ac09b2c56da36ff1da82e69156de52a5b3eaa8c601ca9240a64cb19c338de1ca

Analysis

max time kernel
136s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c18814b8665e82fdaf7660eff80a8182.html
Size

175KB
MD5

c18814b8665e82fdaf7660eff80a8182
SHA1

1ee3a1a0c953084935bd01c5c758eae9fc0a0f6f
SHA256

ac09b2c56da36ff1da82e69156de52a5b3eaa8c601ca9240a64cb19c338de1ca
SHA512

e3760626d4af42885366bd4d9f72a539ca408e9b6671be68e07e39ba164f8a512a95ef5d6dd9a6f1104caf598f592a64bd0906fdad3bcbba21325b6ef33229b5
SSDEEP

3072:S9yfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:SIsMYod+X3oI+YS1tA8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416351014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000def17361bf3d6dffe710ccd53c8bfd75c302c78814cd532b0f725e3ce6e997aa000000000e80000000020000200000006ffe436af8014331f62497f8a192f99b79538954ae5cd38a880ffee3b12ab2c090000000f0fdb2de523e75a6cec946b439273cfdd1387433dc400a3732ff9e645108ba905275ca3bc96d4cfcd03a884d37f6e1dc8e60a4a262085f0b0c11a93c61306da13c13ae1473e3bf17fb3de4e3663979874e26b5c68928103aa316658639139e1f69acfc03c0728c4af8a6db6ca0b36bdea5ad1a15add1d2c44dfc060febf8217e436db99192380758042d87fb5496d7fe40000000a83379df8bd3876405b8edbe831ed39f99462ae5f0d81bd2a3c18f3b50c49b79d576451350b12849ff622b0166b862af96253c36fab9c7ca13cffc965355a2aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073e24bf373da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{775D5EC1-DFE6-11EE-852B-6265250A2D3F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008d6584696d7e08a4d10cef14b7c2378afdda1738fa1d17081701ee4d21445446000000000e8000000002000020000000bb4f3eb639c58103faaa51b26907f21eec10621b62b535511259522d4f3de63c200000002ce49524c2e125468633bcb1617a32faf9e06c5c296d33530d7b2d4b1a50852d4000000048f11067145fa3dffce786acd770053947de1f501437ad0dc233883f33e8b36a754d67fe8bd75fda529197366b3d97cb0d7795f2f9e0568bd055ee6a530d8782	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2148	2732	iexplore.exe	28
PID 2732 wrote to memory of 2148	2732	iexplore.exe	28
PID 2732 wrote to memory of 2148	2732	iexplore.exe	28
PID 2732 wrote to memory of 2148	2732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c18814b8665e82fdaf7660eff80a8182.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be53598e45c40b31dd1eac27a4563e5a

SHA1
b6f8f7c3cc81f4df93620602ff1af92012127b8f

SHA256
f6c642de71295b0b87fc680a8bfe7dd3b991ee411e1ebee03d0688aeaa978dce

SHA512
e9848c41348b1a16dac290ae9a7c0ffa3fe11e036e28ea6e09dd1ad809dd878ae80b16e6af20053dfa111698131e2f0f114c854dc4fab7ebb5e565fa136aa509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16aca59c7e4f4174bdfdf086496a5e9

SHA1
c4bc31333f53f9d0e1428729572f6e22df1a285e

SHA256
3d885be514b557ece7915681b762133f483e76145d47d7cb520e8b65f123bd54

SHA512
be29f6a09bd4f35bcc57709ed96b974979e3bf52fad3b19e42a6b2872e670f34898e573ae42e4ede0f2eb17a8062c373e5a7fd637d9ee39a3e837ab544a35632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
491556fcefe535da066467e3c75c30ad

SHA1
e1c91beced85abb177cc5edb35b08b2ef796b1ec

SHA256
1fd7f32b39372d3fc0b5e059f612978e01bd76cab5d1b012a37d3cdba0a57a63

SHA512
54082d2127a5035c39a639a66795c2a4b15ca6e7522c59770027d6af52975ff6b70019156942edd93ee63820cd46b86e675116f38eec3afc78ff9217d4cb6cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8317537a769103b8f5aa574aa96e6d0f

SHA1
e26806906dd10c6de6c1e0c83953cfeb8f4ffdc9

SHA256
f5713e827609b824ee32c0a693fc791b90fb2ed973b2ddbd6e771af62e86ada8

SHA512
66d957d3f884747d9650ad2490fa884beafd777521d49ac4260138a80f2f81ea63e1791e5294d1d52cba22b7125d381cf01c439326d71d76bcfa6fea619924b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58762676287b5f3b6b8d3299ababc9d1

SHA1
509f678dba6c315158ec984c898f6b214bab6292

SHA256
730adaef39319247692f56712dc52dc1567e46a66dc05fdce086dc974ab95091

SHA512
a2e6e6ee9c0fef4bb400dc9c97da73c5b601f6620f16a61c07066137733cf163d266d8626bb554516d04371505f339a4361b739f5dcd53d2e0b01fe6fb139210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85880c352334db14d04a5b0e4cc3998f

SHA1
009e6e1a48986840dfc2871877a45f26a6568634

SHA256
1d265cc6d48ec4ace756f8c94bdb56d103525c29c5a623b10a4ad496e679f235

SHA512
2f55b3ba723a0a0c003f7d102e18cf7b18b4276eda670f6a10194339ffb0d0e427b343593801b46e38fce02649034f73a52533198675341fa286cd400e425b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e771fd7814da5f81c9a1d29cbd935f7

SHA1
a074e2c3b130021c9a81fbfcf5c86595fba2ebae

SHA256
6336ab58888f07a5b231eb0d9578ec6511f283854e05a5c968fd17ec52fd76fe

SHA512
ea9c1d57ea0857d32d9c6e9c2eb4419f6da85010e8c0fa0dbe4fd77f9c9b788b7e8f27d4e9dd516076ec78882d9c94e3ab939a3d0b0a28be1158e9611e203e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
456d9262b4a41a0e3c96220d9e5c778e

SHA1
f83e0050edcadaf1320fb2e53a81aef57b69a951

SHA256
d3bed8b4c15fdbad06495f20e7aff1f7deed2dc008aef23c49074cc6873cce7d

SHA512
94ea50725d1b1e98f4bb3288016f24fbab8e97b6d4d0bf0ae04d46223e05b1d8a4052d2f3e7074658bac197181c3323c8772b8e73eea02288ba13ed76cd13b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79428c283c31d37eee5e85f99dff6121

SHA1
d95b7f0bc34ff7dc446f08d6df26c1406855a1f8

SHA256
cd422db3609064f781ea1ed836121c8f26e6b7a8df46416ac8b89bc8594f5438

SHA512
c6f743c698e78e48301fef3704325a7d62101488dd0fccdc975e16a16986062c341df832a2f2fa7a1799db5e27d028feaa00b3d228c7db1f2e7924751fe67b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37f0ba190b29ab1f5462e002dee3a864

SHA1
e4c3d53c02783567039ded7c4ee16fe457556c12

SHA256
e7a4e4d4b5422d06679be2c39dcb88bb573264d9fe1039324467ffac8892dd9b

SHA512
e9bf17071694401abddac169adef3f17593e92c7f891eef7caa7e5914562261d89017882faf27aea69b677af9da218de40da27248357d252ef9ba4e1826f1e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654235e0c120d07d8665df347ae45733

SHA1
a389def999528c3a9abfd666b38051904fef4b83

SHA256
ec05c6b7cd2e3dea488178e3107fadd1c1f3f7e02f72fe878dedd3a84ebf8671

SHA512
9a95d600f166c0ac9fd37f54880b87f02841ac310d8c25aaf1966bb2fe0829398fa99df3753757201a4fb6ba85b846bd990007225fd655f18c69ed1123afbfd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce70ba234ba3b3936dc70ce3c6295a4e

SHA1
f0d7d04099b206d53f41dd0971a8687eb5781d17

SHA256
975f7a5a78a4f0dc09da3184897b1db37393d78516194b8fb3d602a526225fab

SHA512
9b3ada5f8f4e53ec6e24f6a8674dc8fa7900a7caa667412befc4b8fa22b572807d5c10f9e094752b516ef1b0c5abc37465786bec7b52c6f1de45ad6c12e4ac90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6f39aba26a05194b1674f0194b5a9e

SHA1
0c7354703f91d96c8c3f8d0dbc8f31f9f6ddbdf7

SHA256
9c1d89b6b265535410ff7b5fa89bf27e6bc0c23ac253ec403f41721f49fc6960

SHA512
c2bbbba9d9981dad5115f477d149a8e9f1ca22a1151df18d8c8c191788f0b1960d7a1a0db2e4bde5bc9384b72bc6675b1f8d91685af23ac9125bdf5327043c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601c71b7f4f7061f114ad4c6bdb2f6d7

SHA1
5368ba5d12e2ae4b2b9ae6e0c65857c2a96254d3

SHA256
d3e0fbcfb17f9c94710f95c3d49fe63a061e600d8a9ebf62d895af5814c178cc

SHA512
3e45297cac43bcbdbf2085940cc091285f1cce7d5b6af8c74e23e53ecc87e69e4ada97659ed44418fb8536cd720baa59dd4ba40221e48c8639c0747b7a5336a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EE7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4055.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit