fe81cef477b1bb0162a307e19f23f6631a246cf68032fa34cd543ae4e676fb46

Analysis

max time kernel
120s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdec55e3d18ac3a33487e1fc7f52236a.html
Size

601B
MD5

bdec55e3d18ac3a33487e1fc7f52236a
SHA1

56a6877437bf96de0f2acf5be709592e0d383a38
SHA256

fe81cef477b1bb0162a307e19f23f6631a246cf68032fa34cd543ae4e676fb46
SHA512

717a98aaf307230bf9e12d4deaee3173a21bf036e6a88dd241fe38d4d40e826c4f1ee6cfd02aac31004096f0357d1c4e19499704b561a95e0de2596ce424c2a3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000b640e173b3d4dc591f01a37ae5693960b66d96a10d3abf530018b08cbe764e47000000000e80000000020000200000002d61a7f7a72bda76df1b42a76852cffa565bbfd259cbc34ab89a472bff8e06c2200000005f1e0b4f4e724c44d32cf54cb5e40057e92cd26c224acc174aeeb58bfbfc74c440000000b87e55701fd2fdeaa54bfece76608bd0e29bd0af2ab15b131120709237ebb21132a7a0817c8d414d1a97076d399ea991652592e07280045633762cabadff762b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b080a7a0b572da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8E0EF21-DEA8-11EE-8C39-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416214600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000032de12bffa1531d2abd8752574ba4d7b3dea256d90f8e5822840f18646611339000000000e8000000002000020000000c8950994c3c9f48ecfc077a1655897a335f47cbd2f8ea17a09cb31f32ae45db490000000d1f7fe873940dd9346c2b99dc616710eb4b868f09c7bc0a5e089dcd0cb78a5d6b03a10dabfce2fb77d93faca221403ab4e72b1abf697ca4219a2ed2d175bf5514f7406659347006aeffd07647744e9e6cd98eee3faceb4851a8c91e0b4126eac5b58b4237aecfdd2de9dbfa514eb57afafed73eb54efee24759f045b187041c7d167a6f69b6e58a43a1c42e818d615a440000000d75153d782ebe2f24711d7939ea2f1f770578b21287c94f1eaae1435c1d570d92ba6c8570b1bd9070e45a631fd4b311626190043ab77442789c495413814059a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE
1948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1948	1940	iexplore.exe	28
PID 1940 wrote to memory of 1948	1940	iexplore.exe	28
PID 1940 wrote to memory of 1948	1940	iexplore.exe	28
PID 1940 wrote to memory of 1948	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bdec55e3d18ac3a33487e1fc7f52236a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7fd8162d6490bdbdf3ea471be8decb2

SHA1
ccabd6d2d7fab4bd893956fc6472177fe4c5f912

SHA256
e6e528a3b09a70106ec00b9296fbbdd369082ea03d610deb11c790beee8f094d

SHA512
050b8e54d7f108d53569b0fd61a51fc438329f563021d250623a6e4664e118053ae1f40e717150e786ddf8fe5098c42d2b2183dc5bc3f81a7d6eab8961980ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bce90bae87d8257845ec6f03bdb7952

SHA1
67a78b78a835759d0bbc31dc082f39fd6a8b7917

SHA256
e290d13f876613b21d8be745ca5eaf989cc07a4795a8d87df8b6c7909e530a15

SHA512
4376bbcf91826a328bf09709fd7dce255e605e8a116f5fa5d4c43ee50df2418a47f601fab5dbb16fc4a3c77f9374f178158192af8927b8297c950c8376f3c4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d83407869b1912b25145256ee9be622e

SHA1
b7c272285d54865763435bce9bcfe3e35d3c8dd1

SHA256
4c5a214a2eadd42d6ae6b73c4ba37d0c91da5377843575cfa322c1ec5b2859e4

SHA512
e9bcb000d9690d205e7e0be3f26f1e2295e55ca244b249344f39fb4b533a9b7318543911e79531501b338392bc9f36b7bc2f264caabe6505dfe02f582b491f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba1d482da436c3c09b5c3e97ff42143

SHA1
729f9f0fe53a9aadf346ad22eefa9cbda2d3fba5

SHA256
4b10a692db89cfbe92e8a69d9321a9808e8bf9dbfce6d8e46531774e9cc8da18

SHA512
451d8255ac4e54b05947ac806ba53573ef1fcf6f030dd8659f42c4acbb3c96814a5aed84974d2f6cd8bad554afa0a4d66d0766904a9c3fbabf45915f0f58840b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7572430b009f978de3d3a21fd13c3f03

SHA1
149904b4c1606d27d5efc026f76867a21dad5be2

SHA256
c4e59d722c9055a34abfbd3f909ef27f253d3aba0f4babd62f49e09f62d89634

SHA512
4755ab4411bf3ef766ed527cb51482e7e544f8350e601bcea36bfb285920e0c3fdb32cf1ff1f11bd231f7297bdefc26df09961c2ba680e4e5b186a147ea99d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7cefaa1dc0202b2e4a3d27e2e009214

SHA1
c8944901937432d55b2006733a6a904995dd60b3

SHA256
4663c30d906b59b046a10fb06df7d1d1f712193cf7666e4e1e4ee3162cfc5db1

SHA512
6181eb1b005f4dc0aa1f621d64849c9790180f1b57d8148799b2981c863360600f6e02fe2c0626a1b51570e3b4a57a55c10f9c870000ac01f7e99020dc1df717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
674eea4743b38244eb3802b9802c909f

SHA1
7b85226c0b3389b060f0f31e3acf04924bbfdf56

SHA256
3b8770ece121a4c908fa2ac22f714945efd1196678145ac2755739f87d673020

SHA512
f4901758bccfb47d34f35d77ae6bdac16fe0ca60e680bda339840d93f8554c6848bc67cd0144c5d8e27c91b53ea012e5f89d315228152b08c2a8fdad1917c521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9feef0c61916d48b1081e0655fa096e

SHA1
82e13ef99d937a1155fbf6363e7df64dc7a2a7d1

SHA256
1c1340d508edb3295a2133875d4d552aae3f9c5f6179eb329bd494ebbe2a3d08

SHA512
67aa29cc97837a45969f9f43ab5ae84d32a374b42442efaa6f68e9cd99b6109a2649ab3c515552bfce72b1bc32260ab6889dd13a88920c04e9056a40878935b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e5ae18f5e1b4fcc034bd7d1439e4ae6

SHA1
ad72cba2b91b7a3cb67b2e6ea7955c61a0848fb3

SHA256
1af8d90d05f3d51506ce6ba80feba76ed06bff0d8f59d6ddc832f36e673d17c5

SHA512
cec3214175fe7640b4225e7160aba254ad13046503f05fb0ad0c154045ea6c14d6c0d3e0b3b9f03bdba0faec6ae52086d0703537ca912a15a76a563de419a806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae8b405be07976d89d8c8fc4312ada41

SHA1
c5c86ea7032b5edb8c56d2da34ac5de40142eb74

SHA256
475f413e5a134df576aa697bd90fec98ee85dba20fb22ce367976f93df553c57

SHA512
b70beb77108670f843681e0a226069d936fd9fba5525e41ac63bc2909891809e5de1fb4ce4ab115d94ec03799981a9f5ccbe3b86550d1e8f4736605a1b17840d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9777694ac0fffa2269327068686e0cf9

SHA1
8c1b94ea019673298a97fe6a62a0d20d5d5cce80

SHA256
d78380a7e472a44d321e1df567c81d42706020e532d27a0745dff431ddc97a59

SHA512
186f82607800b4f7c868fc825145c9059e27f717e7f206c15ff32cf2de5c039a647d1608ff715eeaf5b29158b35dde929e9091f01c85c51ec1421f826f5244dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47e281e199cebf9ca6bdd27f6aad33fb

SHA1
83e521e675ba24b61b093e28a29afd8fc0b83251

SHA256
6766ac65f57f894f78310045a8ddccef39b454b47a986ff4195bd8e70cad96a3

SHA512
16e097ce101f7a990467c668ac1ec69d6db064a8d3472ef8eb3294a971a945c31113f8925ce1cfc848c8323f269365addcff249b3d46dff53ae09b0662815662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a84ef77014dd41c0bab04ddb6c9898

SHA1
3cac6e8777d24ae22206ef940c595414cd7fdf4a

SHA256
9b2001eadc59fcf7c76f9bc20b431cb7455cde90f8b96463e940528d767a69d2

SHA512
a0edb2e4b0612b727801af9ce3100f9135708cd4dfa0016e64088bb3a9f1dd6f6e3999e992eb702f64feaa4988e50e9d804c5cc11c2f461f7c7eb84acf9cb158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8989caa6ee869c91985aa07e5b18c916

SHA1
816957c0d044ae208ad75562f504587c56ed5838

SHA256
cf22b92883babd1956d883090f6ed88dced4da18c3def9cf3ce7618138485a10

SHA512
d60e1caf6015efde05f18ff5793fec90a50efe2809609d30d567030577dbcfa499501bf83e57a04b724c85b52a95a32550cb351bb83d95cf3b93d97169ffec57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBFC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC230.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit