9a1af3a2ca88dd862e43eafc9b61d5ecdcb3de9219d4ba8303ecbf9122bab34c

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bb8f56999407d5d1803a004495b4bd2b.html
Size

25KB
MD5

bb8f56999407d5d1803a004495b4bd2b
SHA1

0cb31937fb0de31e76145b551373d8afef039ce1
SHA256

9a1af3a2ca88dd862e43eafc9b61d5ecdcb3de9219d4ba8303ecbf9122bab34c
SHA512

9d529a96c6b67300feaea4bb2fb5cc60ab57ee51320137900eacc1aaaad3cfe3ceccdb487eaaf7fc2f0ed7f65c32d99daf75900888f8216cc0ffe835dd8d2011
SSDEEP

384:xy1R1QREDBeCliOwUcQ1jBD8hE9Ca6XYa6nlseK82XKRsYuo8CPRrMO77OM0TCt7:xy1R1DeCUOF1jBD8hE9h6XYa/aV77OzY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F89E4DF1-DD5C-11EE-9387-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003df87d935646b7a307c9021f71bc5feaba6b67e522b29bc71fa7af4ac70b6fbb000000000e8000000002000020000000f72c85b054811ee019abc4d5feba811e8149c91ef7345d0ec8801e9c7eb76912900000000eea5b6fc8d7eb60ff6d3d768906e504c00e8f30a64acbe7a9d17d0f997b20b0bb1e9c050a0b85251429d2c3e4aecfdbbf79be434abace83f5924d8a049b8ab6e24b0743b1d9c726ab4509c13d495d41ab18e86d23a26ff5c03486580027785d097aa5e0e9b6f91c49fd181955b4ed30ead3d7d2925ec7eaffdda11dcae4df2e73dbf4e61e3e4d849bc3518c899fbf6b400000004b0d9de6df9a0ef7f2ee6ac2888041b53da7eb431617d72acb67772ff17ff6525ab517a5951604a47ed0d6a318c72dcaad7c0830d0fdf7c178aea1f18c8dd2a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ede4b0cc6831263091b8717408b8b8ab25301b6f2821d160952f7a0e23ae9f21000000000e8000000002000020000000c39dfe6002fac0241c5cda9766a5ea4065792e04cb6c8d36ab457056eb81161320000000f823505b96f9cc89ddbf299094ad5b298ab282668244e2a24417a4b02a564d5b400000004f4cb1e9844472d790aad0f789e8609ee36ff868cead5c69f9be8014c8db4866e0f7b073cce7ee143be795e6d940bd8d71451cb378729343540bb7035391bc23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d343cd6971da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416072061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2520	2696	iexplore.exe	28
PID 2696 wrote to memory of 2520	2696	iexplore.exe	28
PID 2696 wrote to memory of 2520	2696	iexplore.exe	28
PID 2696 wrote to memory of 2520	2696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb8f56999407d5d1803a004495b4bd2b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11eba2d33489ddfa0e4135c0fce939f0

SHA1
7017fad5147a8e0be215204179d92cb1b70fe8b5

SHA256
ebb7c00d7a93dc4bafccb6cb50a0bc1b6c6a2dc989572b9223108804cdad2006

SHA512
245ab45ed1fd1c4ce0cfde905bbebb035b95e4559b16d572e840eb80849796bd1a9b258a28e973b9cc08dd6f0adf3db3e91088b56ac32cae49254dcceb6cbf45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92bef89d7cda2c81cf6d69cfe3f18013

SHA1
7af08ff92a117af042bb8ee60b679bd04b351eca

SHA256
44aefe92254120f999c84c0a400e5752f659a8204b134bb532d63aa09920ba0e

SHA512
d7d63c5ced7b262dfdcb150829ab84cff43253567d8d3b6c5bd1a169ba524b2a83b513ed7ad9457e29703401c981b0daad8986e3066f91ceca97e0469091ed95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8772401f34bf0ab389f5ecee2c261f82

SHA1
6e339030977d4a6133ac1e2a76860afeb84ee921

SHA256
4869537b9d3bf09202232130b49f4a81f333e8d27e8db1b19247187907fe3a98

SHA512
aed4e4eaf1b9369a815190826676b31388d8ce17d7e7722db0a484c991ed25db7d0a0d267d2247de67db3a91eedbbce7eda6c30339dcb0c8fe7c1b0edb2d71b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b9030dc09729989ea29bb05b992c3f1

SHA1
5fece3b275cdbff43ac21e91cc4660791e907067

SHA256
6fa0c787b70275d86295ca864c85c987dfcc9728a596ad212ee6f82d4ed7b251

SHA512
1e91fe8a0940799168a0ecd043210c8f7807c64eb5dcae3cc8bad8364996bfb1c560d22c6867e7654c54a51c336d1cdab2d0f1335492623d4e314cd5d713f4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09aec9ef7563afb98361dfe0c618d9d1

SHA1
ab4a8427a67efdf2dcdbc93d04700024c6a7dd48

SHA256
d794a1add14defaa1ea6e406f26ef5b415934e658b66f56632d4cb18da4463a3

SHA512
d76e845977e4ca87988635dde893e9ebaf47ffcd25b8ffad1ecb90454b6263549e710c3e3dbedfdbfa4083be85b6b893088de5e033cf108a54a31c82ca0b2497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21001c6d96fa659ece8f38ca71526b8f

SHA1
d35c8fd05822fede64f34a7c1a11e59f2b03985f

SHA256
06a98577039f3481fec15a3b6fc9082bc29b03b58328ff59cbfdf9c7c61c6bc2

SHA512
fe570f144cbaf507e15dc02249bc031e3428c89cb89dc14655c039b1831b273771bf1785b57038235176cbdcc2d10291315c3e97c6698c87e339d22a632f8f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
350f6e35674f8b16b2e5ae27116c150f

SHA1
412d39761b71c8db5527b2e4881e0676fd0e52c6

SHA256
ad0a0cdab293d54206e0ea61423a7d9308320e5382133eeca996cf6225082a21

SHA512
aca74223c24f6688b06b2710a77a28564a2c7057a46eb571ab2d25ec4633241db8f76a002d2af989f837790c5eedfbd7bc6470d56ce303e4a053f61c66f8760d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80659b7e2b9573c2a4870768d52d305d

SHA1
4ddfd7695bde428dc69d61506170b35d9e4ce4a3

SHA256
0188d3b2203341209e6d576aa306e95b22cbd83881c9e3cd81d5489939fd91a6

SHA512
c3ffc3021723a75d3bfa1fde550b760bec2340594a0904b8d56c937cdaa343d23ce133be667e1598291cb5774613d1f4c4d37d226dd73916618bd0bc5831d529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541befbd4eda8f178b0b4f72b8ed3b45

SHA1
0e8a6929dfec6e95c4a01c6047be988e654b4605

SHA256
7f97f05d6f25102bb4f855e6a2f3f551eb60765a5fe5fcf5d6909b5f623b3d21

SHA512
b11e64f91835498901d9096705448f38e9096210f74d139048ffa0afc3ea2c8d42133095fa169c4871cfd4c7b8d360ff163f7d9e06298be8fcf841adfd4ef4b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
226e9104680408e3225fc7f32717111c

SHA1
5f74d8c53793fb7f2b49ad711eea3fcb29e8c51d

SHA256
940090ee0ee3beaf5ad8abaab4c1d6679ab9a9d9c50f0f45c14ef7c56b9af883

SHA512
2447bb10421b44d72ec76e703b5b6b574aed4d72b2985e77beb120bbabe8376884b86beb7c51a339d8f4d6a14b9bd6310ab6e1e20123ffb0277c9bd4523d8b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c56c90946861701b4dce451850a35335

SHA1
5606bcf5d7d64f97065974d2cfa1d62e7727fa15

SHA256
7b67b8953370b49240dadae1543316abf48cfb8ccf82dc5005ae7a7386c6b2a0

SHA512
b98923761839d141ab5e9a618b96af38823753642dce2103305abd15d66696e4b6fcaf4ab9f223c7da73b9a937c9e7cb1b52082dbde386bde3b1e0855a351191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2713.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28FE.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit