e0f4512120cb416da007f11f983abfc2a8b17c68ef00984851308a5a488d5c92

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd6ffaedeaa50ec5ccbe6c2f3e911d96.html
Size

56KB
MD5

bd6ffaedeaa50ec5ccbe6c2f3e911d96
SHA1

686e674522801a59a10bd0ef16ce533b41d645ca
SHA256

e0f4512120cb416da007f11f983abfc2a8b17c68ef00984851308a5a488d5c92
SHA512

24216e1bc908a05a86463ebdba2b05513048e3fdfb3a3a8d4ff4400ba28bb8a784778419e5479dfd599218ab4eb9a61abe4ed8b5471a327e3ac13c2f50414684
SSDEEP

1536:gQZBCCOdW0IxCXT+AUVmMDlnti8cSses6eqqa8GYayMAWeASmiuyySy860UCG2Ir:gk2A0IxdAUVmMDlnti8cSses6eqqa8G5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000053c5e27434b5affd9e99a524b78f12c77e3e0143f471c3b393b33870279304d7000000000e8000000002000020000000efaa7cdede71ecfa524f44407c92ffbaff75f32756c9f08819795a7807471554200000008df296d76fc6a7b91c92cdb41283757dc56eb0489d2618da833333069a0b5cb940000000c79c0fc557b41a59d5cb7dbc2823ca9e90123ad83bc0273456b6d01e5f1409fc7835316eaa365ccea850678668ffe3c191f2fd6bd5532dffc06c6108955e70a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E60FDA1-DE88-11EE-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416200512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0089ecfb9472da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000c6316044ea1c3afccdbbd476447a31fcb7b53f9f133623cd18b2a2c0074d1bf0000000000e80000000020000200000006ade69393c1a3f9ec04b417e4108f06dd91bdcf77a95fe2a7c5c2a13b4bf0a3e900000007ba45bb477b07d314917460aaa71e15b03a346afb8a5c22d12bfa84315af132457e0ae926b4733e471b0ea335b031fe4ae26d39ea19bd02aba33e0a75676180dfb47020a8bcc989099ca45143cc1e4a2b8bd8987ea54062d9b56d247793391659072931a49ddaff8d8792e21393ea3b0b991991398371dafe5388fde7ed20dfde1f05a91deb089c27526e8962e080aff400000007a81ea52400c0d2e6332ba1c39126295fa015688a2fca9856ced50b10adaff09688975e19f9376db89b4f4e558a8c24452bbd89ade44cf5ecf70752c3f438771	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd6ffaedeaa50ec5ccbe6c2f3e911d96.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1166c19fe6e107be6d06223d78cd17e9

SHA1
35061cb8bd85e2957af03677e3493ed58b0b0a66

SHA256
3570bb5ec57b2ecca1ed9655266fd7461a4e59510c175a2817ba54a9201c67de

SHA512
80def8aa717e08b19fbd1ef3168f8f0c8bb43a1a407ab2a3387b7af0e84fc108c244734158c6f5a512d138e5cad3df75bbc6840e91cd29df6c707bb0ca0844ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9258c23a34bcefcf6baa07b8478d5389

SHA1
4b5be57bb3b5d31f37dcb5b4940cda0e34dff3cb

SHA256
593202d5cefd22b37934287bcdcfc1e5e28debfea91aaf0fcda56e58a982e59c

SHA512
7694adc6ce4c78797e5841202217d15f27677608538019ab27d2f2932420eca9dc6561c68af32d302bdb91ef30bfa0cef3da550027e5989c0c45f89302d66944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35c41c7d0b4a49eb8a1ce560515da53

SHA1
e62b97c2f53992da33c6841aed7ece3ea26cb62e

SHA256
222ee9bd6404b51e88662547bb924252583004cae4392fb13c7f7a88902012e6

SHA512
4fc88d458038ac69192df6bb8029bf5fd304b970fe5a5657adfe6bf76d12f89f155f3c87e82662b1e0da46cfedc6b9a184b06beb56f1b14e04a23b62f073211d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53df53d76250d982690617a906fdb106

SHA1
35008bfb2e2209adecd9c4477c882297b01d19b2

SHA256
f04484d0b27d423f109dd37d1280462715637b0166154f926d393e6bda93ccb3

SHA512
f85ced9e0dcd64afbdb79fe566599b637c948fababd149114260131b40f6b2cd6b1a91f672dc459e95335d98a8d60cb2ee6a17e5f65b108ebd0155ce8b09e47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f3fa632258237612514ebb4a852cdd

SHA1
4f23a534db69d524789377caf4507f99c3136b4e

SHA256
584dee11a9c4b9e765605bdcfd134293e0074001213226ecb4818d01a5a1d697

SHA512
72781ff84c8474db7ec3e603250946b5089dd815625d9eb90c533c56d84de31a85a6b2cdc5dc22f535a771a944d020cabe05a35bbc1ed486498c7158b13499c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c367c67fae962205686903f5e8565360

SHA1
3ecb37e6a77aaa498ae062575f83226603ba2a1c

SHA256
4051347ebbafbfb26140c08afd461d08fd337a32908971d7cc66e26ad3ae252c

SHA512
a2770cb6e614ce9195668fe0a1259a3c3442e10118520ef87dd1c633c75637548bac630fb118900311886f1c292bbf45ba4226225718bc2b025702bad276ea14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
383aefedf16737e1e798bf8a220e1c2f

SHA1
c4d9a1c005608c9c9290073bfd0ca927196f6f46

SHA256
364187931b4e551dd07e548655467813cea1ccc9d601508b8582896e827b68c3

SHA512
79cc4c449d088e37467666ab7abaca4fb74081601db0b7bc53b1bcba94df6b15adf68c228748b57fd2565c8213a75f15600e6fa7bf7d6b01a154ecaa2db6229d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d83445a8f9873a856c9051b32c7f5e31

SHA1
9c844cba3b36265f43747a6342c3d92bfef3457f

SHA256
19e293ae1fcd9dae69d34b358c7a2d334f9b59d8c34ea14686e213f1a3fd0770

SHA512
2b4f13bc8572ddc845fdc86e6b3cd93eb2df274d5101e6fbc8458d6dc37de330e5b00d1794bfa511933cc3b660509d43a3db804849d055b3833881d77c7291e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5ec56929404cb401115f0489e26c6c

SHA1
e35ccb7eb62c7623931a70b6190af877aa07f0a1

SHA256
84a3a7614e104e5d8a805d2d71f70d7d0b03910e7c61fe7e1327fd871dbb2cfb

SHA512
867353080f85d043c3d0ceca59b7e03a83a5fa2da4aa1035adbcec35ccef4008a0b8f0be8294fa5cdee388a75f7f0f90b39d6dc709a259fa2c9e9df305a943ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa95f0d684e4ace24a85e17acacb7b6a

SHA1
ad58d7a0bb6f49ccf6785e506751cd89a0eb2df6

SHA256
9550bcbda7af11003ae6d94142bf3ad08f185e943104351f243aa93863daeb80

SHA512
bf3ddbe341217a21be55c44a83b9358769303cf1fb403951cc9f6f2e60007c9dab86fc6b5834666d390f6e0ce0ed736cfee684c5bf3a80a2dd7311169225449b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea01f7e175f202e9e97b954f68c7c90

SHA1
0f8ee36b0f9aed0dfba0e83e3d6ea0dbe4371acb

SHA256
cebedc9ab07e0b370e0b1971043702c23d6bb6d9ff8379652d66efcb8803f6a9

SHA512
37475ee83b5c68299d0c5a17028dc43aa76335d57a86ca0be690a4218810a507e3076b2d8d8be9525365b9a20e0c27e450a6bf899bd42d3248603596b40316ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532e769710d86a0256f6719f3f630be3

SHA1
7599947d85f739f396d92cffe1bcca13a2893555

SHA256
6b626a46b5ecec04b4df95527afdaa8c53d6bd4045a9e3f3b6ee0d8e50ac7897

SHA512
63e38d2fd067842a29e486edd7c9c0cfa2e8f685dc9460099652c85c9c0cdaca32d8620f88c83132443b070a755f61d33035a23cda1806a8fa4d8804958a033b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe85bdfd8bcc9a2b921c4a7f9838013b

SHA1
e7cbce8f286393e09947cb5e1d1c20987cbb128b

SHA256
5c20c9fa9204ad139d0c24a1c42cda5b4c07bb2eaea3db3875ec741d6d8ac497

SHA512
df2a463765e7803f4d7c57c1b6ec0a3f7ef799b021fc98e0d21366669fd76246f95b6807fa9c0c507ef515d385c2d0b64d39bf1d54641e167be1b4e9df81863a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
516a804f776028cfb1f9ef03752f410e

SHA1
097ac409de23982c2fb8d2e1ad9d44f4bf2805e3

SHA256
65f3ec71d93a598f5ecc3a41f6f19a4d9f61cfa0c18d951c739d2fa100bfbcf2

SHA512
e59c58e07444c038b65dd590445851b2a084c1b7b76018fd6ff28919672ed91f3ae15fa16e0c9a452030d04e7fd25494358790fcbe2ea613502f31350e2ac0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c089e61bf44a5cba8201fd9e70f334

SHA1
540277e9088ae1e1f5450539c717d0951d44d914

SHA256
bfa038002456e9340caf16499b06be72f0d8eb7393d7e8699f610cffa82a9e51

SHA512
a0962c6442501c0629f2c12966c6b8cbc6a2816ae80cff1a6fad871baf6f87a688e31e5d00a092105a7251a8b4041c7ff399dad3285187db887691a32097b0b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5491c1c790841b6649b1d14514e0ab9

SHA1
f99b5cc007976f3cab03abc14c5d65044126a5d3

SHA256
fbab013543963b76eeebbe3ac0702ee49b36eb655e6670a5292fda7e5143a0bd

SHA512
cfbcb73e561181f57a1fa4c0e156bd8e93201552f1dc1c9c5c29d352e8db690a0df9ab4c58206174b003c3ec115c246f920cb7ac513dd7e7471dbb377b63fee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e715eab4fe5b762c9a0195834d4671f6

SHA1
0dd05adc599e6c714f37027879e1fc6bc47b3518

SHA256
f08aa90a0f13c7e50a262f914f87283e0c4bf297518389cf10d4ae2a18e1fade

SHA512
d1e88388016be5d0032e526c670ef154975fe484eabc9a51f78392827daf357d1eee04610e78bb85c1a6e4b9377567fc8d5eaffa5d5d3b9a9ab6acb722ed8042

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BD1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit