415fa533c542256b51e8c9a926e04a67f860f60f8f8f45d8a5200c0b66f6fe04

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be92930984288abd8aaf396bcf40adfb.html
Size

14KB
MD5

be92930984288abd8aaf396bcf40adfb
SHA1

0232d38c4e64e794e98cf01893dc5ea6ba0afe24
SHA256

415fa533c542256b51e8c9a926e04a67f860f60f8f8f45d8a5200c0b66f6fe04
SHA512

89953a9c9728abe0ca1670a4cce33a500d49e2d3a7fe7de24937b1868a417125d72c5dd0fa09c9781b51e484a0be548838eefd8cd227ce4b330772508617d201
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v9rmlKt6DvE:aioWD/ZmXg8SZQcrmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c915cde9d1ec19da74d0b53e566c221bb426640ad934b2c1eb6e1b61d7ce94ce000000000e8000000002000020000000f5a59e618695cbba4a8cd0dc85387d52123d6497ea02985296c19267bed41aef90000000dda547d08be0fecae2894a1917e0b70a61802503863631900e2be4ac42fbc34e522d25b2f16b251ae1bd94ae550a52eff9fa988c6d59fb2f58a2edce3e5ef84924b322232aad9e9493d9ff7ad9e9b084da4fddc1b57618b3fef603dcc602c163d98023d10943c2d5bc6502dc0061a4e281691dc7bc540902aebe1b31a2f00501bae98ca2bb35353670343ec040e7322f4000000009a414db7215870a60ce518e5bb5e1ed4fc3260ea8737689e34a68423eca7b23a21fe6a6c437fda3369152fe078d0d9a25269dfe14fda969ff63b9de0806dc90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000077e60a7e7e94188115c5c4a75e8af70577b7b4d72aca19e3c53e27a918ae875a000000000e8000000002000020000000cc0c71b1a99e1cae09a5fdefc418bf9b7c5eb217c0e279cd15606fa438233fcd20000000d5566f79f9f76403291a6129c95d0f269372a2dbf4485a678758d93f8de3eaff40000000a47b35f0fcffff21721d8aa6e6696363798953208e315cceb4ada443ea37ac5e04dbb88a48ffdfdfd08b4f07ca1a55bfb63535f9f1718af055d7aa52a32ff19b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406cd306e472da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416234508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31606581-DED7-11EE-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be92930984288abd8aaf396bcf40adfb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4a647cfbc0a845124de97e876add22

SHA1
d310f5d22b2658a3a12a0424692aa46cc43b00bd

SHA256
2693a0ccfc1e0ffcd3d535d5c2ec73a243e212c972bc562351cb7990eff81314

SHA512
6994f52333155f874e4409ff939bb171432bdd99e397d01dd385e4ba58aee8c26b439db3edddc696875ed4cd73bb95e95d0a274680bf9adafef42dcb89a4ccfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efecf8c045ce2a395201433d6358ecb

SHA1
0486b62400f890c919dbb775c0e84e0e226ffa72

SHA256
8d0618e56e435e38405ec80973ed6ee3b9fc34c6212e071a49ec2abb7f971565

SHA512
96cdbfd29d1584bcbaf8e7fd5e8418f32dccd950a1385339f3c5eaa8b2100d8356f5a446ee23c73fe7d04d97b73018e894620405c1cbd60f1d0883a1e065f5d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9103bc697dfa93beeee72eac8de6201d

SHA1
6c3203c0d3c7614e7f2d171cb3863818f941f520

SHA256
eb9341693ca31c01e8c8a549d041edecab673ba431d9c4e4136a78297115dd98

SHA512
a69db4167dec39f53b389c5753a812d49dbfbab33d213a6526ce842d0f437c8c4148bbbe6db89eeb8feebc399790dd3e7148840ea942dc4d3fe339c5182f530c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ce6114a880333c2519f4176cbbc751

SHA1
6354ec129345913a209578bbcc20803524ea7c2e

SHA256
35097716de653cd47da58f24abe12da0cda55ed0d1ccd3c6bfbde86c5bbb9e87

SHA512
7c29fb94a75523ab6fa59ff2b221e8f42d1cae47e47fa0970681f7f9a8d0aadcf0c6933e1646ffa1138e2dbdb44b31ec33d0ba06957f35fc723338ddf4780984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f69daf30b0f1c6c63040f610df2af4

SHA1
221f34a1c0d5682e9e9d2f9401e7ff48e6975f6e

SHA256
f35ccd4c3494f8ad84d0842a0e73150e9b0aa9aed88891cc75e692201c59045e

SHA512
b62e689e85a3fa112df91865b82ea397afeeaef6507ba3870ce8d5b21762661cabc9a2dff30ada4d0397623b40435219116b82992fbe4ca8250b3c62d6db67d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f840446fdfd346b103c1a3acd4fa02

SHA1
1fb8aca959833fa7b27de3f4f8bef75ff1d5af37

SHA256
b783ee220bb4c98ea94a7abccb066ac212faca97515433454e5e8cc97b686d27

SHA512
dde5f21eac178c43432035b013ae08e0c8a407d8b6ef6856e4d1765089d34bd10abc482ee26f61ee268b4b217640ac1d852d4134c41ff333702247cf69cda92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc898df57b04fdc6c4d1b2d12d21791

SHA1
36b585db0f7ee097db20c9927780983373deb0bf

SHA256
f8fc017d046e201f95294e34a508aad768fc37493a2b5772b14c31ab68a0aa3c

SHA512
94cdd4448b7516ea1e3eeb0967711f8076fc8a9c52939b7d4c109af046647e20c211ee3f5ff6feb05aa22de8c82591d3abcb338f7597d1c931fdcdebec4a3a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f4e8eb1d2645c4ef5aeeeb92ee2305

SHA1
2609a57e883a8f02836dfcf822cfa4e3d662e4a2

SHA256
aaa5395d4807c72adc561428377ec11ab5a6c9baa234fd9f196991ed4af18683

SHA512
5e52cce2532078712eb58f35ac0fa5177c8ff73cf0d7e345c8e0929ad52fa691b8e8e053d9f54a45c9ded8b0f5c4c83fd3c8115dd91a1a176d78a3cdc54fe41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97caad1110f718b172cde15bd35030de

SHA1
f26b7e2aef2da72f9210a6c9ea6c04adc89be593

SHA256
cb92f17bb2d643027dff9236bafb730a8add88c8ed5d236bbbb5d3dc354fe1ca

SHA512
87eb91b09c07aca6b2e7a4790ac1032f64013fd597b1cefdb9a595f7ae17e928035ee392f36d2522d5cc4cbec34a303acd06e9882fd61f4b4c14fdcc29c741f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD43.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADD6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit