e992e527bd98a4993efdb000e4a9b4999bd7d6d8568846751b1fd8719c1a8c1e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee22e571340c4e9658beeab174022c9.html
Size

15KB
MD5

bee22e571340c4e9658beeab174022c9
SHA1

bd38d019fb2ef7c14bd83d97b5d0f821282ba738
SHA256

e992e527bd98a4993efdb000e4a9b4999bd7d6d8568846751b1fd8719c1a8c1e
SHA512

06bdb29dafddd4151e10fd0e42a35bfc240e347293ca9dc5c7833596de93238053f3b2063c8c9d0e3e858d4f691fe1484af49e3ad7da34dd15ad69647e4fd26b
SSDEEP

384:04fwAKwV/t/3PP5eIwyaOg29uRw8RtpBDo/hzvhA+W1axOSGrux8SpOZyYZJ:3p95NVZgNw8RtpBDo/hzvhuwBx8Spc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007958e23d269101561c9d5baad4871d88fa4337bbca15ce47a6b5cb5dd6555f3f000000000e800000000200002000000036cdf933e5cae7c2b450cd5ec92e417bc65074d11f499f9a6677bf3c4ff5bd5e2000000071441fbeb24253787dfb2fe3a6ce1c06eac3a8fb05928fc1c9f0266bc937bb9b40000000ea9f658b263116d28181f8209664a3e226ffecf4f47b1bbd95b6e9cc3aed57debdfe805cd5505bd1aac68a75746b0fb27d6f064206995382c79c4e656906b7e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d9c494fa72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE9E37A1-DEED-11EE-9A72-56DE4A60B18F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416244159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000c7283db59a7bac91df4bd72b5d4c54f0d8a2db23cf6e1c3a8a4b6e0d5ed44a9000000000e80000000020000200000008fb59662983a72cc191caf1b4aca8c22dd12e9f3f018650ed5be88c406f97e7290000000101d984d7899e5a3fa5390119932e7dafecede02b0fcb45bdb5a11189d6880ee48ae3a68b2119c8c65ededa82949dc0a9574f75b985a7842079082f99eae8fc31f0db234180e35919f852551f1d658e320c616b36a9d0439f86ab0e134b0ca8b27fd80dd0d894efb62634e174f8bfff3db183c8825d8f04eb4a6bde9bc099136295beb60d9b83ef480400bc4692fae3e400000007528e9a5a6a3d33a82738625ce6a223c96ee72c15cdc6ff4b7c9555deec69a20d885e3963ddfffa1a61f8f1fb1802eedc8be929dc603319ce14449f44f2499d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1112	iexplore.exe
1112	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2176	1112	iexplore.exe	28
PID 1112 wrote to memory of 2176	1112	iexplore.exe	28
PID 1112 wrote to memory of 2176	1112	iexplore.exe	28
PID 1112 wrote to memory of 2176	1112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bee22e571340c4e9658beeab174022c9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b8d2ecd6a2fee784dc46ad20f8902eb

SHA1
b393605f2e2120586af632dc0e9eaf9146ca57cf

SHA256
e70621fbc60f7870e8047b302c6192c8c50fe3a27ea9de61e24bc990094fb847

SHA512
0a4f6a124844eb13fae8dc32a2ddb0168eb82bacf54080fe2fe462c67b91755878a71330ff190e28bb07ac14f21a07409e4a4c66d773ce148220ae0db18ba1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ccd2cd54fb4eb1e14629572a6d8d88

SHA1
89faeb4a2dbff1cb29a154960981fd3c2378c54d

SHA256
99723db18f33799e05331154926edd7c3e09dcba90e7c0cd48a5dc40c6f2708a

SHA512
d5e68d524cbcdcc8880e27d7dfd4a3b4e38b3e7399392424a2da4d0d5944a126cd5391cdd4071451f92b7d5e6c90e77890d04f329c44220de99273bc25f31eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b3841c79654fc693f6a5b7846b163f

SHA1
c347f79ad0c380258ff4894664208295537fddc3

SHA256
1e5b161c13ab97304abbc67479886ae240d0f937d56ba43b1a51d433c493d294

SHA512
0ca85b199eee3c33babb7662ae499cc737fb982db7f901154bcdb9228caa48726e95a1d833431c7a923bdd8464fe24ba8771410b8f192306fa9d95ebc3182c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1edc8052d5fdeeb32497a707b80e00d7

SHA1
6e7203d588b85822245adc2b76ff8ae620566d48

SHA256
4d5672a6f3e68a82a9ebf6f5ac7c35f60632f22ad3fec7e6d78b0f50faa5604b

SHA512
6fbaea49262b21fa76a54717a542e783b6c345d2bc8e895e7af46c02596faca354c48a2c876e2421698f4548471289a36706d92c29289d4f96e59d035dec7f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c73462a0f99c58816ac033169dc36b1

SHA1
578a31934fb9014c1b05073d8ef8f9e0dd1e5165

SHA256
594e1542d124638f3f8fd104d7f4081c4b0398334aa63cd4bd8572ba42314588

SHA512
af56485a0f7993101d3a98e5004e58cb2fe0e7886452be34801a0bfc7a3bf3b801ba4cd96ebcb7195734e321e5e642c5d6c9dd48ac461e648d7532d0a64e87eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401dd6b5c3b4a9aa5ab30d9116b30c5a

SHA1
c9eb983af9bd6a3d5843c0191c24942743a4e992

SHA256
6295ab2502cd5b95a53ed96bf33989bf7330eda3eba75b6b2fd04a4caa941e2c

SHA512
44c36d4f3cb220b9535c30458760f6c00dbfa9facb7d5ff835057bbf2a6366b24a070cbd1ea1c58e201f792065b45ab2da207494a76860710a25cbdbf27f2f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c5f8652dd05b93c004f1e2874ff77f

SHA1
43f28700fbe5b4e5e81cc382889cf005b2578921

SHA256
13eaad4fa64051e853dcf23f4faf4ef8c36a548ac2ee9dfa68d73dc9b8f1e026

SHA512
6a50f72cea0b14e29e77b072c4a885c3d5532400e152181a7384f3b5562799f083507cd823c7da6c853452c6b27eb9ac767fb5a7515eea7de548098974e3f5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f4bdb5e943aa3a2e03e52910e49354

SHA1
2f86e4a5a5c2122404c6891cd024b808466a7070

SHA256
3fa098413706af5c55b4cb31eb87b60b8ab37924dfec2172ad3a64cf84445160

SHA512
d6ae48d02c893780cb6c9dc98d8152cb2207ea995e4d022b71c6bae5e753a6c63d429b4444c0cda8d5af4ca29b91f7c9d96b2d86012a53af066502378ea20d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0f693c7a4ccbb749471514b39da263

SHA1
8a3b0ca3bc638521958d120420b32ee97a2773c1

SHA256
19eb7c9c140aa29efa1b77540b7813f1a116db3618f4e68388166b6f560de7e7

SHA512
5be824e7dd6995c52e1e6db540cc7c2fc6cb93a077f0d4c9bbd42f30d472a25ba8b122acd37831b826adbce8f8a2aee0e517593217096a26f96c393253b8f0ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc0b3752fefe78ebdcdf400eff77b8d

SHA1
a8d61ce0df7e9c896ee8ea6e6409d877d016dfdf

SHA256
f2308ca9eb8c25a9a9be7f8921c128f16cab64ffeaf2a49f101a9d0da9d7ee78

SHA512
fb9c0b930817efc4303c66c597f10871a60da6d9dd05675b65532d3d5af6d6bc00c45821886a357eea4fdcabed43b5dcefa83414931417baf74624960ebfd161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf63d07f9484db1114e299ef03e1d2b7

SHA1
643a238fce0f4c6e28117c3da21155354a2c54ed

SHA256
653f1585d63a64fac49cebde23326fb220114d1c2b93288cf098e4e7fadbfc30

SHA512
f60ca579005f4beaf11e828a353b6f5ece51afadf780cc8004cef4d9352df608b6dbe21cef7c7e5f6ec146294204e9705524fda56d71c04b3f00d86717df3276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87a9aac2be8f8e8c9e5e8810dac38022

SHA1
c6ec723b2e537918d868ad5944233027e5a972b0

SHA256
c4c5de37433477eb45e5a9ddd7f7300535bb2a3a99ba67b81ac448cc329854d0

SHA512
08b1e3d3374acd9a3def2fcac4787ffcee9f22d7bf31caaf163e16beff8c5af387bd101acfa26c986d428a82e7c9e5786d9ef727c5001f6390d8b2d42351ff3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CFC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E98.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit