39d6d19763de4dcaf8b90237a8b6f6f37a6e0c1e3fd23fc5948cf83b6d2167ec

Analysis

max time kernel
138s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd91bfe42d8a273eed05a1591e398374.html
Size

5KB
MD5

bd91bfe42d8a273eed05a1591e398374
SHA1

963f8b5db18ab96d175c42adb98c89c2936c0a5e
SHA256

39d6d19763de4dcaf8b90237a8b6f6f37a6e0c1e3fd23fc5948cf83b6d2167ec
SHA512

a5cddb0e6c72e7a1c7303a05160e4131fca6091ba94fe362fb161d53ac3b1c740e5b56a006d586a1d1fe067c625860762942d44c864d7dceaae4ea0851a8d267
SSDEEP

96:or2I7VODw1vFjh8pPfGQ6H97uUB4WHpU11tyYEuVh7cYmq:or2I7Uc1vFj69fH6ZdB4WJayYEg0q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000083ba78e1c795d26ecd659b70cd6ee8164fc8c07788d99f6f1e5c9c056e3f15c4000000000e8000000002000020000000531f510d91002e2fa8993df7a60de70fea2078b7aa8f19562161a059dd34081b20000000833e8f6c660106d6cd1ddb83a951abb29a5fe0aa69cc51c246beb53f948d7805400000006c205f68b5cd233aabaf5bd831c7db23d7f4de8ddb8ba7aa51e6eb07a93a0cefbf9ff5c9e3129bd2e27a971a8c7064978bb6f86a7c7f42e3896d64959a24bb4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000008060523a5363f29fd09c1500bf5fef44d13eb98e243ebfa51ccd0a096637a689000000000e80000000020000200000002d66828de1b65a3f9c040b165099ae84841b01921bb187c753cd46e548c8ca7690000000577c44e1fdbbac83c1059eab627869ee355d6a27533b4861827e87d9ee3e696515d49b18169781a0613170edf8d4e188923b4732f9af1adcbfb89d540bd31289557c312ba2d5f99dad772d2bf9280a6a7e91278b277e366393b56e22b1f747cecf41e5b1cc2ffd091f74637e84a16499554813e42246ccaf99b4a57f1bb5db664ad3a26adfcb8242498f3553c936e7e64000000044a2eef29acce7aa2781371810d031142551eaacb967172132541fc19ad71edc729930488187cd4d95c21ce461e4ad013d162155f020e58200dd1450c6870581	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9F82541-DE8F-11EE-AB07-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416203862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507955af9c72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2656	2644	iexplore.exe	28
PID 2644 wrote to memory of 2656	2644	iexplore.exe	28
PID 2644 wrote to memory of 2656	2644	iexplore.exe	28
PID 2644 wrote to memory of 2656	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd91bfe42d8a273eed05a1591e398374.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54fd2f98917a672ca5ed4b30597e040a

SHA1
0acfa2cec6fbbab67b47ead1332b57d33d9910c1

SHA256
69825401d667a1b1189a8f00c9927235423613ae6504e5fca86e9d600d9016b5

SHA512
63835b1059faf95b0a569ab9e26ba84bd1e4a9681460efae017a56cfbff1ccd4e319bde276b772ba4112ce136b2492845e6066bc413e009a4cf40e2d557379a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25ecf3eb0e1a0e309bdb7a598b4bf550

SHA1
29499aca53a88c727d3c49f3c24db68e0621d92e

SHA256
2c32c9d6cc2a710f5209ccee652401cbc9ddd2e8704f5be2a87f6eea46a4a036

SHA512
926247ab227b4872723b867fba4ff0801b3b717739d19fa5984a39ddac116e82354de496f9a788d135c5000022358799b7c06c942391be0a649ee2a23002d0e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e19857c492f39bcc39bb4979d9fccd0

SHA1
3c20d7950c3c96a4f411a8fdfbbad58e2f1be861

SHA256
d7d3c46bfd25501006e89c9fabc2ffa42b41c8fb00baff3e4fb2543fd302d6d1

SHA512
4bce6eabc77478ac5f56a2187f93a6a45675eb4e809d87535df0764000a440824fdba6cf6dd3950e6246672ad9402e268df191ea1c015498e42062fc4ffa0416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0c0bfabe8ef0f59fa43dae3179f84c

SHA1
f715d8dff4e8492f4e4db39ce3fdf86236c24b10

SHA256
53123d9b1382ea5c4c38f41c27d6af05e411190142a4711b1c3af80697340846

SHA512
a426ad50f79612daaf58d843fc3cd3053d1cc412e29b83645fd8dc0e3f6ab30fa866750a73b09c9f93c04ea48f57c2e592e85245302ea7119f1a89651248aaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0491a5a65004c1b53ec71d9ca27effbd

SHA1
c2b6433bacd33801b755488142312de3fa652e1e

SHA256
7a15cfdb02d2b0d062f0d6afaadfe7b87c4248a39c3ac55ee762db620d5b0f29

SHA512
0bada6d699ffbb0989d840b00077aec65799b2f724a445612123a3877a018283e7cff35dd73156c0e18bb577dfba17ef5457c3afabfb33e2b412dc91556b4ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c4d93cf2d9c813f37e42b0446ee5905

SHA1
c38ce8b2005a9c05f3d4b8699789557505a95a88

SHA256
821e95d87b9e55d5f2a7ea3e14cb64a53ca18f978ae5e18df8ed538d1a1f1d21

SHA512
26ce92a248ea377fc10d3a6fd310d0171cda175e0611845c5d5f3950b5ac91837a3ae0d08478bc04c7583f5b996bd29deb58481e2fabb2e5dba5de34e0048eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
200790ece493494cfa3c0147e59fd7d5

SHA1
301c312bd4b705a4b9cabded0554be41c6f2d585

SHA256
dd21069ff8bac58a5bbf7ac792ee089528f1b22e73253d4060fb4895a2f82a10

SHA512
3eeac3dcaa094db532442f1744bc46ac18213e9296afd23265c1390c6d2cf9ffe849f947cc90a497fccd41fbc39b828456c375bfe198a23a9e49e9bd805260fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eefe08a2260c0dad9ce19169707a1878

SHA1
075938957b63f5685ac15f5376a75b2efdc6fff3

SHA256
f6f27a5db78e54e9f33d9230fdf1098bc44e170ebc9bf591f3d939743f227f3d

SHA512
881734a139e557c6e786aa27c8c08ca1c70e409b0ccb6e11d2be81fa752d95e735c0b4f9708a299bc61b1b08572c9e2c3ebf588536282706873a9a0f999a9289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53a7ba927537fde2e1a237b47828e39

SHA1
2021b349ea41c0786b9d25d48c7d29ff1b08455f

SHA256
9e661f028cba850fa91728434eddbf0ef944aba3b6727a5c0f4969a54da59984

SHA512
231cd40d2b3e837915bef83e3d397cd1feff013df7fedebb7468322380bb799ec743f7749220dba7fa9d0e1b3190b9cc7637a27e237b7f12c5b83786fc386104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd780bc862ec593393703c16dea833c4

SHA1
50febbe7b96cb921c703acad49b40479f1e30043

SHA256
e7e790056db472ac1a7ba916807f0dd3c7e554e0f5ab0f3a4db8acb090a5da78

SHA512
226992cace088cf57039cab9f6eddc4ad8ba89d27dfee4cea4004ecfb4e1d812a4d2fc645d0d937362c69803e86642e0bd912506cffcc8c9454cf614fe8cb326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d048210d487413cfc375e6e31923e525

SHA1
ae334b3dbda30d04d8cdb4d3b74ab179feb647bf

SHA256
4597c5cb12ccc96bd0d2fff65dec06b55411e2799de489e5afbd9956e9119d28

SHA512
7a01eed4452fa2fb5529060b977a0a49f2247227d61596c13f9247128e41ca712281acf48c6c1ffe905038e43c0d3502b442e915a5693305cf9afa8e3b4acd1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfd6aa34eb464d3d4aa899870076816c

SHA1
e53c8f3d4f61a99914a73b5a647913e5d8a6d264

SHA256
1b18e9220750253aac35ad77a78a7b4e19dc6864f211d8c8630340c00147af0e

SHA512
af23d65b7620c1a69c3dcb14771000bf3e8f7c7339d76b79334e41b5b24202d19a293eb676752b33e5937ccf8b1b2d6b441890941749e06f9b345a1a36916136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f7a2ed08ba8ce72df92ce073311e3e

SHA1
5e1bec26c52175d571e4dc75cf4e78e49f0c861a

SHA256
164987acf3f685940d1628fdf885425512781148910d3f3c8adfd62152261644

SHA512
b672a5775cf960df14ff19013b732f523a8b13f5f721a6a84217ffc571c02c786b28658bf844cc922c3c27715cf2069b4eb2e626d7843df55ebd36e4ee762479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b587e52ad3c5db69c507bf38b82843b7

SHA1
ae080edcaf80761997e957a364a6559e7f0ef5da

SHA256
872d2f3211a8977a55e73aee801c9c3ebf4828dc2ab1de12db3739f3b529e96f

SHA512
c2bb23f395dfdb767e5da770c5b9d955ff8a53e26e9365e103bf096ded12bb9573dee67629bfe0b5d3b73ab659e97a32db9e7bc1cd71efe55241ef384f8e0029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd822726944c38663fcd0337e0ec5e5

SHA1
44cc2a2a888e448f1bcd0ed87a7de270e6680c6c

SHA256
b3c61ee1d10864c0448b9bcfb5bd62398c00f268b209a67352e0029b27e4a106

SHA512
c4f0d6f42f8f14ad653e90e1f451c87ff3cf7e9e41efd374aba3df97558ad4cd1b51ad3327587e34c9267dbffc5038d1969f83a4f45beaa6707ccbb5170b64d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b97d9f714d3963362392bd981268ddb

SHA1
c35403fd53f0b0edac2a60c1c87cc9117f0cbac7

SHA256
faf36ef757afa9e42c5dc9163ba3a82133324330174601acd46a2718ba4c80b0

SHA512
650dba4fd8c6568165655a86d523cbc13311507f7f03ce0373654fbb86d2f086516d7b77a5586a0bceb34395f8ee8d972f1ca96f0784e917642fa118f6372f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab84CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8743.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit