf266e

SHA1
f3e16286994e34a196fb71c117e3838185290ced

SHA256
9f1f3e7b5ce8bf6799bee36dd5e0c353e1e97b7611dc1922b5853ea484316a03

SHA512
a7578611c58e05e583704b1d3fd1c9755e647dba61f83a25c91bfaedec79ac144571e347841c8ba128825b9dc5207ccb5f5940cd72fcec072f4aa1d61e0a3e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ee49ff730b17f131b5700b88cbfe91a

SHA1
dc55eb56277013b3ab50eb678e40292f6901c351

SHA256
bb777d0a81afd16547ab508be5ff469fc28412ec191c47103e05a5f1b1d5b814

SHA512
360a3a79e290ee85c86a2d8303cd52c1ae6c42cf390fd0623bceb174d17ea3f213f22f6e071c50343f673e67dd83b37a151a760eb13363f9fd46c27fa59b8307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15683e5bdc7b9d1a9d236af4af691ddd

SHA1
3766e02c69f87e0649bc4bcb14aaf89a25871803

SHA256
7082b4c24aad78fb525e570e716f2115d58b9fd2f1a998605586fde78f501f99

SHA512
3b07234fd202ceeac454ba8bf872016e82a8a2d2b85d2fd801830b3a913b676ac77b0734cbca7ffa0595d365f9d70a66c73d41164fef73bee0588d557a244f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81c1c4eda42cec54762014b1177b7b9

SHA1
49e6fe6dae7b07091d32f4b61d813efcee134f3e

SHA256
31189e9138648aca94f823fec8643d47602dab2bb3494b7d0494fb169efd7e9f

SHA512
94f092229994d9c0838a3fd60219493a1825ec9962282d5394dfde86d79852cd5209e7d9be52cf5ddbaba34b0db0bdd07a0f91324de0c468acb3d90a27efc551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b76ff28e81d9b4c6c35c792e88c666b0

SHA1
cdec0da7545a73721b7169413fb2981a9ee06bfb

SHA256
a0e1af249619499f3f723b5c3647706f38df919be00dae91281b6382f2bed5a7

SHA512
9edcfe0824f12bd513aaa2e5c32b12925689bb805b98855516431c2a8d2ed0b2a5f6d074d99ae3ab7c449ddfec5e0067668fcfc800481afeb81c86d5b64ef5a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e4fb54feceb197307044db3000e4d96

SHA1
be7c6f83f6c63097ab40508ee8794cfdd1729f04

SHA256
193984069d421b5fbcf50a6f0d714ecc15286194ec06fb0ba4ef61b39efbaf6f

SHA512
67009125d1a9fcc30a01469198de615846be8b549d5ff2f63815b6b2d27ac142c1a488ce52eb41973f0b8d8af7242522fc3c5fccc977f1989ec1db31fe13119c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c61a8e1f9cd0192dc743f99513f90a8e

SHA1
6f9c5d6b374017232c61306935649c2b670d5489

SHA256
54d0f9630fbc8779408961119d16c6a140d3e94a1ebe542121fb8740b21c2f78

SHA512
cac1760e03bc124bbcce8b6f7a2e7491ab84afc556eb0c2eba5ab0ab587e24191daa61d79e412cb303d5acc072660a52c8009f8492bc48e521e1a0c294a27ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d02dd3d2d4ce632d3a5a5b245165bd7e

SHA1
567153b01eac584d1a9d2cdea46f2ab53fc90e93

SHA256
a68e6a6883da1014bc68b787e164b41e0567463b846da767683b78553784c4dd

SHA512
5b9e503462e860e91b0dc96b48086bb5c1b35bc86465219787d2b8fba45a88d9456ea76b41c5fd2dad2b2b36ebb48393bc09cac56248c9ad7a3d83a1fc9100d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d58400e39a2c9db064c3049009ef0c0

SHA1
af0f839027f21d5ccee479590ea80f17da9a0f4a

SHA256
75b15244c26274722071a69b701947d07fea2c656138e2da1c7f8c67b5bdf3c7

SHA512
f9d2f8170c5c7a0ad4e6c622083e45fa755e3bc275f539e606900b89f5219b0d0b8cb7111da46efa880f5f5757a388ee3ef4f7482632a516cb4624ea39b1f3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a66f183ebf36f820fc6775ec02e2ea3

SHA1
59c0a89a1ff7e130e233d82206f75993d57c40f6

SHA256
dd850fca0d7cd5543e07712f1ce67f143674e0045247006fe39b9edc4e3e21d6

SHA512
57b0761227b5472b7a36e8bc16b329963420adf0ee4811ec38cc6455b7a4419f2bc591cd65c3971066fa8350bab0987cffa964cff9bc32c397dc30d43670cd67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec94cbae9818bd01d5dd593b7aa7fa0

SHA1
90ccc442e9f6b043474522b311be82e16a0afefa

SHA256
7b7332d5f4f932e0b437ed5a55176c281e6aa68062d3671822011c0467981860

SHA512
5cd85830981a6f1cf3bb9130f31373e55321d6ad6d1da098616eef35a4347e3b8e14db57519dd0c671dffb44b26f25748ed61564f251a6e1d3d5dec7fb730f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11bfcc87a73f131e5a058c86735415a8

SHA1
a2d47a92927b147e9d26ae229ab363d545f17f7a

SHA256
bc20c1281bb73048ccf4fbfe591a3eee364729723fc3ac276091cb86065b7795

SHA512
320f07e6aa2c9ada90c7a890d87a720d4ec41f2e521cb26e3c0c288d12121b97e6bf321ffb2a1c51987eba69bd6953e656e6c72608dde20c30bc5c09fcdd18d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2fd8405cc430e6816ae745aa5fc932b

SHA1
1f960be3a4713d7f0b3d102bb5ad79fbb6895944

SHA256
24c8bb382d848b62ec7e459bbb3a344b1943990b07c1d6d9623ae24097a22ccf

SHA512
8e553b09fe85cba2f2468ad8c835911519fa2e65cd9db0a17ca97d923b2e9e88ecf898eab9db9728123ff6cb1dc7515c19d0d97d7d6fcab5a4fe85561b921f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65BD.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit