f36ce1a7b0bc1658d1e9a27b97010c5bbe3e5460e7a36bfafc22fe80d1d35403

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc3ca5b4d93e5e5c116776144c45b422.html
Size

2KB
MD5

bc3ca5b4d93e5e5c116776144c45b422
SHA1

6ee8eac429af344794d9c0c8167b5760abfb2258
SHA256

f36ce1a7b0bc1658d1e9a27b97010c5bbe3e5460e7a36bfafc22fe80d1d35403
SHA512

859eb5aed2488506527f409a5ccd56c83c78199238cf2f2128b7fcd0f2c2779a983d8114fa3ed81ee6c12bbb939064e131412d594da7f6b21b0fc4991607a91a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFCA5C81-DE2F-11EE-8A90-4AADDC6219DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416162559"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000008c82c488d4c4ec7ca08c42c85cf6575f40da6d93787f7061fcb100816fe4bf98000000000e8000000002000020000000594eeed1a54dd01c9ffe7cc40fd0d1db363ba81196e09a3ef47be5df8267893d900000002052f14890af065556174aa44ac361622a2199d09ade4ef6fdc13a277870c3b4c89b401470f2226fbbb725233734702b0665d39146815938a9a07a0dd490fcea0c28087adb971036fdfce1005f078f314d41116cbdf6dd6e4783d781335ab90c45be9a1d2253eb0e71614e7dba9cf7b0ee4f5d11d0ff0eccb5d86e4f656e00ae46da6a490bfc471acab305cfe02120574000000055112c75b8b093d7ac67b36836ad2b44f55ca47f34a2c967030feac9deaf9acb0bc2f678f3d445d80052630acd2752c23a950050d111d472b2c6dd29a2479969	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b095fa843c72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000055eb993779044471638842e608da9b0430a9b4145508ac488feb394db2a5b5ef000000000e8000000002000020000000b2001d011852b259c2de6ee828ceb01a37b473fcd9cb566881382353f8711cde2000000025b460ffcf29c4529194e9e91bc4f791c671740e6ad52e5c85ccb983b2ed9c9c4000000082dc2f86e5f1b694e6dd5b5c035a5ec52c624761f184afa7c90554c2993dbd3e5978fee4015d7f420c1e0cb1fcdc02f821d31414f412bfda73aef395fbf7429c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1608	2252	iexplore.exe	28
PID 2252 wrote to memory of 1608	2252	iexplore.exe	28
PID 2252 wrote to memory of 1608	2252	iexplore.exe	28
PID 2252 wrote to memory of 1608	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc3ca5b4d93e5e5c116776144c45b422.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d6f3e0e0911ddadedba609714770065

SHA1
d7388c0ae8404925478c173768e7d1886c09fa6c

SHA256
b9e7c9f4092d1eb827589220dc44d1fb36bdd4bc513373c1e88ff626cd2538b9

SHA512
cc5540c04b4ceeef16c79b8500cfb1fc1b0b520b9e6fcb4104fa96cb8898880dcb827131fe4995edf7160c5de5fdf8a11166d942b81c465992c1ff3a46c112cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514aef70a95e30a2203e4c4725bab9e0

SHA1
b719f3cb8f2a66699c3f1222006d4d45c8906850

SHA256
0b41cb3df53b6cb4b906a2b1c9e0eae2efd58246a90ed76e00936ab8bf3cd41e

SHA512
205c9903021daee549706da69ed112ea3d445d5375f512842e05eaecfbe1cbabde0f71798e7ea4cd6ca99228ad25a928299652c1ba5c837fb8f588d5535bf4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d99e232e893937725145303e1a0c40

SHA1
01704ac7ebc3c539602bd3fee268bc6922c3d1b3

SHA256
68ba3aba39a118191787e97ede86b7991ce597e5948ca810e776c3aaa0f48bf7

SHA512
f6ef6b75945c5177cc3fa0b95a1abe773e29a87d9b373eaad5d9c211f84411c698e428448f23720d4ad15f21b13c9387f64a8676ceb1d90b722858a85edb5cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9030692303fbba48934043ba718c4b66

SHA1
505ff012d256d6c38cda702b0809551b3377f7d1

SHA256
4da77e2eae056236d5576fac26d3198491ad4a69032e0708c3380baf60115317

SHA512
2284f830bed06dd628996764b197b3f06d48cd7afd53542eea90b0134aabf6b40f9af850fef86542cfe52da117e3060f60b151051594aea09b779706a5f24723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d82379e1446a05b1b030ab5a18b227d

SHA1
e7cd65815b88cbbaea3bc1cfb9c0f82109fda7dc

SHA256
506a17ebd03d83ec8cd912de48263e0554c19e0961760944a18e4ce311076f83

SHA512
02a9771474b32d29b35f7f5fd7bee8cea97d5472dc70d4c9512cdd9b4bc561e735ffcd2ddf542f16d73ff0327e3e633414c71b14e42444e0d462c4c4de3b7b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93858926b60e639fe437dbb740bfc34d

SHA1
63d260c14d320a08e4982648d96ef426dc5ec234

SHA256
5918d31a8ab7506eff4903e864da95982066be96dcb02ed9ddd7fc8b226b4844

SHA512
3067b13fd28811f58fc83bf0e9c4a48273b56f9683a0a25d531d273886703b1bcf39c468d2f878ff3fc86930196d247d015055b690c5811cd8d280ee84dba6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff9955c32a46c17fb4d3f21422f19ac

SHA1
c88ee8621ad2110a60539f0b12d36ebcc9d4f569

SHA256
55c82fa07dee5c55b879708b9f45011052f886964d21af9a78ac5bd5382c487a

SHA512
db91502fc1df0993cfac2654980acc52b87271a90eef29dc13bb8751925b24ae43b5c2bafbfc120af342f9778da15b6b448965fd4ae91da4031ce1092ab6642e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c4c03ef91cc5e2309fde38e81579fe

SHA1
972cb351bc01e58001e0a556ac1c60c8e2c70234

SHA256
ed0047f14aee7904cfab2f1dc9e784c037c4dbc7257d4cc8e82987aa4630d4a9

SHA512
3a50ba2ea50adf62882cb639eb0e56a6d51225fe41f8f5c7332d202002147750f93c5ecc129ae9f90a513d9e9754bbec4c5b5737149727618d2ed0c46fefb1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc46ba0d5da116b4838e3ff1b712d3a3

SHA1
c835e4ee9ecae8c22941fdb650a1eb6432e8eaba

SHA256
90acd74b5a28b86d6ee9a08712ff3f9a0e8498ba9c334ce19743fbc157159e99

SHA512
a62e76bfae3f41d9087a98d6048bb9b5d69d960b5a3132fb9d721d22ac317c6e81070411b24ed668a5980e9a8ab79405b6b46165cd02892a90105d0ecb86612a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc057413e878e49ff29032e1d31c417

SHA1
2ab8e57abe64c238d54e2fcd9a985e43925ffaa6

SHA256
b592e5784e93a7b95772c25e71ce0e3eca561502baf27a3eb073547545e7720c

SHA512
948d07297cdd61a268eaf8dd995342b70d264710e53036e13fe5bef26bf4d04c0ba1bf1b2ff6958f6cc25505348ea6f371e808a47d1f5c932ba76dafd6f73e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e15d78d5f213447270db776e5465dac4

SHA1
09d695f81bfb90b962687806e76fc34c4b2622e0

SHA256
00ae1e3f442dd52ad06f6f7c18ce3f3c7411cbfc3897a4a1226056c10b7a1c20

SHA512
56b8a58a10d756e982355b9999b5853e6b19907e1dbeb5a6e0e0fc14e8aee49e7d8985119fa260fa3b0cc8f1c3f8363dc8b63ed59901935c269b4e3a7474d65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8225b7e96364f50bc83b96b571a29cb6

SHA1
dc67fae03159971340cbae1ec02c3b48aaa1bcad

SHA256
27f7bd3e9b1fb0f750dc8785cc965ed9522d83f34994116d1a6a138d92349678

SHA512
0aaec6c88e2465ff5cf5d1ee589586d5496804e49c51dfa0b791bea11ceee56f7672003aa1498d45f4b6233a583e243b856b406d4b8b846ddf4ee312ff9d7bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffa2c564cc208e76ec074d2d5521ff5d

SHA1
3d16b41c57d8f44b9a73e618eff30aa4b2f3f522

SHA256
eafbaad97eb08630f5023baa4bde7002e319caa4c74601de5605b94cb0ec4a87

SHA512
876e48326c534aa9c198e458d9f3dcb2a4c6d5be695fbafb36dc4dea52d52270556164435a332b7b23862fb56f8872227ce9f235a187d28f7fa11ff64fced11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc0f68434570c81897fececd60a7b91

SHA1
4c9f54fe2e77d18edba9c85bf80e4a7b238f71ab

SHA256
2337fc46ddadfc08e0a38ae6dbb22926b08421f71ca7ab5ba8de00eaff5a380e

SHA512
7b84a08ce1c581278b3532509e5a2a6864e0d0fd931c7f1fe203b0fa42e2a047af1578e409411bcaca32823161c6a18cdb7b6d45021b41e655b987182858f175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b70d0dc038cb6c1ea770c09359a166

SHA1
5cde59fea3e9e040d4e6d29f6e58c4b6ae4894c2

SHA256
80a519941043d73d758e3599f3e87ad3c74eb5fe59402e0765c6beda330bb16a

SHA512
681402ec0ae01fd43ef37bfeb8192eaf4647679f02c784c238d8589bee26700a3ce1b2f30d80d31aca7645b4d86d9d30f1a72653c2534c9d2a4eb0b5fe3cfe87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FA2.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FC6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit