54ce9a665e8d359e425c7a72951c3188d79b828e7a858671c489d5a2bde6fe94

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0652860900d0b8ed153e66ba344e7d5.html
Size

60KB
MD5

c0652860900d0b8ed153e66ba344e7d5
SHA1

5f88be6d51e27eb9ccb2e6f4822c4790d11a5c1a
SHA256

54ce9a665e8d359e425c7a72951c3188d79b828e7a858671c489d5a2bde6fe94
SHA512

ec84ddd2c33ad665a08bd617d25b6c2ca3e04532933abc805ba6c00d7a4b83f14ee74d64bfe63dbd72472a7b3b01d433d84896c0072b1fade88dc8b5a194ac38
SSDEEP

1536:yP02gJZSjaHyfkve8BA7zK6U74E4cC2tNalNaiVyzBe3AYuc52D2Re:yM2gJx4otC2tNalNaiVyzBe3AYucoDce

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416315733"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00dd52ca173da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{523ED761-DF94-11EE-AB14-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d5d490a5848964635ceed93f1139d996568b39562192bd6b3a4baf0b53670848000000000e80000000020000200000002d89109467ed5cac4c45496c467d7d7f053f603b0d6401838666cb02993010ba9000000000fe04253a65220e17f18c72b204944480fe4b0493aa80842d1b214a3878aea3607e6e50698e44dab68f359ccffb853032b39c224cf675ed23738aebe6ce968de9035fc0e57b3b37dc412483d7496a356a66a4737973260ad5e892b672587f249dcd0376f4b66824267a0f3ab3fdb8f8da357044083cfc01390eb2811bc9471c39c9fbd26d40bb7c12b6be7bea30625c400000006715322ffc9f5c093b5d75f0b3fe5dc1c3ac3d8b49f3dde63232b8a10680fc666825ce4b3fffd42a7c1829e6e97b6f17b6d47bd5aceb54bb21bacfc73b682dd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005d106eab7e2eb1312ef0848f4c85a59ee310bbd3894e737131b7b87cfb74603e000000000e8000000002000020000000afa288e25cd9e1c5a83c2158cc7ed0070d321a8bf79788a9c6edb78a563f86062000000022b5542315c93cc92852ba6310a74b5cfc32befe7bf75ce681b121750ff532a2400000008f77bbea68adddcc692857a074df5f9844812935f49a5df445f2ea0c9c7c5ab07fc29e643c348e9811103b7d88c79f640886af3700aca152c73958b9fae03192	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1256	2988	iexplore.exe	28
PID 2988 wrote to memory of 1256	2988	iexplore.exe	28
PID 2988 wrote to memory of 1256	2988	iexplore.exe	28
PID 2988 wrote to memory of 1256	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0652860900d0b8ed153e66ba344e7d5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
894e7aefbaee349dce6e9338952cfd5a

SHA1
bde7382775a58d52500690eb787c595dc93c2571

SHA256
ff815a815416aa5102f3c60611a250cfb01e7b70074e7eb8936da1f8173ba206

SHA512
031dbc977f2e7cbad425e990acd501e33845a8aa0afe0053602df604a09316fdcf8b61227fb5b14bae57e4b1c490228a764d933286d8d4716a76b3e3f7ec56b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
978B

MD5
f673bb24776fa92c66fb2240e87cdadc

SHA1
691a68eed7f8c906cf544d50718528ba5692e3c9

SHA256
2a03ddae1a42ec425421269bebbb0696da38478bb57e4e6da78dd50e356bb120

SHA512
80e0226042d4ee280ce0241b15ff9af4e5e935397579890ce9891518dee0a04925b8ebc639251dd68f93ee73c4f37be5fd498824dfd1b1c8ef7dda698c0fbec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06657329f76643087bdebef11b778df0

SHA1
7ae5dc53c3e90c1eb1fbc72d0753f16187def3fa

SHA256
d86cdd1aa1e7a604fdd738f35586c8eec0ea6e3c1fd72a8d0f55f5ca30ea2b84

SHA512
1fd0ac94e74b6503048668abdfc17a0f584b4aa14978f1facbe9174cddcdb61b7bef4795f4d2d4afb6f23c7569979a079c3af1374d59da5bc730326dd7883865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c27703ca89fa24e4f32bd066bca6317

SHA1
ad5b9b6fd88601ef080e99afc017641061b15912

SHA256
f7cd7709a9ff04740414166ad7d782fc3a7fd18adb35fc77232e630c0889afb3

SHA512
27a1f0a8834cc83757be5d71099a60eadf134ac780ffcd5e6d77120bcfe2f9c54018c5a8fd88a474bc4f9e5d2d30f11f734cddcc76c2bededfb855de52ac02f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9100ac4f194a225a4763a9aa563a33d

SHA1
8ab4f26dde02ba8b1a0642ce5f6f863dd38bce98

SHA256
103d67042bc51723faaf660740e347e736a928e60795300364be53d91b06bcff

SHA512
34ae9b52c950f9ee46cf6e45042373507f13adc635ffe0855fc6cf292f2bbf5bc944976ba45bb92b31bbf222d658d824cfbf6be4bfe3ef5e2ab998b7c7ad6d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
262a24acf6dbbc99bb60ced6fd0082cc

SHA1
cbe6bee55f7e62552193a59db0e2d7660bc7cc2b

SHA256
715a5c74ba0c29cc8ac4c2378f29160f371843adecf6ccceeff4211776f1253d

SHA512
c791eaf692dc20ea6ca5f9e226a6ca1a5c5eb50458e4b2b7c7e9bb85d8577dfa394121ca08819b588696e93bf114ceee1807f32f29ec7d70390a53e10cba3bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff25615be257bbff0f4b9375be7e1667

SHA1
32a97e3ee56962bc983f4f0bdef5a0a8677f293c

SHA256
25ed32565cb02204dc8ae8ce928f63fc4642908e2ddbf1233ed39f6f592f5ee5

SHA512
9ee5c10d9067823c2bb2164fa228bc0cf7cd72c885386486af7ccda6e4bafb96b01abf50ed5a2384c2dd8c1e71582df0d6f3cac9ce672d5af9fe4198a03fb63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
717ea20ee54d928c6841e27ca5f5e6af

SHA1
6d2e63edcc990e211a7739ff122d091da6c54940

SHA256
b705f5c20c6c220142b1ade8d1a4632691c9706a3615f89d354cc3f68f220896

SHA512
81da8caf2ec24f480612dca0d8ae28fb922588677f0a5a911ad5f3a952db6e2e7bfcd7d9109f6a731fbb9e3778393310d69628ace10a09b4485f8a710d706818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d07c299ebca6468119241ef455dfc51

SHA1
e5618382385bf3e75b609ab9d44b14c7235624fd

SHA256
8ebf7dd86f5f6b5502345dbcc8c7127de9da718694235a391b224cbd9b5f783a

SHA512
91cb7c4f5e3b1582c041a5e4f79473445903012d085e99c569fbc9b035b5559b45780b63012abb34f1c70b720c9170b8aecccc8d6c6d5b52ce4aa6d373e54044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dedb088c2b94acf853265933a69bf6e

SHA1
1b048f007d2dc166354ab37fe1f47324661117ed

SHA256
eb37910045b5f127f8e4b97a425ce3972652ef3fd2e1ec89d97d3496060d1610

SHA512
05b226c7bf5642a3523b73adb99b86c8cb4babb293722640d31aef4dc4f5c6c59be13b85a783a64d4c96d08deeef1cbfd8694f9130aab09293396bbd723a6d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
671d613fd348c3c18ab8debcaaa746f1

SHA1
b47a7362400dd4e592b0698881327a3a6e7bb41f

SHA256
3ed9fcf879414a2239d85f36914c25960c278395160979993251a84abdbfdb5d

SHA512
9d9b8534111d2cfe36bb056e5f181f7825e633c0cd12b9240f13660259c0c98cfb5e2061a19305ff629ee83142f662e0e89532278683d98d490e063cb991f8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f05fa534b289a6697930ab6b67d1be29

SHA1
e22b3636f961a855cb83dda1cdb0f0931f670f56

SHA256
ebc1ce2abcd95916c73bf10d52efc452611643e79c6d5df97188b12197168033

SHA512
8e63b3971a6f055704e8fa0b659ce25cfae2b31192ee960952222c1e9932944d846fba2543d33f270843f6537cc5aad719768ffd63962ce216f59d3671940d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f798e00e8e6a20f5b7120b9a192600c1

SHA1
dd549e2ba7c734dc20b55954dace6c446cb4fbc3

SHA256
8283a2d17a4b2cf168f62acd4314c6858adb9262530e5ba17e11a0049024b522

SHA512
78fd55ef86b520dc6e33b5f5e166d4d8beeaa8cfdc5aa9474c930676b8527d7eb35a0c717c426c825d83ee55db78c2c3c6c61947900aea4a07420048a0ac3a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99ac1196a2f36494c0fb15baee30216a

SHA1
4ab226d01157f4b64898413f3d970b31c8747aad

SHA256
9cfda50a17f698957fcf818fff4b52fed809d0afd058ff6855a8c059e51588ce

SHA512
459faa5dc1812f332e9b6b7eedc90ffe12b24f650438f972bc13ba093731942a235b6c8bb335aff2a6fbdc41c5f16c479ed64968ac1f70b61f83ed394381660f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
34d45976ffea8c1457dc88ee998f8bd3

SHA1
93bf5a2debb7f8dbb4a30c9f69ac81e52525d49b

SHA256
ddfbbb11b78d5ffd0bcaffd2145b750fc118e19636a3664b71dd999cc6c51ee5

SHA512
328a7275363476bd8cbc2c8746edd9754d355908505f4cbc4544572f3d850e5bf661062cd4ac9fa4928b1b94fae7d93856241427d140df43adeb021684967ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1398.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1395.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1557.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit