e0e568c15fd66418f446c166b820afe718dd66e1c2d71ce99c7a6593c973f20f

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c17e216f4014aa5749246a6e7488c72f.html
Size

54KB
MD5

c17e216f4014aa5749246a6e7488c72f
SHA1

baf7d1c956f7eaa7917db6546521a3788848cdc7
SHA256

e0e568c15fd66418f446c166b820afe718dd66e1c2d71ce99c7a6593c973f20f
SHA512

f393107251122e6cb9212672bffe6e38eccf597f5c5845eff8976d63be839179817310b4ec5f8e58aa6b6a9fc9b22ccafdfba2820180f6b51dd440f5dbcc05c5
SSDEEP

1536:/fHXHEHT17Qo0FcNesQTSzW+tYFSLtP9akoDCWJBh:HHXHxbcNeNT2JP9akkCWJBh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30995154f073da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78DFC831-DFE3-11EE-A5A7-5A32F786089A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000051db0f4dd1fa558f7f37fcd53c12c47dfb93750695c74edf4b081792c10ff4c000000000e8000000002000020000000283291907aa253f797d56b41ab1b05056eaedb578616a6a122ff7fa53ac778e7900000009a55f0719dfd93dd2fa1044091e1f90b46b8a381611b73eda11423e91f0f7597177519107099bda9868f875edc223fe7e13318ca42795ce4093ecf2043c665aa230f05eb81ad1605ad6fd2bc1f063aaa33bde6c3423296900632795211ed98e20615c159ecadfcfeac0ef2dd65416cf89f4ac2d9d3578e4b5de295fe5699738723d0c73bf0aaf818063df08cf4a2463340000000f60a4be6ce8ef9aacc1a36023fa525f568d06c639d70c9a7023db6048eab91ff6ef4815371536546a7d214b3f7b330b373f89190372da4dc525d20c5599eaa4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416349744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000535a0a8cb64d67c8d2f7b3cf9d0b6bc63c3af7920081a4084bcc5597becff6de000000000e80000000020000200000004d73ae42b5c044a218863cd353fe4d88c13cbb229d2731fa5ca2f5167209c68520000000f4d33b64d93635a5d2c69f561175915401d9b63e50f0d5540f14f231afa850e140000000867b5af792ad035a9c7f92857d00f09463ecdc650733150f9cd510a0abd8b40601ddeed128cde3c36fe11402036e33a0238582424df31fe80bea1241fc0e59ba	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3048	2924	iexplore.exe	28
PID 2924 wrote to memory of 3048	2924	iexplore.exe	28
PID 2924 wrote to memory of 3048	2924	iexplore.exe	28
PID 2924 wrote to memory of 3048	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c17e216f4014aa5749246a6e7488c72f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc353f0e2d896032eddc238ba0c153e

SHA1
c9623b3433bb878e070683224312254b248f1fff

SHA256
460c7c5570ac97fec7ce0c6d531a7ad7a8fc0aee3bda1ee0b70fef4f49dff84b

SHA512
3f3002e187e8fa3c5bf03b4e371366944012409b5818b1692c1d2bd2edfa7711953862ce469e6187e26156c53f5143d0b020759ddbda2c54e10148e7404bff7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f15425f1e712246101e60d55bdeab8e0

SHA1
8b99d88a3e6945f2cffd089e0922b6037d575020

SHA256
0901b52bfadf1a0d97f14649c2de39cbacbb398a5b1052035aa18db1490035bd

SHA512
42810ad8566065a6abc26327f198628b1ab3264d8d3cd6813c941d3b38614189125e01fbf25014422544d68c55e737af39dda0e9e767b82c14f4998b357b6fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9bb74894852e4977c25a2c3a0cd4474

SHA1
825cc7baf2f2ef484cdc7d19c991057dd9f250a0

SHA256
1f0eab52e03e1fc3d8498740b5731d746054474611ee868db41f67af653d9099

SHA512
fd8ab864a4d1162c5da745b81b6631882136314176a1e6ac588bd598ac1791c6a8d5add58e5b960631677b2d39db22755d40d8564f8e93167ae0c3f39643eaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845b762853f3a0f4b98086c0ff93a626

SHA1
171c37c35b24bc624a3dc7976294249697051ccc

SHA256
8fc4b283bc62ecd637b5013ae49617f6d4bcf0fb05d690f4a94dd1affa37b6ef

SHA512
30f92045d5c66b83e5cdc5e805d553dd06d253ba6f2ee8b29805357e023641d847f09be46e40ddffc10ed39cce9f7f572936d631a6150c70ff6e0c36a352fc17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbbfd0c5f007e62bcf05976ede6d23f7

SHA1
80bc9660641c8f64b8c85fb473130f08b418ed78

SHA256
56790ac66d28d5a5b3c4195376b708de431d7f6d644133fb58bb43e82e88bbb2

SHA512
34522c2a023a46ecb0e86ef48d094ef305f2eb9103b6aaa49759079a2bf5c70e75f01fcdcfd4338ad2d07a4c130565741972682d26c3fd18c45fd16f069eded0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094d4a5ab901d7948eccb69b6e60c921

SHA1
343ae35f964d4594daa12c551d1037e00e01481f

SHA256
6cab3e8a9da48fabd1e39843fc95df2a533a7e08e0216eaeb5478282f2b3b963

SHA512
88fc9ffb3615d70776f58cf94ebecd125d7dc064ae5331e81b8a138c243ecddccdead473ca27c5f1bb81a4df00f1e5cac1e56e1431c0c5f103e75d9f7f8400a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
550c42a15255f57d754fbf256f8da436

SHA1
4bdc30b7025bceaf449c617bfaaf5defc99f47f9

SHA256
778da846bf755ca80730c9acb1e26d1a36a5661b9dc38380d977e83acb4991b1

SHA512
f1a1b300544cecc6eb1aa3ba1cb58584a4db88f241fea8b488e069b4765cc6e1c2ce27c35f73cc86c68cb94adfc52c13f4c2360cbb45824d711a7e70f9333fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar148E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar166B.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit