2eb1e86756e25ea3c2d67364800b5d7d861ae3712f50ed08db1c1d4c4583bab8

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bce4530a07e85d738d2afe17f3ac3883.html
Size

3KB
MD5

bce4530a07e85d738d2afe17f3ac3883
SHA1

d071d3a109cefe5b458777f1760689cff6b85cd5
SHA256

2eb1e86756e25ea3c2d67364800b5d7d861ae3712f50ed08db1c1d4c4583bab8
SHA512

13538b4cbb14b14f2a3d3f899c9881285fedcb299d2d5fc0fa9ea64abf247665f6fdeff5132ebacb1a4426a98d59a554573e5695bccefb427ae63cc5adb87201

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bb0e4761bd87c6700c20be8e2b2f4b9c20bcc0a180feba834694fd77976d5d27000000000e800000000200002000000006580b207fb0371f168a9af86ac3bebe9f3866f56f47c5983c8406666fe2e7e62000000067078b2012d453e4aeefceb969dc70b02a1bcc6cd870f3b42fbe06b3eea218d640000000c3d6d589a500c9314b687331378e1dc3a93225d8bd6d3a0886bc831ce0fa7a5c6f270606e1c74b231ad6caec56054e8d5c47174529b538fc9cae6e3c349fa271	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000646178b1f99e839555d222c485b25b99dcf4ec40c29a7aec4685f1d7483f9ba2000000000e8000000002000020000000bd3e1e80f625a818780fc2628cfba65501df40635ef832ae821816258ee6fb8b90000000fe94b55ea5e438161506a7ef6a81e1af7fb0112093af26792e3cbf47eb6aedc2b436d946854c572161a9cdc264c358633295f198204c2d153c6a264e1c98495971e29138b3ab221a05680fb375225ee7308c68c72fb4d55cd78ba744b42e7dbb54c4f9952e5c9e3d946d6a1b810b00b3151176d51ef7a5ed01584db947ab768a90bc130d448c2a700e0287e40eeee28d4000000094f1737c9219c3e4fb0a39ef98fe8c52624af0de42395ac91fbacaa58f45ce564e1f3d7e2a0626f3c17b1b2e29b19daffc172ef6a43ce7457a7bcc1701b06e8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416182888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{044BCD01-DE5F-11EE-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203fe9d96b72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bce4530a07e85d738d2afe17f3ac3883.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd14bf252d70d7b8d4854b77d519732c

SHA1
05535e36b3278fb687eee64ddbccfbeaf5474182

SHA256
0e892c4bd8c0fb77c40712bf584a7894b981a08044358abcd071de2b6b365bc2

SHA512
254cb3dc71cd08081cf381e707b449c852b55001133b66c20c4e4a35f892291166fb443c927bf310d7e7f24202f746da24b41b7499f7a69262477dab60ae21dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91de0709f436dd21d14349df944ee06

SHA1
fb06864e64f639af7b8e212e16705458fefbc30a

SHA256
cd118b5f46857b1eb6bd917eb349aeedb1656b3bf7ef85137b228ad88c2889ae

SHA512
e57bc5007f1fb9d86e76eebc45354eb89cd6d32b8f5094881dd1cb31839ed4c611298e4c6c1a46e8e1a4057bdc933954d4a2b7232ad25abcd87e4c31be7b33c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b9672777abac5d05d52a38ebd5d6934

SHA1
966413e106012262ea5e8ac1cc9423ba48f089c6

SHA256
fe70ae27afe8b522b6314a00189443f8e5b72c19d4fce7f5ad32ff419374f249

SHA512
f21277135b06c4752833a10b7bd49188e03e637fe3f743d75fba06045f7c185579e440459595c6cfe27137d2d96fd598aaa3ddd363d47d13a07a948df2a5e357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2f522a1aac72f5e574a15e28d65dd5

SHA1
8935764d47bf4827a35158ac539bb9b1adb6d448

SHA256
9bca56bc28a8413ff7458413c2d650f1001f9006e3f957e6dbacaf8078ccb18d

SHA512
3025482d67c36717b13c16ab89d1f7eff7192c805d796647ea423b347691e947bcf68f083ddd82692fdec0c8c672375fe5c087f43293644082932bdceeacd5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fca9e75fa476626cb101128173e35475

SHA1
aa3d6d59778c7ccaa44260635724d011026324bf

SHA256
30e845e209e4e9bc1dd4ff0720a301938a1c55b0985e4176f13b6ea051410c78

SHA512
99e017573d70af40884a906edaf412a215dfe786ebdc228ba0a22a08f0a7de8305f1ae39a58a7ddfe2e7105eb22af63f44b0239e007497daba5db719c1ba163b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ae21e675142be96e68d47b68ee85a3

SHA1
0dea3dc7be2b9b3f843ae87d33836143e291ae59

SHA256
fee7d21fdf52f7f314ba294a566bc6210397e3491768a4b562ffefb9f1715368

SHA512
54379e70721aaca11f10d289a52995c1c8fe63c6231115fd0de9ff0ab5c70fc6a2aa9bff04e86568607e77ced3100333921fb0197c19f8fca2a36b42f00359a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a96545124a7f2906c11a5449fa9042db

SHA1
771f49c15cc2efae37b43aaf3a3f937b7cfd3c03

SHA256
cece31fda951054cd161869831a820d973ff79573f57d76a4bac46d525f5ba72

SHA512
fd5fc6832c244ca0cef4268c54d3bd645c6c93a6873a022e1520f04519dd08ff4af054411c86a2fb8b9da363bf6916e962ee31a8ceba36712d62987ce7c64646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44d2c06fbc85ad11ab6cf64dfa2ac797

SHA1
f881f9a9b584c22631ac15a31db4c6b89b3b3f71

SHA256
d63c7d065ea140e6e7d11ae321ce8f64b93443d262d1671881fa5c44e824363c

SHA512
30f7f417b6dcf35bb3741a137ea69445005b9c18cd81650d6470f676e932f13b44a31edbda0471722cbcd50d3acdfbddfdf2efcffc73f94e8948a788d4665037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab393b2c392f05406cfbc6a9f26babc

SHA1
8564d647fd4564c16add49c18ea5ea89e0ada8fb

SHA256
c947661a390109a11e59cf8556c47ab02ff4ddcddcf537438fe3034bfb14a63e

SHA512
4ce3bd00a5850084e2c0b6b4f2f797d87526a5ceb4db2dc9b4e80fd2ce70d4f53950d523214f6cce6a49dc31535f8f3243112d57420dba8e9bfe99f2b16f10b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12f24de0295d62fcf9c468df41b3f914

SHA1
3d2fc6f9ec37242c24bf2ace6caf425e563ce7d6

SHA256
a7d334de0b0b4a9a4146c672ae71b4dbf2704aca53936f9004ff951e0561e0aa

SHA512
77ac99738beff63d30af981f139b42796615096a6925f29b2a26709c0979635540a0ca6a06f5f9791dbb0a09b97259d9fdf850145ab9c5f66777f780c30a573e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaf2365a7bc029a639185edd77774a8f

SHA1
d0b047e4b832274afc77ccaf73784f56f21adaad

SHA256
59ff02d84bf24d959500bb8f5b6215897571c61c2b1d0f8fe22d13c851fe0aec

SHA512
376f70f31f7f559f45db1d5160b8973530ad8d51964d2063ff0311f7d31f4b626fc105ba54b8043e2f1e730662d4153cfc07c842ea83070e0d13c3eb106f96c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019e44f4beca5cca3013cc677207a380

SHA1
53b2e48bce7f82b9a3632afd774c24fb329d2762

SHA256
b7c8bd6a7da9a6217ee689b8563ef99ae90e344780f9d0d0cdb90bd4a63da1ba

SHA512
e5225a683ec48b315df4eaef81ad5fe6b63135873a5516e419ec7aebb98a5afb706c870ddfe6356aaa7f9b243ba62a8d2bd8ab9bf4fd146db45eff522332eb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93A2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit