9079f8d98dac528afac0472a5d77d12fb007cc91ae978ba51949b141cb6b5d93

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfb0904f18e9a0d21cdc11418f363c1a.html
Size

25KB
MD5

bfb0904f18e9a0d21cdc11418f363c1a
SHA1

061eafaf4c9242c12d6f925ee12b08e0d503b198
SHA256

9079f8d98dac528afac0472a5d77d12fb007cc91ae978ba51949b141cb6b5d93
SHA512

8322dbd3c933c6ffb5045c6e3a9dc74223581e60b7f92ab96132d416e1af6f7c073a948f9022891d470c4ae4ed71900de18b193ee15500224d4ef1c141ee9cea
SSDEEP

384:lmnA4ywUOpCt5FztvukeKXXTuHwP0aagMLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:c1GhtWkekccfu1k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d65ef06173da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B9E7601-DF55-11EE-B1D1-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c224e38b4a0ddee6c58f57067619c452680519fa2ec9f173197b66e89bd4477a000000000e80000000020000200000007fa5d0528b4079ba54a593e9a0396aa63c0acb4aafec8726a60af6a235861fca9000000098d6efdc446867232a7b0bc7b3c299287c9eff15e915087a81f97a6d445dad3e649d4e4a35bbac63003daf962e7678c558a97f136b68bf4f28047ec60770fc2a17529730c1ecbc8efa4850f763e28ecd7b40b520947e362604a46c1eacf99c48fc05dc77df8586cf91975d1bd1a574d355faa3a10e0f292df90d0f3d40a0e40852b843cb3e3330c42ca3a02c239bf73d4000000052577db6be059a36e3ac71a7854659b74fc44dc32fdb260c7440a5d4b4f8d88d2235b6fc0243a7217216c312d28797d32ac5da7dd0f45cd2b7faa9f01233a55e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416288581"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003f18d9b3fa727cc64c17b36a19b25ea417717f2e3632b1071d5829533e66e473000000000e8000000002000020000000c88fbbab2a06a56c2f3560818d1b4bcbfe0373ad1b8c204ec1ad0536f96d715b20000000e84453e0ee664438f3a7daf5859771fe544d7a5d64cd98ddf67043788549a50f40000000fca7b39831e05f38f7e7a4299b96c84e196115dffe41a0bb957a1dd66b1ea8688c8f883aa5d2b0d006da3fb6d134333e9c3ac530f8a7f45492ee35ccfd0a76f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
756	iexplore.exe
756	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2620	756	iexplore.exe	28
PID 756 wrote to memory of 2620	756	iexplore.exe	28
PID 756 wrote to memory of 2620	756	iexplore.exe	28
PID 756 wrote to memory of 2620	756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfb0904f18e9a0d21cdc11418f363c1a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d280095c44a966a58766a375daadd68d

SHA1
ca4ce92b1edd212a35b7e348f666fcf79fb08751

SHA256
03e49c1320ffd85bf9cf9535348afa634df4ea13e09371a22efc790864509c7e

SHA512
0f08a28fad178d1cf7bae9dc54a60ab419d987f98453aa0cc69e95fb119ef405d13e9c267b118cafac5e26ced7e8fe8ff4ba329bee1ea58e8a4ff417630d5304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c3be7bed86a433201113b67d523c7fd

SHA1
07c03fca1ce6b8ab81b7a64d2a4cedcdb30bfd3f

SHA256
93381f0cdc5c049276047289da86cfae47fe21ab655340ca68a8417bd2e580c1

SHA512
7591fe3d9763c96aa87767d0e2ecab3f6fb06ed559a89c29039ab9fa5e91d4097c4228cda48e6ad4deaa23d0bb9e682c1aaef5ec7a7207baa35fe3dcf087e9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1d78578fddc13e9ffb56e7ef407edc

SHA1
ea9fa091a84bc80ea8db9e1fb06179807f3715b7

SHA256
feb57d8afde667bd8bca8e49871762b626bd7ae40b06036688a38e3c8ae3884e

SHA512
600fe77018c88059799f7b443f239566ace6c53c283db6e227d0ffabe9755a61cb772812be346adff17ef127c665a1bc3bcf48405065175edb187302ed3dfcff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e48dd4bad26dcd425020b3d5c87f736

SHA1
2a47a086f8b431da0d76ed0de90e13218dab2dbc

SHA256
53bdfd133d1ed16de0432f151c70029949064096c2ed45bae9cd2cd21787ffb6

SHA512
2c43d8eec94b03df30ec15b589b349f62892f92ed7d66f25c23e8c21e2e6fb65e68968d7b43277e1e32de98e182d1d5faf60e0f6dab30ab29067a6f6f702d14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f88b5c6250d64fb2e7f56b6893703b3

SHA1
029a96909f20947a791cd4dcd01a5ef0493f69f6

SHA256
7366f168a3fc0e5565f4d22afa97558af1fa31c124dc74306759ccf57d92ca25

SHA512
4c320b37929cea7e5fdad4a09619978ba6c1c4f81174777eabdc863f2942bf352adc1a61bb0628339df2044445073864607be02f4cb1100c21459ed1c8a95571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40434c31afa268ba09e7940b017dfcef

SHA1
c1cd8ae9efd52176189144302e55a4c0f74c7dc2

SHA256
89bc118598b5460ecd7a911d7d16440c73675d61b9e7ab017c1e7f1e217459db

SHA512
469614c2780322ef3cd4abb353a178ae45ef46136946a676b280d7ce7a740e773ac82997a0d4865ae3a42766086c978cb3b297e2441bfb0188be810ccc23f009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5a8de1a3c94acdae49fe3cabbb0f27f

SHA1
412b321e5c04feb632eb763d65bcb197d486504f

SHA256
91cebbe76e7d7a7532786a9e4a1155fbab198dfbb230f1cef0e109db6f76f2c7

SHA512
643ceb2f59079ef04fe8c3951644c6abac37d06ff8895bbe91a3a2eb9a3a450b00219f6ccc8410c19ec952fb20332a6edaf428d0b9c4c37e9801b73ac7ea0e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2e7bc584c8637052e5a2db1d1a909d

SHA1
2171ccfd70113043568d75d8e74b2cb0b947c515

SHA256
2f516619443f328de606f20b2573ea977a20deacdf42d8a9c21c09e5063f20d3

SHA512
c30bc00625d605bf83b3a67aaa1ade2e01dd54bf7e13f2a1b0525f6fcf9036b43cda3433ed2101e8ce7cd0bc3288726eecace012cb6acd6ab4b93eeaa54bdbfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab371A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar447A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit