a1127358ed90d211efb84380a142b5a6ba2a8b1d3055731fcf7b66a7a94a61a6

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdae2f095561b2fbfc6e9096bcd794f5.html
Size

59KB
MD5

bdae2f095561b2fbfc6e9096bcd794f5
SHA1

05298e8aee72963e3520112b48d7ead863c8feea
SHA256

a1127358ed90d211efb84380a142b5a6ba2a8b1d3055731fcf7b66a7a94a61a6
SHA512

f3aa281ea5677d4a5fcef0f920e514bfd5fa7120319ae20988c18e845561764820da38c1039fc060fcd0e65f3957e0cbf2edb28a49d79e7d7a23757a261dd469
SSDEEP

384:ifbjvTDYbw0cRQgDH0e4hbm9hpIxExiMOsHTF+69+XALkqMLcLIqDT62wvUKKQbQ:Pw9mMOETs6UkL3532w9qVd6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07473B01-DE98-11EE-AB07-4AE872E97954} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006552985f025bf5239367e64551f9998a9db246405b0f23fcaa2d2d8f391ac4b4000000000e800000000200002000000009ebe038af200bfff78dac38273b8430292bc6db37207fd003a62a89a7178e9020000000823a3c8198747c216eeb83d6f8ac1d54f0ce60f2800307d0add06e6242191bae400000006dea6620c9032e87725a6818d963c47f76e91c0f9f94bc1ff79404a77b9e0ddc13614e7da4cf7860b8f94b494fdb184ea1da63ac15ecc135b4054ce88baa390f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000094b8ba063b203bf4092d317f20a583a8603b246c9ac788b8a94258fe62b45262000000000e800000000200002000000029cdb7c46bd77f2a9f1694d04e8290d486a03531a4158841a8b40079e4c2ebe590000000ae4f742e42937ae969dd9434601b552c395c813ce34ac4c294142ecbc7dff07ce6aab2967b77fd94095fe88809098cd4389a9691e2050d29d554ecdd9b4a7328efa474315b76bed6a3d2ffc18c3f57c80bc0e08a67f89ee7b8d71a77b34b8670add03d4bdc5a4e1fcb5c97f7eaf4c60703a09e2472d95a155093bafa55d721c5c7923c6b66aea20ebd034c8a5dfebe3e40000000c5bfedb5f8b135ec595a0bd8a128c1b195f3dc5b095ab41fc5d4f5accb0bde50a672e55b2934beddb9aaefca62955f5999b567ac0712625da5595a7626453f6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d032c9dba472da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416207373"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2540	2528	iexplore.exe	28
PID 2528 wrote to memory of 2540	2528	iexplore.exe	28
PID 2528 wrote to memory of 2540	2528	iexplore.exe	28
PID 2528 wrote to memory of 2540	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bdae2f095561b2fbfc6e9096bcd794f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7516035ab7de9bbf53efd2e74490da

SHA1
3c72e15a264b32eef067ea970e95f6e44a10a077

SHA256
7f2bc9e44c711004c5e0194e88a859e59d5d08807767c5efac28bfcc825eb030

SHA512
3dc869d8d1ac5b340b447007638b0ecd1b2f27ebc99712ba9ce9f7a70086b2762fa787fce28acd0a9f0f09af6124c12d4a38138ac70ae7731c5613546566ae04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5d70ace5072b7a9a45c44c23032c70

SHA1
7d86e6ba7a6c2a35501ccb323d881a6dced49944

SHA256
6448bc2145ede188940b8a0f8ee516b369c534968dfdb97b82f55fe4176e13a3

SHA512
10809be817d642e95791ac986abf89db8c2857fdb5966fbb051722aa1064aca64697144d5a4764ef59ed4f21fabbfb6bd682e178c15f6e40079d1ee0cad1c4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dffeb1f26db6c11b9853408143a70ba

SHA1
566579a735df191a533f138c8427fdaf75c30dba

SHA256
05b94f260057245cd7504a611f0e642d2c20db3df24bb8fef3f65d86d4ab2e15

SHA512
4e358e90c3b6e66e63794cbc609512412106b76822f7c121af98cfee401f8216a11be9072f78d79d5361de8f2020c95732629b6cf5dbc4a5c20774ec41bf9b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e03c7b6e365ff7fb5bf2170cb8ea93a

SHA1
a5f997424aaf0093d55102d2fac08e2adea24b2e

SHA256
354ca85159e524e92f13e2604cafa1334ab7d5be6933b6791e90330552c0759f

SHA512
6a9c5a98ed582b2118e702e11541bd4453bf734ca3f30bef7bf97399a50bc5c8de32aba70c4f392c75bb64d9fbf910df07a3356024777ff2065811ea85402ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dcc811c560fc4bec1cac52aa5027c4f

SHA1
d6328bae46af86298c00f7b9b9dd9632c978d6dd

SHA256
c3e35263651de46fa0ad5f23c924023bc4048441a5918d9879efd1cc673a560e

SHA512
ff76816a529067237f8eb61d48f4f5668dce8e2473d296c4fff79cea1162e95769bde43824f4ae1ea8761a71947d76635955a9d91846977f8308ed628aa61464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f82bebbb30189d717a82b6f0f46efe

SHA1
627a0b343f2da1a1704ca4b70a21dc1b8a72aec5

SHA256
fd25dd39d626d3cb1346e538175eac66cea05205e3e80fa8355b8474f4cbce41

SHA512
e850f88e0e25d9ca7c6f0946ad2a8856d362975a05c77808bd287172ea14f3ebf8cf20a9a1b1db5d660427aa09be2569168d977840e297e001549daa71d5e26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c0a3f5c87083c2260b2909f3b7d027

SHA1
7c1ce8c7542d3566517f91d70e34d3da7c2d6864

SHA256
76c51f9c2767d4c4f29979d1c467093658155fd8fe2a8342fb937b0d081c1298

SHA512
9369623393f81ffe12edc96490d57b3192e71aa7709abbc4c15248b211c8a0c627e7c0ba88ff652ed32c05acc011cc8c7eda9e1f05210f341bb309b0557d2da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf34dbf6db2d096b9428f3311cdd432

SHA1
59410fdfcfaf51f14e0e7d48a8c3b7db41dd6a2b

SHA256
81eae0428bf52eaf01b6ab756dcb481513119cec54d81527ea0313e37f1a668d

SHA512
a86c86963f8b0e7c49ed52bd5016b5c24b523b9e31c08a36d3644480be6af58c9f56bfcc59ffbccc3a315109363ad9cbe4166b0ecdce0f82eaa4e78f1f1e2419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29304da969d88957405080af370721d5

SHA1
a6cc5d9c3a69cf1ba8bc52d8faf2d9bcf49b06a0

SHA256
f717587896be494eed4a8288b370014c8460a48fcef72fcb75c4d14aec41962e

SHA512
116de1f17f32fb7e96e288766921042ef1299820979530d4efe6b1bce12695b344cdb421027f56dfa67b55a0e67b456b3b711364a8237649acc1e59bdd360a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e97e5a961e91ce921f4dd4db0a1a587b

SHA1
6d26adf067fb126b353a55575dc24aeb6eebc708

SHA256
50793c423e43ead7aa029380a73830bf879d047b821eab2218b3077a04eee461

SHA512
ed8cbf1822a57c9ec280106058a17721eabe0254e1638177f67104368d77b7f0ae492472c5d1978c8e6b07aef13f011db80986a40f3bdaa126dd5e83388c08c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
577f40a60f1a6d06e7a821c4e2213ad6

SHA1
1d1bb37721cf924e1d653ccf533ff54d2595c187

SHA256
65e2cf8d3b4d1bb6155e5bcb13ed604b540dce358d7f7bb1057e3ae7a57a6e49

SHA512
22a3fd7f247a56475a85da826689e7c97c5569a90a04dae49421cb3b24b6d98523cf0e4c1b26871d310fa8ea4cde0f5d30a107ccf5ce140cb68b7fa287153615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf62a49b2fcb5459c7d951eac52f52af

SHA1
e7389f1f7c621898268f545ef5f6c1bd6ebb045c

SHA256
c479f69aefa442d5699118687ca189a39b2488af5385423d03aea88e99323e12

SHA512
aab87389be6f54b8e6279c09501d59f29b1f9b5b8de539930791854bf0ffef2b7a9afb49fd18f274d325a0d9d6398fd6b77d2689a3da939662d265bf976a1e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e9d2710d2e11fc8c392b3c75672592

SHA1
6d020d26e2382708dd538eeab69a60d36ad0be86

SHA256
ad36650a20f85d9a5033551ca95a194c3fc2cc7f56bf34d0df1ae4be7affa8ad

SHA512
0105ab78b4a70c4b848cb72a377bb5114869bc17d2f714ef2eb47f3a00195927dc5209f408e1e9f3cb3f0a1e2bf7b8c030620a94ed6b08a27212dc15340dd025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74d28437ade7223e6e8dca65d47c7d5a

SHA1
b9eb3d08f7c48f1655adc1d7e945460e2055209a

SHA256
2a8d2f11ac3969ed15fd8154aec79d7ef913808b5d09abcbd496815b5f0c5b02

SHA512
fa54016c6d83853f291701b8a0b9e1c0ad3c71fd44a931cea2410f5259b334f8d793aab02df5e9429a303edf569c06944f978b045634b2fc8c2ca38fda044eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b5b98122161fab7a65da4c58efb397e

SHA1
25607008bf37c0df4a4fbbb2494ae5760f9f8188

SHA256
df92411e8bb3dbf4438ddecf4f6c3df3abab4070553c96c16a05b9a386a3066b

SHA512
0250439bad859c5c8382e7bf99867d02b86b5dc3f2a7300db1b27c78622319a1a21134ef1768a0e2e9b7adb8528986f06e2ad681680ffe5f02e838c115771ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DDC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit