da08147ca5b634dfba2a2556b903f597386cc63f4ee932af113ab1e652b30915

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfac6fbf030301e299faea7869fd386b.html
Size

23KB
MD5

bfac6fbf030301e299faea7869fd386b
SHA1

a8279d9711438ec08383173567e0375b8751b580
SHA256

da08147ca5b634dfba2a2556b903f597386cc63f4ee932af113ab1e652b30915
SHA512

48e8ccd68cb2cbeb85f964a6694226093ef296010a28cae2754d3057551beb46b50bc4442762a65e13cb6bcf360bf098bd71883269b7919f04d7063c67d65d0d
SSDEEP

384:MnA4ywrZ6pvQrRn+ztvukeKXXTuWwehK3sP64WvKL24UTpNyOcn8tvG5nTDuU5e8:U1hZ4tWkekVls314kKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3EEA901-DF53-11EE-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003a371ab3c364efff7b30dd4dcb7d49bc569c099bdbf1bfd1b1fd06261d72c00c000000000e8000000002000020000000548917478d30b4a22bc6159b3157d0806798892b464fc676731f2a5116ac0060200000005f44f096aaf3a9ad113a88b7a275693f6047c0b9af35c015809d224f36e8952840000000afdb000bde5e0527b52d3181abc4931d4441c877bc16e6800d0e199532218714025d4e19e50daabd8df6c84338ef545bae9854955719fa6cfb3956cf4301763c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c6c68c4860c8604c21df6d88cde94d002e2874339c8b5a71a5ab4b65f3b3b5c7000000000e8000000002000020000000d586cb6e49fcb50a5aa2917c109443ddaab14356e28349ce8f76855a04ac5865900000002d1750dd3ae4d975f41ca98d8c884492fd9c16a554b518f22e6d83d88affa50d26873c3e9466ab8a673c8f157ed72ddcdc4235b24f03c04036868c4e7e0f2d5f43132fada6bcc1f82a08fc4ed83aa833e8fbd8ae222b86ad8da9c452eda020ccad2a24c683b383f54bdb8367e2073cddb5c6380db35b918a8493bdf0db080d6002230a5d9ff674c40e3c5c4256a33afa40000000adf2a265b8dcdcfb4922fb63bb94152f2e0eddd7e50bca519fa9e0cbd3a48a3381b5b02d1ab91ed32ebd6757cd824b1e35fc2fee02f600dd3c16817acae75734	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c0bec86073da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416288087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfac6fbf030301e299faea7869fd386b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb262c4ad9f1d6cc0e99d9b41a296ce

SHA1
7e3cc3a661cf5e3c4221b3813ba24f2ea56ec5c8

SHA256
76e2859a2a42d6bf286859c44ff198206bd7f0fed53c1289886dff2cd1a4f16b

SHA512
072836b6424c007acc701100d93f5c03369872f562f939eb18ed54d0042c1f32604d925d1a72d4e1215610bff3016c22af8cb6ee3861a90195dd6ba7eead5c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
732e765bb130d0081753b4d442747734

SHA1
46b16c22e4c1c38191aee59051cf2449ea0f99a1

SHA256
8c62f590b99a8f34d395720bb8d1a13270e2e7abf5f805cbcf720f55f6a74363

SHA512
a764de13f788da7528841205fb892520cd42408e4db365511af85bd1015e0864a0004e46cf725f3ed0efed65d79ad98b447a1f964d062c6653899ffd7948a9cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088a744b20f4d69b397e693ca88ebe92

SHA1
f7e920f40ad8ac69004a5181c3ab71dd51fdeb31

SHA256
0a27e84030bddd7dbfc66117c1386308ae7acfc35bd6f12b5919d7be1ee162a3

SHA512
2e5289ea11959ac0d88eb6137f50ec4f11806f5ae62baadd74eb933274f7e5cbe4cd21f6ad325ec18d313f3054e79f8e996cff5d953fb696c7f18eb1e7879fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef1a0a3e076d4881515e2ab961a61a7

SHA1
3f08ec37fdba2a09eb70e95e37c2940c52705b59

SHA256
517ed93a1dfc67e80f01d23796f3eb470fec65e00534da6138324747335f7ff8

SHA512
4c47001a38383a37513cc1e23d6cc2063e676e75ba55ee6128a32c259ee6b71cc0087ef6a182d244c59ea27ee45cf5c2bab67909c8acea37006ffed0b5aed957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf6238b28294289866fdd206b0224923

SHA1
4561d9a0be29e80dd0934cb0eb531b6250ca2296

SHA256
cb447759e45d28618cdf0549391af0c1a332c62482631e976b79983a146cbd5e

SHA512
9cf1fb38f089e9f9b2559935a6f45c708c3544b88d4aa63b917e8aa195b7366119b032fa24bcc547f74990848298ab8e9eb3b3fb6974b91aa8175e58aa588169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5719710252ecf7f8fa88d74e67e3b6c1

SHA1
28fbfa21b92935eded9cfbe308daf3ffa322562f

SHA256
32d95e8524f1667d7e4b3ee5431db5bb38f86b15fccb58496216f15b825c5ca6

SHA512
b99fc976b0941fe0562eadb068a55dbb051722ed8e6cd3da88de694485a3a5529c2af3215114c31049edae9444ef6649306ac2ca0bfdc98a65a39e32d8e41388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf52f3a2bde719207feb8651e8843bd

SHA1
41b1757af71b2c9c974f67ed50e6669a471354dd

SHA256
f2e90aa8954d9e2b9b20997040bc725ff97eb98a88e80d1e0260b333c05a165e

SHA512
747bda23e14349bc9bffb129e39db0b8ca08808ff9a3226e83c40e4e9f5adcd532dced39541dc1679fab3094e236bf8dd26f21cdd579bad680a1f8b8ed044265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64cb04a82b87361e96a2516a881c00ca

SHA1
12ce7e19a187d9ba6d170b0b9f6aa3686282c95e

SHA256
e20014cf6c20d300032530c93b24515dc4f04dfac856ef1ce9744534c65e7945

SHA512
64410143bffd12c6e6aa5d66d5b054e2b282319c28fb2575ac584a361bc2c98865205ebf4cfa47d47f7029d4bb1c79afad05a0089327f95ca8f8508c099ec380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
530f919a1db3791d22035c5813172315

SHA1
0cad2f02165552462c32582903de5aa2a850ebd2

SHA256
81c3387d1685db7deab87767284a4cdb1cacee3201ac5c3bb29a83226ce37c8e

SHA512
654e7e9b170ec3da6c8361701e73dae7e2d829e8108e72917d81c1c3d732a558d3ffd2b775b5332ef6cf7e66bfcdcea95d663a48df897d6985842bf1943d6a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5674a3c36d2c6f1c1090e21df61719a

SHA1
8f7fc2ec96fa1c1e5a08e718492a6174885af3c9

SHA256
7b26069ccc43a41a23e4406437fe239b283f8c9318029540d58494a6d14802e2

SHA512
7e46635a6339115182b290124a65cb0ac8245e5151deec4343b255134bc5aea294bbef8224704ce5ba40bbd1c6df1ba64e8caead6acfa5f1fc258d7d9df98f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
085a10ac1ed6046e7617aca458ad16e2

SHA1
427cd9ae2a1bc4b44210f5b6057c58ddb912c6ee

SHA256
7564bf856077e9cc12fde787c34bcaae550b7744beecfcd51b9280f251aeaf59

SHA512
d2f7dcbbcd1048e968a1bb07c5b8886922b88224c520965293df5697d112ba380416831927856b44c77bfa186e5d782b11455fde90f1cc4b8d16b5087fccc276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf55387f81431aaca04c6ca01c00d3bd

SHA1
8f87f61807a40ed49ab4f17a23a6768ae67d513c

SHA256
6ae348a7d045395e498aaca455f49c681dc1fcbb44bb92784f163a95871c1fa8

SHA512
660b051c55b3693d86d4f75ab48100eb41ee29069511532a5c3a054dd9a23f9c8af28d0fd31984ecaa76ead04666043a81f5c02ecf18140ee986c676fd5c0855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6e7f194e94a3dbdbe11ec7680cae92

SHA1
112bf43e7373c088ef06828b07579f2be09cecdf

SHA256
75e8d85672850f296a459b3c3c982e2db950b1689fa371f21ce3571bbd7db888

SHA512
566938b08c5b0438caf7e1cda6bbeeecea7e49ec5ea451515dbb557706526814aa04262106d2ee6c79103b36efdcac80d9db4704389bdffe9e9f6334229c95fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ece703c8bb27c14f46f8c53ce27fb04

SHA1
dcf820f91cdef4519b04ce2116abfdf78c3c22db

SHA256
ffc847de08d3abfeb78cbf5d86986fb12d02930aad9b86abe0fdf9727cd8dbcb

SHA512
aef816e21423317f0cfa768ce5de114c101cbca2fc17bc84d9028d0df1f6aafec2b498b45e1b57648cca45e942eaa0eed98a4ae325329b6001b24203e46344e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36AD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37FC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit