dc30d1ed1de9b7d7a4391db5fe7a27d8597adf507205113bee8cdac60f451c91

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfdf5c6111548cc9ca72b78cbb108f2c.html
Size

14KB
MD5

bfdf5c6111548cc9ca72b78cbb108f2c
SHA1

e48f15e096302bed4bcdb089df0fb0fc9000181a
SHA256

dc30d1ed1de9b7d7a4391db5fe7a27d8597adf507205113bee8cdac60f451c91
SHA512

97d7e1dc3839c1635dcf8b1ceade15383174b12a61b9a5ca53bf1d52ae6ea7c34eb235c114e41b491fcb434f0782607d00634ea16af11afaec3ff8b8b877059a
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v/mlKt6DvE:aioWD/ZmXg8SZQSmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fa51976e73da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000c19e4c23f9ea72be6550982f17b3c9e767deb5140e6202046b3efbac271851b1000000000e8000000002000020000000d0d3127e10052df9e0cb9af05c3db05ffc380c08d10e6c55229302e338123c1420000000c4625e3e0aac39f7e06ea6e34b1c3751793a2ce69d07ee662f21856907fca215400000003cd2cfe4545d4f724170865796f1434d5ef0a0402a65bdb4bc9265f98c6c28c88ae1ba53dd3f6aa5e81ef3c2feb53f9569960a325078f227f2b991e5cb2465f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C25FBCE1-DF61-11EE-B215-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000005a88f4af2e9085f445ba4c2606302b490e3aafe3c6427ccb436453f733cf738a000000000e8000000002000020000000cf3a2c637c0e28e14814333c00f7b39b5c0f91f49f40b1b06af36c9bf7ed5c4690000000099b0985cde03d285d1714f40e29970e196d8f4427e10147b212ccb5215aca0f272c6b00ddf97695e6348dcc3d56bcc72dce3cb7df55ff69aabe8442291e9738d4b59bdf9469e03c55fd4df71b80c2e125bfb0069e84eee1ed42beb50804e93dece61e558fac0a08a88d9b842278d1d9fcfd1523a4937b87c9ba1697c2f8eb05a0e4f103c30783d071d3af1ade0f023c400000000c46e1c7a1fdb440f806555ecdbbdbf264d2261a4a2b68a5b9f87bb08df057db6257b3b7e4ce34d8ce3deddbc466ba97a8d45bb0386994da646985b5b15b3cc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416294017"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2212	2204	iexplore.exe	28
PID 2204 wrote to memory of 2212	2204	iexplore.exe	28
PID 2204 wrote to memory of 2212	2204	iexplore.exe	28
PID 2204 wrote to memory of 2212	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfdf5c6111548cc9ca72b78cbb108f2c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18bb25570ceae3a5cb7cd94e872e2140

SHA1
188cbd83b5baf960787777bda711622aa5f49f6d

SHA256
d5e2dd96871308b9010a8f9d4a2ecbc3201313d48a2f72ec60d75f7e56bc8b58

SHA512
a4c3f1eaf1a690c855d84eb066a47bbcd4c785ea9b489d3461063e71a3b8c71bb207450cb445b72fe7a8cd29f1de75b271f55972c0c1fce1e503753726502565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ad40f3862173eb1e24b26f684d909a

SHA1
34b3f95c5d6b769c9f174086a92d78fa86ad9238

SHA256
893b7b4032831d624b935e1daa6a7d6a5eea603ef5d3a3d1a2af015575718c00

SHA512
0f23f74b8c79413d5a71d449114e0235423b5ff0dd0ca4db8533d7565a3812858f4f7021acee4a86a634c6cb787ceed4da7b39a28bcf16f3e4176480c6523109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4c2f221aec6802a5129e3f9543514c

SHA1
17be1e81c2f176c4a70a08e71c5ef787f30ebc08

SHA256
28b083f2f06799f1bb97d8525e0f9641f7caf4a4533d8057a7d1f6118416db14

SHA512
17198c287234a2e7d0da5e36beecc3c3bdd2f1f6bf729a77a9f68e846afd7630bd371f6346b6522e156ad16a721902636e3ff726f1757c4deed30dc3ed8fa35b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afec0dd1d57ef9750ac6c28be799428c

SHA1
d45581df55aa735b2a7e5641a65ee71207142c69

SHA256
d86fcae01a90a0d9aba88355727e18972e908d5b413ec3b8d65ae658bec16dbd

SHA512
e009bb03ce0632f75b47d9572c3c7b59d7ce0e357b7bfd29ad1ec59e31bc168474f31414f3740685826b068d5d725a09f37405ccc9f1abc62203cf5860406e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8403c32dc15affaff299cac61c7cf743

SHA1
3c643369f64d2f8b394de2dc1f530a8040aea7f5

SHA256
f3f5f5485dc4ee501265a376080e90b274978e7dab8605eb63bba1a414ca534f

SHA512
d1d4f5f545f30c382f8b3f469aee1ed7b773e67741825dcf16ad9b93590609585a01baab9802df23b408b789a1e60f641599250ffe8a0dcd87b0e17a8f9bca96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33404f3955811b57746b9156f59228ee

SHA1
c5e2058b8679d364c530495d9187b37ef946cc3c

SHA256
5bd3fe41ad0d87cf435f3c9fdaae7fe34897e28c3a103dc9bb1328736d86670b

SHA512
f4c7cbc635d3603a1a1f5069ecf58a244a8e0daffa2bc89c698589f9979083f541c91c82d0fd63b882bcde3b29e201f7150371648bc463deb5713cb84c6de4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfcce58301443fea2405d482c8402cff

SHA1
ac90c355c129ac74e1e752884a0253528b1e9b14

SHA256
e177962b6f9e623214a4bf584c7df3ed7fc1b91624f1084e82e3d3fd70b99b21

SHA512
8668d38f545b51760b457e64fc99bd9232480d652c62d2aca5d55d775045152f2084bd0d1629c29e61f57b47027633311064e0105628d580cef21be51d237335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222fe6026b9159b2bd7a6250b157bd92

SHA1
ceca0ea6de65efb6dd64e1ad937450e25457b9b6

SHA256
96740da7e1bdaab7189207f3963eb66b55a47032b95e00b58c8f92c3735fa921

SHA512
ab5505edafddf6471e2fe15df812ecf74bd409693595e6a36b9b6c5d67b7f4d168de3acb636805620b0399444d7dc1f7fa09f047c81b36337de1ace3a8860711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
866a5a72c023c0b797552f2da0174824

SHA1
0f8b44ac8eb628114b93908bb735469261801343

SHA256
ca5faa9ec2d8c694b3dcc5248b05165a4aa1a93ab3f4cd551cf3466e4c9ff436

SHA512
64e65627b1f6fb0be448fb48fc2d2419bb2942fbc57b112c945bcd8342100e903c8fb422056a2a6f050dd536e457b6efff5b53a2ed5ba75c2bdacda5cd26162c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964b5cd061a422d345912d0938b16e6e

SHA1
41c9fe27623cf5defe6c5a38ce5c82aea10e0222

SHA256
85d8efbfc947a7d29845ac777f3103729ae9e93d30433f104559867b07c28e7a

SHA512
8ced0512bd52e91c0d8d752f7d9a18130c7ac7449e368436e4cbe11a11a764ca707e5610e7672b30c1f207a3f0221cbe0e9f2dedb9bfe7e1b620f7a06de45887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cdce34ba45c58b9ce0128e5097cff41

SHA1
71092c132fae275e4916f873bde03e9acae265a6

SHA256
660121bc9efdd8c1dac9f63eaaa29a81ec0d97a731a36c96c73c9d36cc43b51b

SHA512
9f09bfb03223b49c178a7600e869e8976c2a64d48eefdbb2a352ac2289435ac4a43640afc1f3a5167d3585e3a7fd3b104092478873a4e28c6f3739bfe8eca07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee8553297101a7d6011c982c1545b9f8

SHA1
5585faf438c5caaa83408ad8838b145db13beeec

SHA256
d058407df982d6d603bd80fd95bf26916e949760845fcfefe917fc5b27274cdb

SHA512
ac44b49c8bb5039fc3e5b9212524ae7a326312916f966d7fab57231c822cec366579c515bfd9d808782a2420afc5dbfc56197fa571d461b4ae17d8d1650ccf27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153e4c966fc2390dc2915639223bafe5

SHA1
bf64b548bed6c6e8cd0a67c3d1a7dcad6a634f17

SHA256
34e0ec50f856c82b4313d580215350ad1c3db13324ba1f44d6233cb37f670d5a

SHA512
951253f6756d3782eaa47532e47bedfc931dfa456aac804304d668ca38a19d799c913380535797ab5bacce450de4e3dea6a6746be021dc87a2f56cb3bc91db8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec068be556191ce1337773292e890caa

SHA1
4a1532ea0efea79e90829eb1fb9ed2efff2d7954

SHA256
c2fdcbee24d679d41ca37bfe9dbd6203358e3c5ac0ef3fbefd440b250f5c1cb8

SHA512
4ce0c84533250e484177f6a8bf680a62fcf657494a44fdf1d5bd64c647666fffb30f9cde3ab0bc129639c357d91dfb26ab0902025883e1a8933bda1d27025d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AFD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C2E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit