c25dd5f8b289678b37106619fbb82dbd151d6fd0caae75aee8733dbd0a1b7c70

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcd8e385db150d6f33028f453eb4fbdd.html
Size

22KB
MD5

bcd8e385db150d6f33028f453eb4fbdd
SHA1

02a534a6f4f88828311d32b7b208e04ad5d0af36
SHA256

c25dd5f8b289678b37106619fbb82dbd151d6fd0caae75aee8733dbd0a1b7c70
SHA512

0fa58a52a06481e4f999c62b517c68e7e1c3924c17f37361afdeb3b19d3d6bcdc722bc21fb95194b5dae4dd62c860966316b03f42d851d152f5181f520e6f92e
SSDEEP

384:FZ9USF4PkJphbpT6B/Q19EgtvjmhgAhSfgBZmxxM+nlMl+VBHcYN/zwjvr077oIY:FUgtTnjbNfqGx5B8+Ez9F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000640d16662402d38ba75b60266e26857b801ff993efe5bef4ed16da83b4154204000000000e8000000002000020000000c4545a34fa83498104662f73c5707f854254e64d071a67fd98867769d41c4026200000001537841018af857a9b8abb66b10d217f3fe4b9da8d83d429f4b0fae3d866c3444000000002ebc07385e096964e5b96aa8ff23214104f17fa8c191dd13aae2c3b23aa22ef833a02027f887b4e31796262669f33898dea02193218a514af96af7039beb8b9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10700bd66872da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000006bdd043a06ddef219262d19e30a4e7f55436c0bd2e7db4154090d398dd7850a3000000000e80000000020000200000003387df8b09bd1724475be525d5f5cdd836a5323ffff68b6e6ed58ee7fd2d6f619000000063482025c4993f04241cc92bd3dd20a7050c506b58b85feff578c51a464eb4ff993de530e30744ad0221c412fbbbdd7ba5e3c9f388a0ffe998368f3fea4e815e066ecc06a70a8a8fd1d8c6a24b2323551eac267df827f43dc8e68e41f489da72a8121050696a3244b3b46401e8c72bcfe4efa3be1c33fe9cc2af41a5607c50ce9c497093ffd95b6e76ae9df01cc3b68a40000000876285d5c735f91063ff937e2a1227e1cf70a23af7b5bb988bdddd325e416300eef260207321919e985787a68b9298e7cde62f917d8773b4093cb0d4a55d232a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416181607"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{009BE3F1-DE5C-11EE-BB39-5267BFD3BAD1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2904	2980	iexplore.exe	28
PID 2980 wrote to memory of 2904	2980	iexplore.exe	28
PID 2980 wrote to memory of 2904	2980	iexplore.exe	28
PID 2980 wrote to memory of 2904	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bcd8e385db150d6f33028f453eb4fbdd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
297a3090d059a52ec57bf0ade7e13b48

SHA1
879290a8075cc644f9f88f6b999bc637a5b75fa8

SHA256
491a851ce7ca8f0645c9a2c15d388ccc4a341639e230aa79ca934fe16605411d

SHA512
58b783a9155c224e2f66adf2de719cc8f15d36de62d0fc04e54f7250370c2fbeb54267d7b41c656e3ae4388b6f333843464620b2d91011495494acb6de07a970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea8fa9a29f890b4a9a2d788a0cccd5d7

SHA1
3fb390ca33b9cf51c50e5fce2e795f69e89b5d19

SHA256
8bd34886ecf44a0ecef6f88c96254e1397a3afa012c9eede7686ebc9d9c68e1e

SHA512
189ed9c5f0e269e191fd17aabd69a4b9dffce303d8354ddf52448870be0428479bee639d32aa0ac9fa39602046621b0be829789798361356fed474499ae335da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a877adacd54ad8456f4fdbe2e860d6

SHA1
5ab48f424e0e5660d7946d0c95be75ba85f62012

SHA256
c0362bd24e958cc5d2f1a064601794fc0d59d2c8381ed0ca2a70d5cd82c5dd0f

SHA512
00fd43cc5ed7165f25524783a06c88c34715c86f70c82665810c9b306b4951ebe34e973650fb052d1fe58a064fd8ba0e0304c0ad02763c958ec4a27d2f028786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe1bb83885aca099968bdf4c29f4834

SHA1
ec1817d84b648c1c317ce25e9d87a4cadc0ed7aa

SHA256
e8c0124bcf2c429964e6fba8c2adcb1816ef97f686fcbaba542a86a534b7bb63

SHA512
bcb93d7890d9fce238b971fc7394f56a5115da81cc8f35becbbc518848d1b038c72d66faff62bad8ac41386b7d8d7f725dd4f73c217c90f104df19cea38d57a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3140e27fa87b02eab4a201269d337f61

SHA1
072c287c94e25de93dcbbb9c5d4e46de8f2a65d3

SHA256
593871daab66ae88b17d2d256aa74b6840dd37681bfcbf3f4f599d8be7c1b83d

SHA512
39b60f9b4bf270e652f8a082447c2809588335851b0f985f8ceea2cc573159d19839a302b3a6f766391613f43ed56024527b0ca462a85b2242d5f8d2515732a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae43a6da24f0e09c98af84aa23047617

SHA1
91ecea4b86337b85d81d9b2b592938f4b4ff2f22

SHA256
ba1f290a7fbe4414da5efa37b796f67439084c70c3da8b4ae9cd7a53cf584c09

SHA512
ae42ad7fbf51330f4e8956b0db02972441b161a61ff0ef18e031de4d9507cf96382378a463593878e998b24fb796cc63ade1d6778a81ddc2c073bb7696856118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5afb074655afbf27a0a5d76cf85bce

SHA1
d65dfdf1e85e4bf5e1cd9b833b9cf57afc65cd3b

SHA256
4d2afdbeeafc171bee9b07d9fbc21f128920febf363a3cc2380c577b8f38fac1

SHA512
cbbb4df0f1d875a2a344763c8aa1049949995cd65e1b2d2afaece8e10484083cff1fe9871ccf8902acd852b58c392d1dd0fbc8a3469751b1c21b100038346818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5197317f5631b9cfef46bdce1220bbc9

SHA1
40596a99e19447333d07064a398aab49ca4b0996

SHA256
5b2219b6ccfe9ded8d8565d84d67ce0516b4c90f746985b36e27644177a74300

SHA512
b1e6a6dce6b8209244b4e50848e8ee29b68c0c9450d7a21d434f932925ce13a5e0092cc1e650d56125d194d132a9a739df3d859d2dd29dd5d2029264830a7589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a13e78ec7cd66af2f0416977106ea849

SHA1
bdb77753ed6b838a67603866745e5fbbe6188ccb

SHA256
2676a17fe50373d33609779cbd19f7636f2a83d7767f258400b1cd9b890b498a

SHA512
246310da77da07248b92b31f2231ef43d43fc372fae9ca3171b00c1b092dd780423d23f20c072cb87221ef96dace956c194f48630006cc620cb4c71d31c59444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76d282eae4ed4878ab0fa57193b3221

SHA1
0957d11afdd2fa42311d875ad7395ebda9f01ec8

SHA256
67ed71d254fed6ebd5edec16bbe662444b715ae2d18e1f86492ba393e969020b

SHA512
f0ac8cf279d1b97485470a225559b1716b7370b108d55678be8190bffdc1e27ac072e95d33f1c9544c60f30acf8fb620f59af4d665c9c8a27efaa533dd93c9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee7fd5af4f016febe32520e3d96fe43

SHA1
58582d437691bf93edde84ce19aec27752c5177c

SHA256
413e4d0f71017e9ebe98cc547fc7d7f8251ff02295d33fa1ef6ef8bb62ba6dd1

SHA512
4c52c6d47596b5b7109b8818f9fd9cab7e45ce664d4edf5bbbe6575a55ab054020c541dfae5ec38b23e4e2dd5934470ebb75c331786d6af58912d7a5248c452f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785b8eaeed59da51f2c7ceebeeff60b1

SHA1
d022bbd3993630c9dd5a59a34fd8de58374c1d30

SHA256
52ca441e9c0a6bf29bf42c046c26c5fe796c940833daa176da1acbded43668db

SHA512
977faf6c66777bcbf5ccbb01a785d3157b7f1bc90a7dc78c53dbbe227e2ea92e150aac79cbf3e08d657b314a7f1796ce09f05c2e25ad9168792207691f0e1ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef600fad62a318ee954876edc0b269b3

SHA1
dfbbf10cf2e157c1a067eb4b99248f4c2297e586

SHA256
23ea14d47b7af417925e60b470ba705deec03af4ea0d191f8455f9b078f95fca

SHA512
80c2858b6e6eedf5ce8dd2c5891e4bc86e3bd8c2c7c86b4bd062c9c92e55a3d52dd24a81231a4e6e2fd595d115b5c221d72ad67ae1c191f80928622a60ac4e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40c24bc473f6d06202b1a2be974cadef

SHA1
eb0ca155eadce102c0a376088dd18f18b37e3b3e

SHA256
48d6e532ad9edb4a8879ae1f1bfc9b3dbefdd8d700564318852c9b356a37bb15

SHA512
352d4219868ee33ea21a4fd2ea2b51f2daaaa33274017ec02f31c1713d64d702bfab99baa7af2d6fa58f00ecf315e14efd4604128e8c6d642e44ffc2d2c638bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
141b4851e5b18a290fae5c880907eb52

SHA1
3828ea2e936914cb690f8e3922db829c099d6eb6

SHA256
7eb3ce907458112ff07bf0313a94255942ab3230ba6d370fae81076a40bc95b8

SHA512
473a3d320417c5b652698b5aaeb0dc2c8c66ba7853eb6980d6a32e64276604a251a1f50e9fa7d55faf6da2261fca1ae853b9a6721715adee6cda61700198dfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6624.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71FA.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar721E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit