17c21982b0b46e0d306722584321ef019ff7bfa0d3224d811de5461d7311cd74

Analysis

max time kernel
156s
max time network
164s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb99b7d00f0f738148b49b7d18e7d95f.html
Size

24KB
MD5

bb99b7d00f0f738148b49b7d18e7d95f
SHA1

26d45b72a1872c3101fd6c37853226261c47ee09
SHA256

17c21982b0b46e0d306722584321ef019ff7bfa0d3224d811de5461d7311cd74
SHA512

107bc82cfa97f8b15b0228255d46802c077f406c9f6fe81a1aa4fbe9b3c899ac30fd51946cc687892d869d4652962164fa7836f136522ed5dbcee8703f438301
SSDEEP

384:XnA4yw0HTpmBGbztvukeKXXTuRwSQhGAJLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:31+XtWkek6BwL1k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{442EE921-DD60-11EE-9E49-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000832ad62422ce350d7dc247580b51b9ea94d771eb6435265dfc99dc13061f5312000000000e800000000200002000000073fcf6eec64ff63505071ae273d561894019ff479afea7b680b536d716e0161b200000005bac2012445b764aead914efd40acf2ccfefd9b68cceb9e4eaaa862241503cfb400000008f976236a77c582695d3827ca31b27a5d5c9eec1facab79d80c984a4ddabb877f4064a5163adbb2afa83c22a4db1a3391e6149356f8b0cfda3697c6c7be2ef37	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416073482"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000e6627478c913a4643b4470b71569de1a87b00b03642d61cc840c5bfce3de6173000000000e800000000200002000000093115a39eb5050da749ba899491561165ef7ec411fae42a1ea5c4949a19ff34f90000000ca1c38bb0287ade204568500fb5cbb19970a519006fd465d6fe8c15a7ff9ec75072158f2e2e17e6795525f580d20fb80faa24294243566af1f273b0473c343f6bbe1194b17fc85ad74207d4dd13ff26a3fef0f5a59f94af6ae8053f3335ab137ac69c1eb458d85b53b18a1db30f56d58dc88c8f6dc4fa51db065b2beacee384bd4b651b3f6c93cdb82f9bc8d434162bf400000007dbe47e3ff965b3dfdc55c307b69270ba42a581d661f0fced6a59fb990c49f89b8365dd542320f2cc43f72818fdf9a3d608f5a997e9d895e8f1195ad062bfe89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90db691a6d71da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2896	3008	iexplore.exe	28
PID 3008 wrote to memory of 2896	3008	iexplore.exe	28
PID 3008 wrote to memory of 2896	3008	iexplore.exe	28
PID 3008 wrote to memory of 2896	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb99b7d00f0f738148b49b7d18e7d95f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7301d19e568a91ebdcd3aa466feca23

SHA1
4613976526fb8683b47c968cb9c1c4217ff1e124

SHA256
a7ab769995514ab3adf8d917177a7eb75a05c58e01502f72db0177e150720746

SHA512
3921bfc7377c5ad88bd55182fea88a14d0e8a4674732d330d222a2f406482885553d15d67941d20e6ddb3d6710c35d1a47e444176f3c06ef6c6266f8b2f5e19f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9cf59186b05c73f1946fb7e173ff468

SHA1
3fdf8d13590877419269862c49e48a7905dee9e7

SHA256
201c55d994ad6b5b51e8b2c6c780aeb9ea023a61b29c328ffff097c3b7937ed6

SHA512
3423e047d3620847b39cd43ff39f6b37042fde98cc8fa11264ce9389b71f9179e81912364ef10a8d2c95433e23c6ddbe33fbd40d397c3f00ecea22fed42f330b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8aac4d6ecc1acfbd790ad125699802f

SHA1
96c1f8bf80917c1200f550e732b8eed3ebe4afee

SHA256
aa56a7d5ddab5d26e645c8bc1c9bd78c85b99d9662166636d730e5d898264e00

SHA512
97e00a1a75c7ee9847934e750e3adcf22d233ec11bcd05ec4df1ea62ee839ed1d196999381057e3388c927b46a8ab23a97e500681ac799c5748f5929a4df21db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c782407ae22980fa089842d21e29d029

SHA1
b400cd940d27119ff2c7228c2b2ca57fb5b3496f

SHA256
3e15a65a41ad3fd6d3d6d4457707f0be6880ec3b59f28a54dc35f184238b42e0

SHA512
381164e04ca6fa2ca6f966e7f95ba1e9abd069b7fa835a342d89f88fb1db74a14df441ec967884e5d0bdd0cfc115308b640d31e1bebf27ef0d2b7649db2d5a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
680423521bd4c80f421a39674f7df36a

SHA1
347a4d88864918880959261791e48d5c0f146525

SHA256
5c74e4e7ec7d14e1d6cdd8ca39a964e58793df44383248a75fb9c7e232e0ce60

SHA512
9962ed8516abcaf7302f0c07b06a303d8f33aa8d0cbc20693281dcca81c470006986440c5e87f0a5de0a18d6895248ba55b7271ff0e36d25cf631eeecb61834a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1cfacedf8661f035a18ea2739072642

SHA1
0125e2d99d3ef27b795a2f31101605a38f22f476

SHA256
5e06f79a44e21c25039caf6ace841ad386fb40fe230e71a484996368051398a9

SHA512
8995805fe6ada6467d7d216356a7c213de05db53a41059f86dd06c2c61bfc8467e1b914c813c0f982ee63fb891a9ca563bc49aeb98ce30b70198ef74c8cf9f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0200df640a4e413b5d8e4fc5b19d1a

SHA1
061e82e40bc69678064a93eabf7af4dcc2c22f4a

SHA256
5a446184e9da65359063d4a11f8a14826a895d80a11286d9e04872445a6e68cb

SHA512
f1c18d27317c84e5110e80916fa2d12ad5334ed65d05ab25d9aae89049c0fcb744b425a2d8726d2d01656e114756f665acfe4b50524da15b003e748de2b3adc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a62f078605b39cec2424a0cb8d7b34e

SHA1
03608be8ba98cb1f532137dbd0761232321b59c3

SHA256
4ded12bd4bc9e0fc81f262bddfd6d95a82f8dbef17432ebfb38d6e06ef98df42

SHA512
f4c5011e55435aef648eeb24298959cbbd06240a5e91622d5846829c67640a1f09a37d333c242d72b7f2ecf86645d2cd266790a4492ccc6da343705e0a836975

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC505.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC77E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit