20148a9814d9d17d20d2738bb6e651379d2968ca061b01c7fb87e4ab5f664ba6

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf98d58811e8c6587218529dd1cd6eb9.html
Size

3KB
MD5

bf98d58811e8c6587218529dd1cd6eb9
SHA1

f0dde35848bb1dc768dbbf22c04a3f8b6d6f6afa
SHA256

20148a9814d9d17d20d2738bb6e651379d2968ca061b01c7fb87e4ab5f664ba6
SHA512

0031bbd8674fe0aaf98b86b0fa43263ec3ea809e3bf89a83b9221d2bb672057df95d39bfa713351e29509fa325a43ef5a6ffde7318ef53a971d2c04a1a2924d2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3C5FA01-DF4E-11EE-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e936b845a0b8e9b837328b8b0e85779d9ec0b1098618a030326cafcf46e09d0f000000000e8000000002000020000000201082260e241940ca9e449e3c3e2a6f0d45874c75bd7407f03e5f6359ac0896200000002461a6529c33623100ada6e2568b81446a85c88946b9519d69755bc09f42e5c9400000001db53d3c652b8512233bcd7dabef2cc3fedfedba0fe3b2bc8053b263d8e7d4edfbd4e388c0c96e9338e14a596efbe65de1ddbf6f98af2fe310e1eb926c0befe6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416285813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003370740e1a9c0c2c438404d20a92c195d5238fc49c655bb72508d0a8167f4a8a000000000e80000000020000200000003f50cc16e8798102e5f00a5adc4d384e2d25ba7069a404cebd412bb9d837cb9f90000000cb037d058d7b52e8a54d2715a9b8b9ff9cee7c5e457494d4300cd0193f7c675ea8c7a42955bbd785dcfa6d3fc6420bfdf4d26c40fb711ba7f4bea26fc8983b10abec5f4d624fefc49784fe13729182baad2bb0557aa56f6a7d1204f862b60b706fc0828ab42809b1d7c8cc1fc1c084f4e523e105e9d71d1e705abd6beb6f09f9d0e6696d6dc2b1b0189e6e4770fc246e40000000a813eb1c8b4bdfb284d15ef98c632803b14dfd19c58480ab852586aa6371874472c3dcfdc5807963e89b50f22d565146de138f0f506ba39bb54afde9fce82398	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7012487b5b73da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf98d58811e8c6587218529dd1cd6eb9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c21a6c825f14f697e138fd799f88164

SHA1
22acaf3ec7b63b330a1e5763d7cabfc3d3acaa07

SHA256
0b3891d05c0859892840f410c3e55f858a73a937dfa5619d5e4657fa3de57681

SHA512
2f8f554e5b33fafcf968ad8fa05977ab01f52d46d9bb838d8d3335b82e471e1dc9bea7c18974fc28da9d471151cead52dc02dc4b4a3efee3577ae964c0044492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e56bc25a21a06efb0e91b2713856036

SHA1
d06eef11a78de289fa0aee28a9200fb0db1ec4db

SHA256
b9d811e4da1a53e35d31251407be8a8512c014abe6a69f36fe187a84f9134946

SHA512
9d00b7abe7ca56bff3beaec3662087294a76bdd9f4be52c275cde39c83efa9a8b796afa19104714ae52dcd77e44042a768796f993a5708748a307bab46cb8e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96fe869af082ed46e88ae9a3dff9a8f9

SHA1
5bf0bdca394f4e6bd6d06c8c54dbd693d79cc7f1

SHA256
67a868308c6c34fadcb39ae370cd02d18856b3dce049a52d65404cbd2687dea4

SHA512
a8b5862ee0e782f448647c1f65fd3300214445d629345bf7a91b1ee3951c3f4fbdf1dadeaa246e87ab7c22fad3e98fa1ac39cb9bf2f8090d054e26c70e9a9072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad230859397958f3d04a269f3b5b289

SHA1
27f6dadfed61b56a8fe3bae24ca48af794670888

SHA256
4f756961d47646b4fac6bdb256ed4b5b59aef470bebbd868655f642d2fc1b8e9

SHA512
ede6e463bb14773a2dd182333fff82f6d6e1776f179a85de55a50bb0d5825e15bc9aacf47a0dd07cfb41367eece341c62c356c01186897d699c434a8366fd85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a72e0201cfc35e3dd8873ba7a8098b

SHA1
234c766cdf16761adcdda53538fdf995572cf225

SHA256
a558fc5e744b332c02b8da2560d1ee6d7bc5a4d0f378f0b8630ca8a606daaaa6

SHA512
9e5db66b55ecfd07cc9a4e332af7a4e3b84219977e7be724a39ce5775ceec0675f4b70617e5f114969d7d4661247ff3fc7393fd20e445e4b1d62087143420658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73eba3ead6726e10c491f85204779c63

SHA1
e210177bd47fb9565cdce2681c518c856c034cba

SHA256
b943ea97d6ef8fd53e792ff012ee88f893b95c8da2e231f075942fddbae08e73

SHA512
55189fd4abed9b18641111982a34f8ef7f89cd5f586adb7052492eb372fc920c4dd7b53999fad6f710780bd2402064757a633a909adefe2612c7a3f8a925f4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460faad97fa60516e26e6393562a92a3

SHA1
fc9d8ad0db303d3cede4a4a3e034b325d5b7089e

SHA256
843bf9052848f4bd1b70e68dfd95b590f512f4cec72169d37606b276a392d99a

SHA512
68c20df7c798c2d4e411fc3ed3d02cd7b705f2351994815e55922b7f1091d7a35f1855b2a125fad551e61ba00c96689d167dacf8421f8b46813f762cb98e85d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50482fa0e5375c833ab4099a604524a

SHA1
21e252f7d40c3c687537df09247db882781ec377

SHA256
3061a731ba840ca4a3eed079e581de7aafb7a4436c774fd09612dbd9ad6d1574

SHA512
a289f2a1f35f0e1b176adb58c7f33f3164c74dae99f877bd39f46b3da2f6e93991efea802a212cc36f8e475b9f6323cc7ac6f78fa25164cc20846293fcb679a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d64032a747da4b493b5c1b5274c341

SHA1
5063fffbd06923ac8ff5b9f4867cfa13fbfc3967

SHA256
6ee00a5de9d4c6097f932cbae6d974d14d39e08efdf03f182f249bf56a2539ff

SHA512
b13fab57673b774dbf506405aa478c433234596d95aed070bf0a580ad98201357793f7ef6b3e6da5f6c6a60911a77264e1789cfcfda665a59a93d0aca719d991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdd81d7d26d2535f4f47e848286fc06e

SHA1
f2e90ba411824479ec817791cb13c0bf8baaef38

SHA256
f54b7b2aab22b97b2a11223df4ffbc0966c1f2535dc5ba3cd16e2469f2b82d77

SHA512
6357403c597016199f23013edbdbefd82becb4e8238ab34ce5b5473bdf6c8ef36ca6326ab99c8335d389e7159a32078dcc7109d83b7b4fb884ff15cc66ec86c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2432567b779ad1bad1f2e2baadb15dd0

SHA1
3ee6c97d7fe1b6d414f2e136089be4a010ed8633

SHA256
d04ef1a1cf7ce90f448eb78047b0d4fa9be9830532412d36b58e2a30da509813

SHA512
cfa29a3de589bf16fc98012a40a569021f2a65bc36c8586f9f601d09f54c1284bcc4edd54e37e04cf62be1cbf84097265199d7a62510cee07470f88a12b8296a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f44c1c69e1b4b4e6c3ed8a3654c00978

SHA1
2e6b5fef248a9e41c790a1a21b4cbfe822064c57

SHA256
a82c65daf5927b6b296eb1f6243d54c7ec6e0140bf669f8c292474e47611de9b

SHA512
0dd532f225ebe8232f95a4e08921b8939b4ba96662d97c3a723f122f1fd73ef16802d94021605e74611da80fb6ef2f72b47370f808e2d5e6082db4a3e0517d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e83bff8a475c618b2085440a0097ff

SHA1
c3640e86e06417659f39e1da8819f8323493e209

SHA256
798c48657b2f1989bd07dfc76f99af56596077bebc00318eb0bbdb30d62d08cb

SHA512
a5d2a0fd90613052d1afae44451605b7c8e493b769870a9c629dea06de650c21480c3a0e7e9bb6042466d461edcc8087fdbe377c4129df8d36f4d3dc4a08f164

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3709.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar370C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar383A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit