07ce5fe2229a3fce3a0b43e3cbf010e1f8acf6a9945388720aea500b5a16f2e6

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc8e9599cb5b100666cb340899e7e930.html
Size

28KB
MD5

bc8e9599cb5b100666cb340899e7e930
SHA1

1a441eb3f4f70950ab91e13cbde0cb1f7c2133f7
SHA256

07ce5fe2229a3fce3a0b43e3cbf010e1f8acf6a9945388720aea500b5a16f2e6
SHA512

63618c12da01bd511d3abce7b14cd1160405c4b61997588ec0e081ac32e5ab270660b3475b656c1b6bf41304710b939d8441c5a01b7e1c16670b4702394a0a5c
SSDEEP

192:uWfPbb5nLIVnQjxn5Q/3nQieGNnxnQOkEnttlnQTbnhnQ6XCUAtaEhWcwqHAqlQF:7Q/YvGNML

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000397a96491e5daa054440befc849a460c2a893c99e82a14970303304f30873951000000000e8000000002000020000000983d5cf7b9a5e834fbfb2adbc61669878edef079c876cbc36a5d5bdaa32b9dda90000000c31ea1209397a6ad7ffb68af28543aef21d5561ed68c40bdcea71ff9b5794fd4a0271ddd22c17080ffa5d5b93850886375ab0496afc767a137d36a0bba35bcd409aff6cb521b9ce7cf00de69b7cc594964c3e333b5c7b87acc88b3b210edf475c36a37c960557b0e3557fb14c92f9691333fb39aaf43f5dbaae1ff40ccfeddfd1b5d1e279f5c149d421481cd6958c2084000000073e35553891a526a959e1c043c8d94a4519c1a35192d7f0a7d90a03c65dbf4b275a22ddd9b7641dfa9d2778b8ce030b7da560a3b5c74d41167013be763568370	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000009edf169b5829ed2e2ed63ecc37535d053d04904f0d5306df282d5cb8a1cad680000000000e80000000020000200000001345bdcec5d88c6a8cedb0687aadac02ddd4bb502c1475dd38c46c687a4172662000000011cb309a31bd51b95c63573860fd66ff52de091d2a9d31777d79173b94d8b4e440000000d22102ec66ed56fd2b6537b226c5b31e1b310905a685edf68415454c4e167f71e2f2844637067f894e611e00d51c834065c44de351c7f706c8feb771a79ca676	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ce86f75372da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FFCAF51-DE47-11EE-8F4C-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416172626"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2524	2752	iexplore.exe	28
PID 2752 wrote to memory of 2524	2752	iexplore.exe	28
PID 2752 wrote to memory of 2524	2752	iexplore.exe	28
PID 2752 wrote to memory of 2524	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc8e9599cb5b100666cb340899e7e930.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf11d2c800520800937173e731fa159d

SHA1
46c677d73b576e819431b2c6911c61fd1d38c656

SHA256
d9b2a8fe80e6584231d0784d45e9b7161dd62ef2c91c589016ab7cc7c1674607

SHA512
85a508f9e8ac7665799025ea935e09212abd4c45e45b3e32d26a3f5fed873a56522cd2e4d1130deeb6230eec8c7d93260223e0adbf258d6437cdf8d435b1b218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27352bd8fcaba11c1009608cc6af0891

SHA1
09e271ed51f3a17d30fbd0774230816f7db0d456

SHA256
34c9275e281c1e0f4b6be30fa12a96ffcf8fa2f9e1648796c39d734641ea9676

SHA512
11be3bf287b9ad3e4cee55308b841826c06aa7ffeb4d3316ccc6d61a9626d320949a3e56e3c5f7f3c100c69b93a445bf318001431dbe0083e28abaf437bb3455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019850d9a4b5aa2f7cbe20d7fa358157

SHA1
d8d5d461c411305255bb3d98747ea90ad0b13cf7

SHA256
bb75af058c428d6805e40db7fcd621ad5c36bfa5e8d3fc4c8aee17e30a5fd727

SHA512
87ad10f7f2fad4f7be35bcb2a5b0de2f1dbd1721e48fbf97a5047373fe405e7002238b2c2c0a877b8e29dac099c908245c44418499cad4d46f339002b7bcd983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3f83dc18bfc80a5c190b2a4f4246b10

SHA1
7fb733a25c14fb9c22448bbb1a848fadcf01477a

SHA256
12ac74a93de659c6e526fd63793bebe4b2c315e0836de40ed2de9a56905a7714

SHA512
577049d4f2c373c4c8b5932a58584bcedd2c8a8d695837df7e6107f1804c55e52af3aab237f126df203b6b1aa4e997763b1a74b75189d228e80a63c74f4b7147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7921eb0c2a78ea4bc8b1fb2880d93a11

SHA1
221b81f9f27e8cba588885cf907adbd633f62b2c

SHA256
579c6221c14ff2f3821e11fe5bba10f40c93417b850f740a243bf6a1f4f8b2cb

SHA512
4f149d4851c20e54f471df6ec34358656731773d186172ca2238d73fd3d9eceba826aac46529a4510492c6edd44b5c29c3ab5d93edbc843b79b2927f03c2b0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae42ba6b1c94aeba8959960d59237455

SHA1
bc3559217a0066255c4dbdb04de13dee8954e778

SHA256
ca4a82f786f0fbd668516e81383a06ef4a3d8936f805e1862cf663b709d5816c

SHA512
288f47117d928b1df899c7bc6a84c5ceaf3be6ad8052cc500883910f72a103eae292794383e0db42fe0b8d50db12d93bed8564859ac115065c1478700fc8a73c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa44ea806d4ca4f36bdf4ad0ded9c22f

SHA1
9753d4ed802963a26999f3068e83373f1041c47a

SHA256
3a18a23a3a8130a08b7a664383b2eeed2354a61217ba8772656ca63f61c7aa2a

SHA512
c7b2b7bb54748839070e781f78555afc52c1f317926b75cc9810d537c25e49f5073ce252d33f1063827547c1cac8800c1e343b113c9aca95deb5db3d89050fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a1d9dd61326156806a1911c21c79377

SHA1
30da7a03a8818454328930cb7538edb7fc713257

SHA256
02b7e55e1182f808b09ee1414ebc36725721df1fae0b4a025a1c358432bb5efc

SHA512
634819dd64accd9c53470985ad89d766a4a334e8245c8f66fb62629fa289ce9dee3d07d0b1967ac1cecada6f33a6bf7338f1d52b004dccb0e25e7e6ffe894de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6585731fc769b94d6b9bc4762306cf0

SHA1
f5364a37050ef8215759976a4438e13f81a06212

SHA256
e22147046c8f943e988fad52df83c826bfee82661daeacd882cc9053069d6805

SHA512
40a99a70b4498dfedd85a03939f7f59eed460cb6eec071ad6b8f0bee5fd0fd7f89cd6ee0790d7df3cb2dff4969a8f73fe3134c164af18a0526164942a9e4dc21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CDF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit