ff50273da078516c1ca3375c95dd73ec7a8a2dbc3ed9dab09f1831aa822c0187

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcab48cc9e51d3a70d5556eb20ab62be.html
Size

2KB
MD5

bcab48cc9e51d3a70d5556eb20ab62be
SHA1

42d32bd86ff7ed73052f032af5fd45da38db0853
SHA256

ff50273da078516c1ca3375c95dd73ec7a8a2dbc3ed9dab09f1831aa822c0187
SHA512

cf7db794399d5c55a3615b14658bc2fb48c0c80c50000596232ca7f1ba12bc5ca13cd00c0801ebc01abea285d191e0e64e07ec6d1f94ce44a48ebc4e509570be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000006c0ef97df2f3265838f4080b28246f838c987639b7536879570edab6e2aad7a000000000e8000000002000020000000b528889a58b6a81e74ecc6ad9fcaa6bbfb0b2e507e1d3f109698e7b71d27ef812000000084697c68b2f35ea27fe496bd4d722c690b93daf3d9c60bf2a223f937962fa0cd40000000846f1ee71b66bfcb205829cb3a30fe389c942723717532faf2960b0c523d3c6a07171d188b4d0ccec1c4f992bb487c38695426949da1c9134b2fb4543171f94f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416176121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41376C71-DE4F-11EE-B937-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000006cdc628e0461d2493b9f557610a30ed79703b39c022c046949e2499bbd3247a000000000e80000000020000200000005a88d2ed6852a4d97dbc090492ed984ef0c73bbac843b995495e7c09c4da44d99000000071b8e2ac23b2b53c5990cd74074929a9756034e925ca3a3475dd53dc72d895738150c15142fc97a4c22f6860e5906791b7084c7f2d5268a8c33b991225d0f85403ad2e226f7ece381726cd7dbbcb6d5a7152d6e9cf7d9c6e9b5c6aa89f8314374f93b600ee5c7ecb52d87ce1dd2fae02d8cdc690e6c55a50a454e37da980fbb707c6e846bce32b9c46719969a3ed62d1400000007832e12c2c2f37652f7ca638a39643f3bb7704eb2cd18e3c24c4e2ad39fc35dcf71f39640de450a1b2cf3780050f5791560b363566b5f257e6ea450b712fab51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ee99185c72da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2976	1700	iexplore.exe	28
PID 1700 wrote to memory of 2976	1700	iexplore.exe	28
PID 1700 wrote to memory of 2976	1700	iexplore.exe	28
PID 1700 wrote to memory of 2976	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bcab48cc9e51d3a70d5556eb20ab62be.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e24c63884c2d213d9d9dd8375ec853de

SHA1
7103df4893f9fb006cb69d813689e9f50ab10563

SHA256
f5741eb0870ac14a69c70a4e492bdb23094726bfa26502518a8dc214063776d0

SHA512
e216c7b2d90a5bbc91b9e1a9044f793a08bead7b5f416e4351ff299c0936246ba21595d15e71cea80125fbffcd15a46d24ecd882386d10f2aa4129accec8b177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a9282004bc04cf9ccf53f0e2caf7e8

SHA1
2ac7930922e70200270ec25570027d481c97e75d

SHA256
ee3be0a054c8e2b8faf82bf6ef0270b65d950d132cb1a0bee5d68adb408d82e8

SHA512
fc8879be137d234179cb00a380d1999037f95720721b9f9cbb5a3615a2d08c82e8dc6837daf6bd4319854fdb12b217364f932e0bc095c4714e447d809ebc7eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa21a5c572cefafa1bf21a07ea18872

SHA1
8f9a09ccfe430288c9c7487861477089fd3ed3d3

SHA256
98a8ec979f284004db0e6d29c33ce005064d3d91db9d168cb1db318a788c3995

SHA512
c131605fa6bd079d06a64b87880defda3da8fffa06f9d27896a7c7aa99ddaa17c7234ca6e5856924a4a9b7ee15a0dd638c0b17b3768fe5980d327766721a3ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db3675973c477bf92f9c18594dc7caf

SHA1
ed7dba726b6bfa78fabeecec1255678eeeba4a99

SHA256
b90602b19c7d84646609f2746ec3d15b1e9ee5952b29ee432d791edaf0fb8953

SHA512
93f89289f873d358a6b60b99ec207f5686d40365d325736c485d0818e71bbfa9e33de2b3eb534742c5a9b8482fa770418ff4776ae97b8831fa0813b1adb4fd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e88d80508f97a632519a71065dbb315

SHA1
25c894b6baccf5a7d0e0c9424237743cb3fd243c

SHA256
e675088154c03e8b62dea3df917822cee12faf2e1d25c0e980f9dca6c5238195

SHA512
856ee654e14fe5f265137876bfc052e82714f611a325e403aec3d89dc7b7db940fe507248ee95d9979525bd18ad52eb5465560d386d41617cc14acd6e9333e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63e63c63a27146d7a192813b1ed78a73

SHA1
183f979360ed31e112dc545a7f2ea0986e871e78

SHA256
d7088038b499808eff67a296bbcae2712bc776ab339e0c785d43735fc4eb4fd9

SHA512
fc5457a56765d6bd83185cd8346f0436f03d119770a41fdc7fcac78340c64c33b8b9f87921974c4fcd84454c1721e9313d2e6d6a80978964eb1049d3e873f3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8adb4e8a0097252c10d1a437c85ba488

SHA1
530ba086b6fad7b99b10e01a91b0f583fb3a4e04

SHA256
459e9920cf03c82affcc486e13be92dcea616acad49ace24bb51ca305655b8e8

SHA512
c78329f3234acdf8cacca81765d50da34a2b9ea8a5abef429227df09fe58ff070cd84f4b77037877c65c498845495308295f8e5ac452336f2a0892ee04f6ab24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
729a3bbb4c46917629ad38ceb6b92588

SHA1
7e9cc1aafb4c769bfdfa4ae3d809d66f6902f31f

SHA256
4a20cd5faa13130fa2fe2cbc7aaab549178a70f1f2f2e4507dff527a167553c7

SHA512
f71f52e103412421a7e53aa5ad37acde2dece75b737ce02f3648a13f54398505c35154c0ef1ef09b8f9e44361f367ad1eda1741624728e6ea86d18a38f5c7574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2efe7fc186dae9e38ac0a6cca9b8b7b3

SHA1
b00420ffe81b873b75e61d76c828f023f1241519

SHA256
5c8455ac82ba8663424bb8cbc36a6ce8e46347fc3256e447b5707ed58c53eb7b

SHA512
9fee7b44df5f060f7d6b7640185c1e49ffb177298794b1a33414de539b49dd1383a49d93c23ec3dcc38aaa652fb0d0b4d199a5bc234d21ef897f27703dfc4bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa86c61865cd3a9a45470c994ef2494

SHA1
7ec3d1a5c9d1e049c3cb283a8bffb014310b9cc3

SHA256
dbcf44a05397d48b344f3bb25757b689c4538c6221ae7c3735c5784741a308b3

SHA512
062a9a936ff88feb5fef30c11a08775d2a8b2704ef10b9dde92c05aee3493c143a09da10fde704f28775b35ba062d30cca8c29250051a85cd6a6b45d6d2d7bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c93afbef18bea8896c0996051ff5185

SHA1
37d831d6a965114bae36a0aebfcf69c5fd01dada

SHA256
adbafe6fa62183e231078376ac2e970cf5bfdd32bfb3f50c23c46403b3db7b7e

SHA512
bdffcbd4e43514f27e013fdbd6d3f6a232728c69e99fe502b3bdcbf6b834486fd1997127620fdcbe07954145500da647defd1b9259bc5e09a5b2b066af6408bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E8E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit