9b116b3ba15f0a45c6dd1fa7350df5b8d3ba58c49518b32216676be5debae8c3

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb655ca219c26b31ac108855e223c562.html
Size

72KB
MD5

bb655ca219c26b31ac108855e223c562
SHA1

09d30c90b5bd67872c287e5315e1d22bf7e3c53f
SHA256

9b116b3ba15f0a45c6dd1fa7350df5b8d3ba58c49518b32216676be5debae8c3
SHA512

4ad79d640591a6321410c2f7cb7e3e9b39f7e5ef93437b685a4970c630c14cd730b8c4dd494554bd8410918176e32a5c9208320d8c7c2d759919365a4e37f1a6
SSDEEP

1536:KYzabquklcMklc2klc7uG/bI+3zkcKklcPEijZeqhUEijZeqLyWf/hwAbivLIWm6:KYsklcMklc2klc7uG/bI+3zkcKklcPE6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416066832"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE4C11B1-DD50-11EE-873B-52ADCDCA366E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2392	3048	iexplore.exe	28
PID 3048 wrote to memory of 2392	3048	iexplore.exe	28
PID 3048 wrote to memory of 2392	3048	iexplore.exe	28
PID 3048 wrote to memory of 2392	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb655ca219c26b31ac108855e223c562.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b05bc8b50ba895b9a4e252213ce4d29f

SHA1
5f5cc543cdebadadf7a4cf81d9a26e35fdc25d1a

SHA256
9b397a2d279b08835b5a8b723d8b722bf25f509c780ffd9c1764cac702b7ea2f

SHA512
b9834bbfd5925db023324fdadd72bb347251e68010dcd9f0cb5cdd5c9235c366dda5f494614fee605f66fd24969449ea6e57b1a01e6b92ec7b22f49f7d45eaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2fbe61758ba9d25c14df3366f52adf0

SHA1
ac77308b08f3d0c77550347113ac4531b2816eb0

SHA256
cec25ef7cc019fa35bbcd02b254e106917d13b1dc4209e81d2b4f702b897a494

SHA512
5e87100604fefd57c6064b5279ad41530c7e5b16c04f5bd22726d8950a5072ab57fca32243571a7329a5d3188456e590706ebdd75b09cf20b1c7671380ff5190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de7b1aac7fcfee880cd50618499e8972

SHA1
6912457893bf78dc38b229703c5a114aae3b319a

SHA256
4d0c0475e3f2879362125f91ecb79c41d1b2d819484b3d71eea4e8a65fda05b5

SHA512
44b2ba76dae3749ceab61b8c2d705744d5a5700bb55d5194ae1c5b9bd825e250c6bb5b794101e901b44e5b4847b210752dbcf70a05b099feb4530476e49cf867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49602fa39d20adc5b489dc8e12b5f76

SHA1
49a9624b4541781c413b9ae176f4f01fde6b5b88

SHA256
82656a45b567523c2df38c70453e610a2a03152003649f3a623477220aabbb19

SHA512
29f36f11ebdb958715be8abb3c78d147a86371b71693d422772bc9a622682b8948e489d8dc68bf1af67dce2d413b37e79a21303516f272e1bf845040bb6254ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cd4f3a4ba4c414e70b93727ed91be3e

SHA1
d1713ce6b1bf459e075384ede3a6694604068e40

SHA256
a02915e08272ccb1dc47ad12047809d361de7899b1cb28275d13a76326298805

SHA512
f92b582a4d5b744e42c96f1277c44ce92e3364ea23cc1ab7d6e839ee219ff1a4b013bbec7c08077de5978f695b2a7ef455505c7f1d9507540c3cefb88f0040fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb4039086aa6520759c890f7ed7d25b0

SHA1
c70a572c626aee436fc0aa16dd84b3b3e10b71b3

SHA256
05063eb1b1fb288a9b7bd54bcf067ad3bdd212e596230937881e6c18d74fa61b

SHA512
995bee4f4bfde12ef27da8f115bbcb6704811646624291032aa3848d110f8d7bad8f3f639521e8134fc15d7b86067172f1ac545df1b1e26080da8ca33b8aacd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7122c726ea5e09b31d1871fdd9c647c1

SHA1
8e4253f378e1af75b7f5689589c51460151c9cd1

SHA256
b1730a35f4c8653687c0af70d427853841bd03462a365f657339665279d5e0c7

SHA512
04b918c8086df6e87800d42aaab94c62770691d0dbd9342962682e2c0d04ee4b1f23c9f1c0cb77ea6087ec28a8daf3127ac0ae043e160ccbe596f4689185a2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a7fa75c1e93a86bbd5af0e2ef38710

SHA1
10446119b84a88d316e6a8fba4a90ee8e8730603

SHA256
f2fdfb27cd3f875bfaf8663b388b405b0734c67b1929cbd76b80a138f357ac5b

SHA512
23b0a224335a607a084a2b7ded3b56beb6fff5d1de0cc406a13ae4d006db403b5ef6d1c3e3c87387d097bacc0b9b50c405e105c1824da26e0367627f4844061b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
269d4690257bc824dad6cc61c6d2d325

SHA1
2beeaee89df4d04f7f9d4e531d0c49e0d38d2211

SHA256
a4c415df748d4a463334f470a55950c1dc11129ab036ec565310d3bc86d13a8a

SHA512
afb626ca66e32adc6daef101327276838f666083aa254423397d0155eb8e18afa3495ae6ccfdb1728b8644730610d23f02251ca0806c1592740609f78cd8477b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934ea1e4e3a4e2439fac98aee35cf193

SHA1
1e13644b9d35e7e149e40b2d98f322e093d45a5d

SHA256
57e9ec3c7a89a17d03354f93be6d5ca65517eb6c3050420e569276f3b11a928e

SHA512
c1466a2c380e265e267de0684b1e76fcdff789bf780968826cba7aa8760a231994c887b9688f04a9b070a404c367d32c450d9731f333714e1628947cc008d9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
7ba158056e164c5d58e4a0331d2a4800

SHA1
becdaa027a6d23d2588b1bc0122a15a3364761cb

SHA256
a8b2107e73855c75aabc2728ecdf0a78d3b28ac1664f7f761fee83136c8b9a96

SHA512
076c80794610cea1a4595a878ff12b2c60dfe550a1a3b080a1f1e2685ae656a963fde5977e6240c4cef1b32637aed068f2195204dba3bcc544d3902221f9b654

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FA3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab210C.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2132.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit