86ec8a7f61667fb4df5bed9012bde7b161692384f605d5e97d8c6eec79efbc94

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

en-us.html
Size

5KB
MD5

10c480c3a146f977ea791a9712fa3c0d
SHA1

12f3a8b3aec7d72420b159edeedfe776e9ed9af7
SHA256

86ec8a7f61667fb4df5bed9012bde7b161692384f605d5e97d8c6eec79efbc94
SHA512

918b3cbdd83cfb1ad40146af9881ea0804a0dc842eccbcb4b76f182516c47817a7a9e456c6937a0e48fd0c24385f961ffae90a01fb0699c3a25b484eec5e2c07
SSDEEP

96:laRg5tgh7hIcghshB9fgT8fc4FxHFjpISFwxRc4jvL/lCClo:laKYBMmlP041j27RcEJZlo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002b7cd0ffe2fa2371cc5524c64364b3d4c00ead669c06feefcf69d26d87c8ad30000000000e8000000002000020000000709ab88f411e253aedc24806bb87cee738a87f64ddc26f146d038a9f77af101490000000618c8ea5ed109a68390a2bcdf039a25112eb440fbf68a6f2356a2263355040e966c2511924cd77fd14a7d5667a53f1167f9714f96301b3fa118a2eddfb982417932875b5710722df7766dcf14f8ac3357c6c4850ed096d202f2269fa13defb2dc8ea6e97ecf237fa9fc0adcef69637f1767e0508aa7ed3a0a168029ee0451f1a376a271c60cf2ce48bf721121ea0252740000000b98c01316638cb1ec0a0ff547c4a9a5a7b3171d2033244edd7885d1fb925af139a565ff1d0d2b22f59ae10a09359ecc5ccf8dd80861008315ff06097e5e7db0f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F99F4001-DF4C-11EE-BC3A-56D57A935C49} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406993dd5973da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416285088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000093e5c4d5f7aa8119c850f3aae3a8b276defdd73acc1798411a026ee26ab4991c000000000e8000000002000020000000382f5e867acab60ea78f16a9b24d2983da3909f5e2a51d3117ac90637e527ed420000000719aab9a0c36923bd92d65bdd466c13e83b491c9c5cd745455bf38d0cd7a11e3400000008820f1376cd4cb16955be7e974f6f7f40f03711356d4e18cba4cb1ed3145c68484ce312f6488716ec16399f55ba18ba89e116312b9adb6958fddabe02a47698e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2932	2176	iexplore.exe	28
PID 2176 wrote to memory of 2932	2176	iexplore.exe	28
PID 2176 wrote to memory of 2932	2176	iexplore.exe	28
PID 2176 wrote to memory of 2932	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\en-us.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0e6cc3929795947a6dab5ad46286aabf

SHA1
847c01a25cf88dd97146039906062f589c97e03b

SHA256
e7af20c77d4dccc14c759f331b127541532cc6fc8e83967896ae38418ecddac2

SHA512
f771396deaf86ee2d9f9b479d302be0d460e0fa4216104c8d85996cb07124321e633c01f9013aa33b83f332ab834a5991be5bb8f1f9ebefd92e9c975d694d820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
45b7036dea114ca18b7e475eb799b2ea

SHA1
644bbb4727e63a475ad1458704184e856b3ef366

SHA256
ec84c15a94d9a725908139c0086a1f0687ce689886155ea26627f98736e80619

SHA512
1b5999096938cfefbd3a34eebe0f99bb245fc69146b399c4f2076c8f2a3fe9cb551ab2b41292fa54caf7e9bbce951115ee22848b29c038bb46a55be505ff63fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7676bb959a6c801402cfa777f8495e1b

SHA1
23c1fb4eb0970ea9982268d656cd9bbc6fcf85cc

SHA256
0407ab43c0a5c0e4cd9fcb2f8c6a12a6a226e80d65fadb3e74154152f0d6492a

SHA512
02d11cb1bfcfdf09187186d088e53b8110d95446197d707dfa8eba18551dd70d484d13c43ae14af5e1f9d92d98740dd6afe46dd88989f85155ad362106def842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3df8fbe0fa2a77d06705a1c361e4032

SHA1
86da08c2c9108a8f9af0e6697f114281e2563484

SHA256
888d0286516f10976af7904e21017978ecac00f2ec3a1921cf61b10d5aeec4fd

SHA512
be995a9616d9a68c1f9eab7384c0e06b5cc06d862b4dbcdf78961e171cee38a66626c53cedfebeb5c42f2b62adc444d0950b2cbac3107620d50b0c309a88e415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9a643e58bde7515754f304e99ff6ab74

SHA1
bfe7ca3033226e41ff6686590f4e651896f08e91

SHA256
f81bc87fee7eccd78fd6654714ae3669937a2b71643fe50c462f7fb70a12a7d4

SHA512
cc1ef85e53f031d768f5b0c9d0025a117c5e9bfbe12efd7b556ec436dcf26a97e8dddfefe74054ccbcec831e33685d2930b6a85b24dbd77e975ad1c9a0d71c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a54cae62d7b3161d462762e53481c2a

SHA1
2aaa4cc9695ef2b3633cc1d8207101a1e22069ab

SHA256
778984f41a370650ca936a4d77721ad20b0f0670a4704473fae7cd5b02c5b8c4

SHA512
fa73224cfcd8959ac8d4dc6ce2f2fa5ba45586049706aa55a987fca78b4703de413f6caa7afbdee4065cbbd8a85ee7873c3af1b8e71d775430095b8b6a81896a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ba627ae042939949dc5c751c59d63e6f

SHA1
e95bdef8625469d3dbbbce2decf48f43cd45f24b

SHA256
42cb41808b19bf22b067ca37bf39acb29dc6db27c4fe3ecad9636e90b0a18080

SHA512
ae63a2ad64a773395cfc745b2073ecfb5e9304645b31a67d8b2997b0bf8fc49cc8aeacf3a09562974fa02bf875e8e05f73e08e74b5a135d590a9eeb32003e708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
61730e33da7aab690a5053ae46b587e3

SHA1
2ead1e841468546cc044a298e4cd1ead0f9dd5b9

SHA256
cb852bbb5b37aca8bd50b35807551143d59d6ca583dcd6d7f884561ad0a4560f

SHA512
f7e0a05c1324e1919eb8669ad0186c4d220ab285f88633f9dc8211050c01afdc568031a3a7492294f884447c2c1671cbb01b4c6475ee3cb0e2a95c2ef878189c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
55d01e5da899bbb7238b3252abb40bfd

SHA1
2d1eaae15d6f784c789959a851528010d623cb50

SHA256
99464861478b91867a8eeb1a84322e8d9fac84e2d8c89f8bee49d25cab55e236

SHA512
bfc90d121bd8427648bdaf0cfe70da2ba663ee769e59408f1d97830b3a0d7d8afdee3e411bffe2a19d857a898c61732c35dae240bd430a74042e404ea547f336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2984b994905d1100420a6542e5fd9da8

SHA1
0c233683abaaa6e7e2f86ea89eba3796b441cf6a

SHA256
1f7bf219303f53bac587976c5d78a3b5542692c30973d92b9ed7a28d698fe1f9

SHA512
4ef5e4c8be075dbb63a84fef7ed69cda719c60c3b89fc97389bd3484153c7878fb7387e3c59a680e1075d5735b829e87e2db04e75be792de0e575424f2131ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6771ce136f5cfabab195569912b21ab2

SHA1
2632cc2aab7e8880dc578fd7dd05f393ac5aa7dd

SHA256
44bd519e6d505164d4aa8a67d68c8f4726b67b46065e35b6ffec6db3ab004aff

SHA512
880d36358077c5e6f8ad19e73300d820a979f26ea5a5d57b67d6281b2e865911aa4b0ab498b1845b050e13db5b6efbf6f85483eb4b21c23a14a1f0e84418bf96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
08ebe530327eb7be4ee30962e60cecd4

SHA1
4436c0ddb1e1f5b88987069354a409348ba2f065

SHA256
31a7d45658c70d00b9577d24d944f7c955dc9890c860f7394acac9d599bb90be

SHA512
2344ebe668523f879372b5a188e2deb3bc618de4f7ef34e8db2f61ac46e683677ed6a684235590ffdd6f7d6aedfcbefacf2d0b38ea99b9f6316feeb2e75c5a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
40e6fa98fdc9529fbc37de885f5e33ed

SHA1
f244acaa6d0e8876a4449369dac3bf669d8c2664

SHA256
84c607d212e07ddba38352fc5cb5516fdb9400a76809320d13f259044a168a2f

SHA512
dce83064a3f481d00a82cc138d63f952063209dfbdccb0d7c430e38750f61bdb8e09485108935519025c90af749567c6e000446766bfe06dc03f975cb9364621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6b13b7ed5f45cd32e54cf5a9354a76e

SHA1
072f9c9559430cb87b3e28ab0dc0ccc2947dd6dc

SHA256
e07772199569ec9cdd7abcb627809584762e98ec97e7ffebf0117b47e1eeda95

SHA512
64e22247dc5014b616510f4baa832b8bf95b7e76511ded0e366f5d4da44456160c1b737989b12f60d364ab1e60532287cf9fecebecce038291d50a620a3e58a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c8c54082c1964934904d9f75d26dabb6

SHA1
695b2f4924d483201ba52c56bb034ffca5a76000

SHA256
49d976f857359d565a8a786ddc97e8266b2939494a3f01798323d6613143327e

SHA512
e6a4719f6ac230b26132d276fd6f49f1b0b8289ecab6ca99a94b097d0dd15693442531dfadd98b0c17c9eccabc063295a677b22b518c023d51990aa40c636b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C5A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D9A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit