6f7cc8e5acf34342a2bcefcd6c46507f9cfd6912fdc6740a315d6270a376e2a7

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

background.html
Size

1KB
MD5

765526318b49b078d35a1a736bb96eb5
SHA1

6dff92a26b1e1194f32ba3f55765d6f2c705ef29
SHA256

b14df17e9b5eda2f908d1a50d37bb287d4c7a42f9732d397323685bfce1ca2c3
SHA512

a948e1be69de00552772d81cecc62cb260e9deaa8821935abb94194a5a4f5f547e47c65dfe2fe156008aaf69064cbb08bf3a874003e31c4cd0a5c580ba1a8e75

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416065166"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED479341-DD4C-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000470679f6b20f9374f5d66070587d8b97e17e40c579fee59d599b1adac482ab3c000000000e800000000200002000000057c0a24c3850cd8128e203f9c66278cbaf08320553f63ecf8b20fe203d8fe77920000000cf8bcbeb5c9be74fb1e3b041c552f86b5f372bb7acf9fa1092afaf862f3d184540000000495a31a70e582ab21354753cc8b40ba8fe43956c9501d9583ff38f2dbbbeafffb326c9e12fd6ab090c1489df8a30ceb0775afd08acccb960c05957ded6335780	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d5cbc15971da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000e20b70d845f93fdb59a6c5edc48eb7fa9194cf2791a4de4a54a608186dfd1521000000000e800000000200002000000040791cc4a9c9e7e2e45fb8629996cf35154c93df6512b6c562b908dfb302a0e6900000005f5ab6a14ec7ae259836d3aa576d6037e7201da10d85c1398b3f2a0b81ccaa40f6150456cb1e0b6d041723e6b6db92d257679554ec98fee5b297b429309e0feaf16e691b38e93e49e85600a9cb1c4acd1bb03fd6d23b5f4616e0368bc097300ebaaf75304756b3b23fec79ba295f6baf191849b6251953ce2072fd6bd8b354fb11df98e5038aeca9f39905125e47e3a9400000000016f47dabaec4801c19e523f14d25a11d26320e81101981ddb1df8754b9feb4da84ec8946d45c701dbbb32883c556efb59505400c64a150cc40d448fb57a149	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28
PID 2208 wrote to memory of 3028	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\background.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49473477a276b5fcdba12a880d2e38ae

SHA1
feb7c4e80828c6cea8ea14e7cd5170b2e7045ff6

SHA256
d021b06d46cb082a2654f728f9f699087b541201b8feb502d271dc3d2f6a8f27

SHA512
823b89d3ca26b181a71608d371a6a5d23e9b3d139a352cf4f38568d410e069921e47441711e146657902c1f8f4a89064cd62dfa0f3f24a91cbe19e35d9b803b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fdf472e7c6c2cb83b524ac97117b671

SHA1
cab65fc90296e0a4ff22e4a9ed2682c596ffdfab

SHA256
90602b9c53c4bc34187cc2a2b1c0b95e91cbb60ee68228dc40fb6d9a3cea2dd4

SHA512
2f3139fda937050519aa0dceef386f0bc8579d4a17b5a8240a24583ca0465875b77620f7182ebf4491e2e29e324051a791e55ff6e4b80a32a5b210a361c16cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84552d53a368bed3ff1a30f84ede8362

SHA1
c85c53f01bd682362d6b3914797b90ca3b5335ed

SHA256
e9236f07e4507ff43ce0de76a5a8c187969ae3b0f8398414e0b84875f86132bc

SHA512
c897d88859a8338c3ccbe8bd3c0f704a8c47a8569d89732dea7f46a26710ca0b738ca8d4a391b6642baac2452e953d97828f6c501c8c24f2d9ca8ff8952ad615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefe04c71a1960ac1e9cc9e8625eaa0c

SHA1
86b5e04c76647e0712723c0fb8d884a3a2f7dad9

SHA256
48110e3e3187e9aad101d1c4ff92840c7df5b86afe010aec6430a75c38ad93b6

SHA512
9a67ebbfb7a8d199f6e1c940c2c42f5265116461c49250b4afe0bd50126214111b8cd99d283677ed0f753f30852debc19467fdbae384aedbe2a836d3b8faca9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a48aa194f81d603029cdfe8d9209902

SHA1
bca090dde42d165699481b324f744032535a2f92

SHA256
d568e83eb0b826ac13ad62688e089648df3a8eb7df6391f2cf7bd6a5e6ac5572

SHA512
ec9c2f79bbf8942796230d2909047d530aae3469c6fb4f27db3614bf0db61416c6f1ce87d50b88f213d2ba936710653874d7e8bb618819fa79c04781eb7a5288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeea05d30a352ea1f60e8ded721cf270

SHA1
a88e80f27e75319638ca9ee698735bd24485b397

SHA256
f3b2235b767dec34f0f8e5f8cb05a2e1e60e722375a0655a88e01ada4343563d

SHA512
bd473707516ab372ee2e4495e68ef12c5726164946ea7ab3b8f35e98871dc1ddc1b589fe8cfc3a4bd73d903c9c98d915a6f0d4ab81c79e2f3adf3ef98635e4d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9fe93eaf112be19c82822c28247f192

SHA1
c5eca1c27cbed35f6b37b31cbfac55f47073ae98

SHA256
9d52bbde3a811fba82e03276915580b8574330a034f2d139bcaf6dbc9b58d2d4

SHA512
5e8c67ec9f88230da91d15b4435cf4d2dde83823c174454e62dc018464be49676895903c648f5786f247b11ba8341675e8e7e1bd90534e2e7ffae88bf131e559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b5e2f95800936f33dd31a6b7536cba

SHA1
8953ea71c4a8dcbb08dfe33d5b694da1834d2c85

SHA256
b6d95fa3a46f57564ce26f98e0b653454daf8c6f586ab47d7d0a04d1f3ac3c44

SHA512
2b6075247de9a74120d964ecd9838dc41b535ac16bda7bf3594ff4eb8acf975b5b1c4f4d0a1ff7fb49421129089c164176d8249a06ad8752f0ff94163426826f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699bd3e5113523cea00d2c3fe712c852

SHA1
3ba5fb1318a7187791a6c2d6e7908868b3737310

SHA256
add18c5c57450d355d23abb83f057ca658fb21b44add70fae2cf6137b61613ec

SHA512
fd7e223d6a81d799fc43e99655e370e9db4848bb3abe4c3600784fdf1df5201166621f21e40241c45ab52abeebdbd5ce5495379a4b2d4eebd4091708f258d841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
740f88b30f849be969958c67c919475d

SHA1
b9bfa72886e7cfb44d5a15ee7595d032bba787ba

SHA256
6753c1d038aa6b7bdeabd9d4491cf0d22d66748eae32f651b62c0ab2abba936f

SHA512
0eeae749eedc356581d9b7c5105a164cee5c22e9861ae267f4c753bed21823f1d1f0b1125835daf9ff66fbc3c01ecb33e6a6f0ae0183ed9c4c7ff57fbe801331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2e89a72abcc722dee6d9c2bfe1d019

SHA1
751511cb89492cb84821abb3b693113ca1ec8e51

SHA256
5dedeae6d5a90d34411ee31d82dcc9ccfaca0dc00f857dde21c39f9a5e47aaab

SHA512
6abbbb7b9eab859fb6e91f82ba8935eb122738bceae4f739498750dcc89c5ca1f17d22b71e9e7b84c291104cade90652aacbea7abae5749b1fed6cb23a48b0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DDE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F7B.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit