3bce4daba0e62571ff511d3d7a726c7eb8f275931e1a1497484fb513dfeaf293

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

beeb8a8b2013abad8c123d02d460be0e.html
Size

52KB
MD5

beeb8a8b2013abad8c123d02d460be0e
SHA1

f18c533b2f01761d4652de5fd0ea762c36e8515c
SHA256

3bce4daba0e62571ff511d3d7a726c7eb8f275931e1a1497484fb513dfeaf293
SHA512

8462739896ec7629d53e7f440e50cc7e096770de8ab7ef4bb8128c8cec97c02d6a51302f2f1832893e54fe9be288ba2e190220f1d9db6d6c4c08bfef8eef8aa3
SSDEEP

1536:MI1zSl6Kl+0ghNxgefN3MU39DMglNJfXwJ0:fs6KlfgeefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAE9EA81-DEEF-11EE-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e900680c1674683e0f85aa3a53f172341e7e23e143005d494b4cc666feb71507000000000e80000000020000200000002a8c5c0a5f74ea9079fceacb61ed361479f608abc968998ab3343bf6dba5570d90000000abc566d5915c4dfcfa92ae42432df342f54ca20c2e29f5e5f5c8d36fda7bc4ff41a30ca1da20f6040c73aa3ebe008eaa1f786706cbe1f42c2aa877bcb9a6f231ca33f11e76f12a8bf98df0e4b8d3f204acfc85599114b4be01a5ca5b38a0a79aabceb4351dcca404654a56a58d9f75a37049088bd45e0941a4d4c6d088de5dd660bd7fc67d97cba60d616bf96575a28b400000006477a7b61d3224db10f775cf04e6ebdfb343c54cbfef5c2921178ba9e19932adec6f901925f2e85f09393d988b4161415e0bf9d2fb7ec6acbab8dd999863b51d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70908bdcfc72da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001ad877f373116eae37ed8289f2b8c39f7ca936c8dfa4f27e3be182e318919101000000000e800000000200002000000080dd9b9142bebaf68e1144a4f39840f9812769f8ccbd44b86b80b6aef37745fa200000006672d1c93c337e341c26db5261986470d722d0bd04bb509918712d8d3e33349040000000579336d3b9c32442186e9a1139d00bc3f471c27a0e4487ec90ca8440ec9ab586c6dd5ca0f3274d5a4d58c9557023f1f62c00e6074b856fccee359d8d050905ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416245147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3064	2388	iexplore.exe	28
PID 2388 wrote to memory of 3064	2388	iexplore.exe	28
PID 2388 wrote to memory of 3064	2388	iexplore.exe	28
PID 2388 wrote to memory of 3064	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\beeb8a8b2013abad8c123d02d460be0e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b339bfa2521b3c1768d26feae55f74e

SHA1
e53ed82010ec7399da7b6d5d325f9bdba01b4623

SHA256
55a03a20f33f227077db43321859e3d74dba7ae78abd2dd99325ea68a52e0ae8

SHA512
15f93b8dadb378d9c2dcab34c2476c14e3f85949a5a9cfab398f1716a3054766a1972a27b42ef8a1f1b8a6a3a486048f85240bb4869257e7dc1f842fd218d666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7675c2d1f41d657c78c90a5c86500eec

SHA1
39ed63400400eaf463f13fe7d3baedabdb31d74b

SHA256
3bebf6d7f91081dde5e875fd90b207647d22fc3c8f1ac037619ad301977a6937

SHA512
81101a0cf69d14b35b0e96f21d56477c2f83c78995d0ade2d725326933714b3f9197b09c6ae1aab716e8c38674ce4584857569cb1450df9619d64bc540e7e3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a271beaf1edb603b5260ab3bf6b75a

SHA1
f4c8c5338bc97f582316b2b46b77031b0a57e189

SHA256
9954e3da668d399a948aeb882cc3d1ed6a08ea14f4a54393669c9df800826033

SHA512
38332e01f7d159eafc4e649af60ec4ce3c64ff948a9a16111c6dc091fa8b37ca1316e8a8064673d56b7cd5f9b8eb9a73957dc1af4c66ce0ad13b0fb91962952c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
789039b57f3b1d24595f1ad3ac0fde6a

SHA1
981a7c0863aa74b02fd65c4ecda11ba80e774b7f

SHA256
1e309968af386e40b153fe4b617b156dca2c3a0c5598df41e7443c695bb4b5c5

SHA512
c8920d004c9426557f61d568b3929b94ac00367fbaf3de9b733177787880dbdad9d1a51270b4a653b0779557da91f3a61832e1513589f9f4b67b48d9e857f303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12477d67f24df32ab06790a22bfdeeb7

SHA1
ffabe4f59a16b781e16e2f0286d43959336252a6

SHA256
8d44067b6c14abe35f02892784509f13bcecbd2d25ca78acfa86af0d44bfbb15

SHA512
a1303d1b7d7764856a19d32aa1c7992d623f6bde42162748c851f2691505a95c381b4b57e2893e5cf6ff551e273af707532515dd84edab54438fff0a4d4c6866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051f2984f5098f04b27a9420cde297d1

SHA1
d42c2157e071c9515e2d67a3cebf3f2156bde787

SHA256
63a70fdfdb2725886ba4be9eded89ca2601c82c689477e68d73d03c425a8d063

SHA512
e1b391791d4aaf2021aacb1503d173cbff196c6845e45670ccf9a0b94d36f87052211ae85f7f870445e67e6a9a391b3a4b0fbd39a0e05c83795097e3ac994b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0723f022f487be8844f21c250b1134b4

SHA1
e2ba427f4373fc806e0cdaed1395ee14dfaee323

SHA256
dfd915fe2b02a025cef206df13b2422a56d06e7abe979db5defb80ab1067996f

SHA512
26f8bbf080b4934e1afa337eef4f79fa1ffce12dbebee93cbb38cc1e8c1454cb3138a9cda99324ca0eff5ffcc3f298871f4a39372bc2273c1be953988f39443f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25307dad5c352598f0da5b701487b44f

SHA1
15b1debc649092b93f1b496d34314e1671f8498e

SHA256
d1dbcfbfaae98393610a2f5dcd62fdcda5e13a9c53b12869b4061e61d27111eb

SHA512
d2aec8da437ca638b27c4e553c5167053f4e3cd57d7178891f3fa6b400509be31244a79f895e29d34a408fba9ed193791f3de3011e0756c31abaf87b48a85af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ac1f36dd32ffbd7b74d23b26fbd140

SHA1
ed550b4d32ff591c1f1b0e15ebd864d1e458af56

SHA256
4e909d8327103a23e11baace70c1623c7b8cbf732f8b3882417ae87ddab87c73

SHA512
7540604054c2556568970dc2ff93da57362c7fb9a0f31e5664ae4dcc54310f2168a60780e728c6a01a91cc38dd5c32444b98d505921387491b130901d0622399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
737f755d531d6ac79a2263fac91352fa

SHA1
eacbcdc3bf98e72c064b5862b08736966c286a3c

SHA256
de94a32c43b5d63fb912133539c5fc8e0bc0eaf75bd3c6a79d87a06e2554923d

SHA512
1d9e4720918cdd38aa6e0b80c6a3f2a7b74c542570b8c0fde2aa8a89f74147a77ff6692efd5aa1774876695a4c7567db1a9383d07af8c63b7133da45db6e7937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d10bf2f67879535a0c5fee98359567c

SHA1
795f775d551a79fd104e12ffac0c8c209aec7dea

SHA256
2b0e9b5d2949e0879f9f603644f96a25d3b2c58ce16e84660f1a517d3efce40b

SHA512
ac2b666f87c5a77119bab26fc41653c95af34060a08b0fdf6fb7c5d1da5ed904262867efe55772ebc448401047c1c80b2100b7cd4e23fdc84dcbbb12e90ea983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7369d029abb76be4f9f9fb1fd5689585

SHA1
312a1887b472ef4f0eac8c298b8a4cc9751e9110

SHA256
3897de692d867e6c25783c6c8e81f3d6ef275b5489d9b62ef0921fca7faa03a4

SHA512
1f23d42592c7da318ed5b48854a1ac8d569d3eadb64df731cdcec51ddf3261ddb7155928eb763c489750e7831f91e397f9e4a3692ce7b27f64124934f89614f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e00954eba11c3196552491ca7f7b9e

SHA1
a42cbb823b57f1e5521550c0b624156cf666f1bb

SHA256
826f7b8c721c1b698a6590a0f2eb7b6f1bbf9d44b80e14447f177bb5bd279e56

SHA512
5c8755547c7cdf7dc075dc6c9fc5893d4f15f82a1d464327638894d2cd6df3fb28bdc9f98afc5488cdc721244e533c3b95eec98ceda5daf4879baf5e90f6d788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36fc728860cedf12c124b9b7af8017e2

SHA1
bc44491f1dafcbee285aeb521f97dffd35ad2aad

SHA256
88fc815abbc20f000ff81cdbf41acb345a4e81e62cf47681cc3f1cd396fe6d6f

SHA512
de2cf54b8c09b56048402c87c79f97154817dd4385f60922f9150e8e8edc0a403f202bc680e3d446596a99f32c6e7c656edffb00aa3c3533607822ca396c730d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar86B0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A30.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit