b5cff751f5549d9720ac7496764dca96f4d857c5dbd429e819dab05189429815

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfc9466dc69de31781f22426711e72b9.html
Size

78KB
MD5

bfc9466dc69de31781f22426711e72b9
SHA1

afc8d4033250572ff7cf10a9050ae30945599663
SHA256

b5cff751f5549d9720ac7496764dca96f4d857c5dbd429e819dab05189429815
SHA512

37a2020709dc4029eb42d00c466423ad186c3f4e9098c3dad55d8cae37f65abe0da4987d208c1b6d6817f5e0dfafb3adae7fadff7d96d1442fc500b15cbee776
SSDEEP

384:SI2tQH36qwosaIH29GGY0QFs2roRhP80NKphx0HMFXUtwSz4WN+l2CQQ6eMAa278:ShXH24Xjc/GpP0wktH9jHQFa27XT4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000dfc2555109479f087c70cf08b29668a757ec1820b21a68c5a2f7f4b8ff28a6b8000000000e8000000002000020000000df2ce30ed370c42ad9d4c429e76b78927fcca691b9083f0e646c45e80769288f90000000c9cf5196e8670e9b7262e256ee59a26bc1d38734838b4b74656132b958205ebebc05dc73790be29ae520aa56f65c38d9ae65ff93f04903c9d34c4e679be70aa5ddc92d7f378da87ada2a34a7b4d66117d266a1d7adcb91599b57cbd7bc03a28b90e043883ba040bb2d60acfe9607bac3c204648c7b66a519f410cddf293f651ae7413ed1ea6ff2b94435950701c7d88a40000000da14fca0ed3a0139ec233d5236314b3a34d2fd3c5eab4eb2f8b522b18d2e771cbd7d9315bc345c1dbe9bc912407410ad23936cc9c925a4231890a8dd31c66e89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd0000000002000000000010660000000100002000000008e079dc68e14c1148fe4e778c361a6fd7ff117ddd1f4d55cdc8f11dacbedd6a000000000e8000000002000020000000f2902da1d7189dee595fc6b73d24bcf1cb4645d6ea472821a25afda77e6de1682000000052be88f653b35a5da564671f1d80ff38008c8844937a38dfab23ffe9620673b540000000aa7ed23461b88e2150142d9753289ac30ef767e5f524417d445a84377a4cd3076537d7a8ebf384b74685b79d033210d61d79e66f8f103f0ccf14d833c77c1f83	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cf7d816873da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416291373"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B006381-DF5B-11EE-BC8A-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1208	iexplore.exe
1208	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2056	1208	iexplore.exe	28
PID 1208 wrote to memory of 2056	1208	iexplore.exe	28
PID 1208 wrote to memory of 2056	1208	iexplore.exe	28
PID 1208 wrote to memory of 2056	1208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfc9466dc69de31781f22426711e72b9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a28438f02087e29cdad459fe08d0a08b

SHA1
298e405c4fa7aaf6a58f1f3aba4afe2fdcba1e16

SHA256
9760d835927879cdb9ae70ca373cb438614ae356180aa01fb00c86f8f53f8b49

SHA512
6e5a1b20ea939cda501d2a9135f5c3d1d1cb44bf58791f1a76efaf8fdfb872d30f59c0a4fe594bca228ef796d625a55a83baec125b81a448e06be346d18cd274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e84c563a7be3af89ce3ed6e9c837887

SHA1
d2dfe482b1b7f683dbaaf7881c771c78a57c13c9

SHA256
82bc74004745cf1fbaa97588c88c5041bda2ce31ec1c3c1d5bc88c560b9918cb

SHA512
628dccb992dfba12bd95effe705480259e845e2462f5470ebcacd034c4a67a989bc8cd936c1f8858d3ec5592bf7ca79c248646662ef1e7fcd22b6df5ee106efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aee3671b69c616c13a5b34399ddbcc16

SHA1
e99418970de40149829a70054002ff4629df0630

SHA256
a1084b51326ec333dcde8259ac92da2ac7e356261c79852d6c6724eaf56df7a3

SHA512
8b49c71814247605731ed0f9a167bf233bc4daca5ef8ca9031be23ff504e08b632611a44542220d4958d815ea2cc10270857690a5d8e0473967c8aa8f028e1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b93ff9fe08eab927ae04640293c04f

SHA1
970c371b9a7852e94e179ab68727598d58a9f26f

SHA256
af0dc794e39de328dc4fca1a34b0f46cff02e6c9dfcad8dfdedee213efab3a4f

SHA512
bb711f7c4dc28e9f56ecf6bdf1f9d82614c763287d56a7320f559eba2638af0fb28221726921378b9bc496f07738817840e6f8d339965749867d079f43ec5384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08d770e4559db9b98d722a4df42349f

SHA1
e9d3ff3a5ffac0b5a652b6a5c524d86839a6de5d

SHA256
311d852444bbf113b62343aebf7dd50b459874b45b02d4224bb8e5eef1378ba6

SHA512
b424b72a6b8aa80eeba28ffcdcfeba1c505dcf02c79abb45650e8ade3d9ea0502e20d3d595e200e849d0b0b01c27be12116d5c79e01f6fce2f8b44a2c92406e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c21b95a3d347ac5d4036db2d5b46eeda

SHA1
640487dfac27028f52c050b38397d791baac907a

SHA256
0f6c0390cd35ef89c1321084c2c953f27717498ca897e2f7ce3b19f0c4c84d55

SHA512
115142838d3766bf1049bf2cb14fdadd99f394e879b8ffd2634c3979cdccfe91d07a66eecefa59d7ff541cd2ffb9af35c5491ca29b2dfa131b2e6e74e602ebb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a24992e6775deee5b82d07fdb7b6eeca

SHA1
844e91bb2d2c6031a7750d720e093c4a728887cf

SHA256
64e798d4eef782d3b81c5f4e2e6d77a8009e28fe74a31d77f5458d02ac378308

SHA512
a66916d07c9927c8ea00460e696bb8207b17fd97fd0a39422d9b37751a472371f94b02386654e3c26e37140e9aa3079afa314d286b6941e637a3bb93b7688c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea2ff8b7de088ba3a9ecb854397bbab

SHA1
b353a6ad9f69c29bba8a251e83ff4dfd4d7e9862

SHA256
6a997ba6ba060f42fc4775d1b98e6fe260f222c138dd1c36036b187344549548

SHA512
71f03af8322f82f8be2f5773b5f825f53954991241a37533ecd867765ffb36ffbbbe299799a333b66cfc1472d381bca7bac29dfb3010a6b3c0fb73b8a83ce76d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c18e60c024ca5fc363fa6b6502931ac

SHA1
3f691696416c2d5b1624cf74feb48d8026eef2ec

SHA256
6b2b185433b16c7f36626eef35aadf149434240844b3e4cf4d37042bed7beaca

SHA512
9e2fce6d6f4f69bece3e7d14f2619a91f04f2566723505e3334fcdd8da0631f462a2d2b982da24b5dfa620f71e56681dd3c37ebd84f82709817280b6142f6144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ca9a9ad057285d843f755286de4fcc6

SHA1
b029c31896d1dcbc6eee4287b4d029e043626ced

SHA256
27a49dd6e57cd40512b2830f7b7e03eb5caf8bd4cbbbbe449aae06e5a002c463

SHA512
48ec7184736c535f3826dfcb18a38e835ea76308e1e1003544e6563aad088e6cec5c350f1c918e1ab3bc68d592faed67f37ab4537956e2506839c1ffb7b4e660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaeebe598920c02c5bba2238f05e4196

SHA1
366b80fc1c8f9e99fdf493526d4fed9a10801bbc

SHA256
234f945efbc161dbba9891a70a4784f17512823bb57a06afd5e0fd3a8a364cd9

SHA512
8ce75189578f630fcdb48e03fca2f74534966f1cd8371efa00794ab101a902fb67ce16a20d93a7829b79d2cf84d602f3bb6b1b3398a0b253a5ecce20373f9abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d02f0167c2c88f0de6996caa97d9a9

SHA1
b59afba2fadfc60c8698599b93c9952a6ba3bfdc

SHA256
535219d7738c94f3a1d5b417978a6d5c101839fbfe92e12c83e4daed5ed59e06

SHA512
3ad9dd48c85accd3f35a1db004dd8b77fd3ac2451b96cc5d190056572781f2a4a9153cabc831b44cc6a9226e6a49c2d268f28ab59312bb281c74da5d13034610

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC94.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE30.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit