e7e1d22f51ed0b87fab74ac75df7c29eaff09d258d1eac021b09683d4caf5a48

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1c1f9244ca82741be14b8ed04ccd611.html
Size

11KB
MD5

c1c1f9244ca82741be14b8ed04ccd611
SHA1

274256ab671d5530329ca6b47138dbe07eedbf63
SHA256

e7e1d22f51ed0b87fab74ac75df7c29eaff09d258d1eac021b09683d4caf5a48
SHA512

137de17f5c32f37269f0081c1efbc322eb3aef8ab72cef8393c33c90ae9b145e4b990b9f4fdfecc4fd207f47bc1668dee01f8efba49e1bdea54e2a9d27a2c1d3
SSDEEP

192:SI9RpsaVBRdKaQ/8VNvG6KpWs9lPv9NfVK4Xb5G6H88qm/Hpa+BLFfSUw4e:SI9TsaVBRdKT8/vIWs97K4XHH8e/LLFa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EBC1111-DFF6-11EE-B51E-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000002ec5c7b55d89f7e6a12836326e0ce49811ae95f309f4b504e622e17bdd231b1f000000000e8000000002000020000000686db302c99440216066a5a3dc65e0e46ca1b575ccf95c436456a138e4ad5b8920000000fec67a8d9981f36fab9d9c5594bfabbbc187b325c104b2cd6172650cec962bbe40000000db2d0899b6cddcc3eb8015a1407648907c256a5e6b3d13d397252db0223b255420828d66a259e9be5d0ca3517675eba75c542f8b8bc741999b686ced1dbb2e09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d084de0a0374da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416357763"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000b275c090273def76cf9a9da91db2ae202b75fade88f92ad4976b129f34e1b325000000000e80000000020000200000001605581d743df5017406408a26dc865f7b41f9ef9253a2a2ae236c4f3356cfec900000004cfca5b0aff8de83c1bc018c634741869b801145e6c926041aa804e67dd1ce8e14551ce29275f7dbc86ff3a3bfa92c9279c876605394364edb81f9c79f2d4bc6da12fd3d2e75467dbd7a8e41d9cc84e90e29256881080f569fefc4d605fd8edbd30681d0672dcd2a093fe3e44da531b4048d871d5481ce7c419e4b1b641a27d5b9fe6e8f54e244fd85d31a010026fa16400000004ae072d638af1407c9d1499d8d0cf75c00e1fb0903158e44f3ab2b311aff833f4ba1cf76da7ae3b8847d429f0184cd3fc0accda47182f698470fe62d5f3acedd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2592	3052	iexplore.exe	28
PID 3052 wrote to memory of 2592	3052	iexplore.exe	28
PID 3052 wrote to memory of 2592	3052	iexplore.exe	28
PID 3052 wrote to memory of 2592	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1c1f9244ca82741be14b8ed04ccd611.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4faa0333d985b83f4a78a6918ac48952

SHA1
5eee46430416b4ca740b41f016bafc8bd6f68df6

SHA256
fb6c9556f78557381f20dc93df8d1055c38e67e1c6a2d6679786805fcd4704e7

SHA512
a0ca04c8d3daef4a14104d6e7de0c2a77700238869a2ce12b2f06cad91833b048e3f024916bbffc8ce3c833d6bf590a7b6cedf59de9ce3ecf30b8058caae77b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf561f13aa7611217e98681f646cd3f

SHA1
de50dbe8724b21659df651e06b7acf2ea135bc6f

SHA256
a6c52df6c322e0fbbfce9fde0d85633eea94c63149dac25fcde16d1854e13638

SHA512
8135374132f8e3e44b6c35f57e8e358c4e0b7e69653c050dc8378d4986fce4b82a14c0236193b837b3c339fd38d42735cd059a0c0c8f1037d06d256854e7dd0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e444dc284ce597d66affc3f9f4e0a350

SHA1
58c779f505518f7bdf670754017a04710aec9714

SHA256
e9f9dc02b179c6f0f33b964645e114dd8a1ee3582d240c3db69bd9ab73affca9

SHA512
d49e8101411b83245506dbd3129d942ddd9574c87ca52191b2f8ba6db4f91298ea94f40a002039b6036ca834c97f683a7842f15e32daec52edddc8a8a96ade6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f25db8418944e0816c6df4d3f23545

SHA1
5bf38258c618d1fb599e0620c61052c845754f2e

SHA256
5876fbd7bd23f36df1785cd54ec487f20e1f3a158a877fe2da4d5ad5bae7a2d3

SHA512
3c7eb240b57d1ddaa242cd30a50e9aae79ce1149df0df383858eafd80c25f4a944239d9ad030643da07d1c02f9ef098067f0b1d6f885664514b80f327cd6dedd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb01b18b967317aa6040f3c5ee596173

SHA1
724ac0bb1c27c8ba11227704a7f0d5759dde9bbc

SHA256
7b2e1b267737a1baa54754bb64e4aa6f5bdeb761b5481186380170a6c5cac132

SHA512
d1925445c53916f855b7491037909e7bb009b8db0f173c666a7a390ebd27b24d845e166894f6c7cf15a2c235dd8e6d149c7b183f3a40020e5831d97210459e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf1798862691b26afcc78620ce84a73

SHA1
461c2a3de04a17d9dd49f500cc11567edd23467e

SHA256
228a8f2c1da0ed7324f18d1fabce10ff16e58ea65d8036188709f029188a98e9

SHA512
21eb7a8a733ed62fae1f20d54b61eff68f290e934cada4a6b1446a7246506d4769549834a6e6783f13a64dfade5d45ff307ff89fa7984ec1e51978cb28b324e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e5280a8546aa7ac200e6d63876d5aba

SHA1
51181a4e01c814d121d2cd9bbc664e1aa551605c

SHA256
7eb0bc649a5d39afb6b58d7843622dc675785ef1af9321bbcad2d3f7e918b649

SHA512
52db0dcdd3ac189df2490f6e8e4721e116c44514a4cc6026d5505c35c8036ecb9f5b0db2ad788aefbff68e8589b99797b5f0d932a7e6988f3569580c20d6bb8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbeca2a1ab482705c6878344cb23e365

SHA1
85b4b1a7b8fa22e4ee38a2535be45bfa2f5e4bbe

SHA256
f69357414e28288d8f081dfe3cf573b05776c99b978278a30c35a8dc4f29ff79

SHA512
357f2d2e17e3bc5ed4fdfdbdc0dabbc420bcc5a1a1f14d0d9941f34dffe9b4a47775df574a1c2de2e71a4c580f883a23de47316ffe82937b35225653830a932e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7024152efd8d595809e99872525e63d0

SHA1
d028777f6f318d079d05faf0de7428d6ab661841

SHA256
712ad299c1e39b60d6ce139f5d22daeb5144aee16f9546985ea1ccedf8d4b5be

SHA512
f884d3b336ab38b4c72920238b56433239746aa9960f58b19a5dbcb2071d1272b90b53c28047a643aedeb57c3cd076bda1459578e5caaede28425bd93f6a2b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6b097aac501c7fb8a004e3ef20b8a1e

SHA1
13aa35d66847fd36dfec25121c07671e83f1da84

SHA256
ae08479b594c5360a46f7d166d8d566cbda2a7ea5b84f4039096121fc410fd5f

SHA512
422ee0cd5ca3a79c2ed1486de7927f5bad07b62576d138b086f8648c9fd807badc58b6a3ba2d45bf40c004a984c3e90760fe0f28e53a4155f43d2131d5ad7248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
674c0310d205dfd15077fd70b8b9de53

SHA1
538daef67aa4c4340c1d0cf86c77d844897c9fec

SHA256
10f987da7ee5580092991c5f061fb339b6a2fb53b34e68ee471be57a9b615abb

SHA512
8858722a0bc6f939cc9d80c731bd7e7b1679c578a47ae8424727f3a660d779ecaa2656591fd64a465c56be8a02c9f3215d11fea734bc388d1ff71d4cb124f8d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef34b6a31a13eab97bcd23109bd67f73

SHA1
578a4d896f58baa4b9f47ac49815825b9214ba59

SHA256
8d0e40d3718b5c155afea121662c2523b072c30808efbcf36ec3c112504c6cae

SHA512
5c47a409f1a7f4f3a91157cf85793434ee039f14ad57943032a29ef4913d7b7bab8e77a958e0301000e68cf74fad7df8c562429ee0cbe3826e17d5c198bae6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa761998186c17f0c17f6f7109b7c77

SHA1
7ab821e64ec18237b5d6dcd5dab8c2b4f50695ef

SHA256
b9b68211af709937350d3baf17d1d1d30d1226ff3f7f1d058583338676260b87

SHA512
ba936a5462e56562ba71f27ee2e18456a2f03cac5bb85f42c7391c152f41a731697a223ba8489a24ef4d0331d5ba40c46ed0a925f4d1019af669b70fc3fba45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a64da24bb8fc601261b9e5dee17c68

SHA1
d9f0416d0a434d6b240d904f19fb6b2d935ad618

SHA256
4fc46a005343b4f91f05f5e1f28a0528e7833a6eac6b83460f797ec7b2c4a3d2

SHA512
9a4d5e53b23065e8c228bcff39d5a88e7f115dd8113b3a89f58d1268228e420738482a8d3eee1aeffea12bbb9d3a39366f7d48327aa5d0c5d6355be8c6fecc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6441.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A60.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit