566533e46bf0e235793f13bc1935d102e1f39534b2e632c9ccf71ff51b670970

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c43bcf7707e62f0f51740f77303025f1.html
Size

161KB
MD5

c43bcf7707e62f0f51740f77303025f1
SHA1

cb6d1fff824647e786dc2afcd487db3b2281808d
SHA256

566533e46bf0e235793f13bc1935d102e1f39534b2e632c9ccf71ff51b670970
SHA512

e8cd8c516cb04dce48648ca16fec15e9e4ed7305f0ffab01153fe0d6a3ecfe24f222d8cb6d41c7b0cd612163e154957c90e5b90aac1539bb8703730d93fb6585
SSDEEP

1536:LCb7wDUnvBw/a1fIuiHlq5mN8lDbNmPbcNyHcph7nFf:LCHwDUz1iT5HqnFf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75B14A51-E0BD-11EE-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ab84afc683d71b2aba6ea67c3ea43a128da7a2af599d493245f58b2c043accb5000000000e8000000002000020000000da91a4db82c31927c6f76ac17f0545c6919494691f32df41fc112507479bf1cc90000000d00ae70d624e1e368ec00371984acef76d057b9971ce6d90c12a809fa21dfd7eb8ff0fc3aa16ee51ce120b2234ad86d8157fd8207f21306f53d6753c70995003374b471c4365c178ac79cf78771828bda5f5a9b6f30711efebb26baeb6fc20249ef947e7a060e1e3dba72f9280ab66fa2ff9b48d46f1ffafa01c71fc57ee2c974fa9dff4ada7c7f64710653e82f390c640000000a391c2e45190bc9aae8c2c97144b7f16ca39547ff4db83430c5a768ef7283b2df5053c09694ec277eed572e88f8fe4b3cbe9be6a1ea28fb52289c180ea6178c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001aa24780ed125eebb35f36a9d13363ace62147faf59ade556e881b7cbef1d85c000000000e8000000002000020000000ce6a44dfd3a4ca287adf11246b8eb5b89a6ac79c4f221504dbfcb6aab6fa06e020000000483aa03f78d138a810b454813895f09ce56af2782409fa70f97d14f6ab771d7840000000f8d7ef877b319a2c15b2537d851c047d9babb705c5500a73b245a4cb0d5890eaf40d1875cc4e96b5164047f381599ccb7defd7d9ea9e38bdb3c6441573c06d35	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416443351"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402dab58ca74da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c43bcf7707e62f0f51740f77303025f1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e90187a7359d621ea3b82f41a4b07e

SHA1
8ccc666ebdd0fdfb651c0fc2e4b6636eb1aaa560

SHA256
d02c77982017d382d0cbc09f5feaa8eaebd21a8086ac3ec665707b5e34875093

SHA512
4cbb86ccaa6abe7712a50eaed23494535444336ff94f19f214c967c033adf4044febd91b6cf8376ba9accfdced52a10f13431d419bb69ff2b75690d81254db98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8163c60472a522dcef621d2a621c569f

SHA1
c0105c9ad5148175d9d12269f30291de8bcbe035

SHA256
7c6f73a1db31a1c5ae294510926f64aa13d62939642574f50a4d69e495755abd

SHA512
0d03568d38410db0dd998f0fc6b31eb1dd889652456f16871d9b685a5caed3c5f42be8a3bcf81be4fcdb04fd008927c0b9e8e33e5f0df0bf5ccf8f775fdefa0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb106f02baf2ebd72339f11358847628

SHA1
9e8546d7f9b497c7ecf5a01e6601415fad51ab9f

SHA256
89101e2e0c953556c1c510d0e634dc2891ad56ce3e01e2f03ec2d43370530435

SHA512
bdc0a8c707645e0cd87e85456209e3d1f0e3e8a50e532072f8005adf26c530de13282e2e22e3b557aedbbc2dbef2d534e6b300a92eb7fa75308547e997650770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9043ea626f9d9d3f210607d69cddad8b

SHA1
d0848a9dc077fd78b8777e1e60e38ab368b2a4c3

SHA256
523ac5576ebb9fc2972453c7bf0147690283d9b231c40c22c64cae3c349768ec

SHA512
93dd4825e3b60ab0c3c22e0c18d333a3685cb440090f24bb59bae99a87201f03e3dad767cbd26ea6b7d656ab20507054fadc15ba00be211304ad32b758d1b440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e5463e33ce95701af7c38cfc777e35

SHA1
41ba8885eef02bbbea2d54cc04a1e31b3cdacdde

SHA256
d8599234a4ff6c82316a259785fc49193113731c77ec700a86ac10f8c0865dc6

SHA512
fa8bb94b9beb550b32e53760730834ba522519da7195ff537bc515e99d4f7eb8ceeb2fb9c0d100a775f7be7a8ca479a7428074b68fcd66321d5e932f81e1f95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9cf055ec409348f8414bdbe0617bc89

SHA1
42ca9349b469d56c50c8e1730dd962d550bfdba7

SHA256
0b77e7e1ccb035163bc2517e16e2ee09b66f4afa900a788d3e4118153bd21743

SHA512
02be736f25545b0ef79fcd4c099966204ac6e3c560568b23ff863f9dbc9c69378f5c33dda6832bd990ccefbb20e1cc3fca7f0309b0d337d74fe0499de4011495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b957df18459c8518dbc2f26b082a0d2

SHA1
86a03e73c998dee90d9427a055a0724e561dcb4b

SHA256
c2252a6524d4121704294e50c48b11f2b577f5c99224702b69b70492dfce6c95

SHA512
c2808ef1467a5e0cc63b95707dce121e193cc00100e763ace24fcc2c0f7cd659be5dccc3908c6ec0fce27590c11e9ba907dfbf3c9eb62211402d826ce891cfcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d06c940564781d331fa4b850b5f9a9d

SHA1
4b598dd89396adc518cd14cac8b54612d1064497

SHA256
ae9c02dfd3b79319e588645a90b1ab53f0789b4dbbf16b4259c7dc5b39850d54

SHA512
eee8082e7034a7bd422f4e15ac97772f18100a215616c462738ddfdb4c96d0946893e2b210a1ab3362e64f685598ff1f71d6228035c0f438f40fb2c7f84ff546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5059d9340d5a794e080573cd5155ce7

SHA1
492a733e5e3e80b8cb2af3cf7b18f8e5da549789

SHA256
ef63911ec29589c22c4451272ff832891a2f629d185bfc93bc15e1f891a5fc2b

SHA512
2addc48b11f9c5e4b82a1ad7c5868a70099b30470be7e28934f8af4aa49f3ce6fd5eae618a24b5d98ed63d62fd8421e155fa667cc05f723233428f6ba8521d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
841030a77a2e022742431d03b9cc12bb

SHA1
bc721d6bc2ec8ec7e3857a2f1b6d8f9137fa4d96

SHA256
70a36f4bb1be9feeb2e9296c0e42e9fcbf94d9fa9e23e157b2c25fa32c2e6186

SHA512
1ec10cf34808ce41a2eaa5bde5cdd72199425000d00779350f25b3702f54e9c998c547c9305898bdbd17872033d267c35bd38e4a95023d2504c61d34ee72b1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e78cd919d55ccdd0c5f98d15f8e3c0

SHA1
b29fb002ff14ee6f5302d7d8ca819bf8f6ba8511

SHA256
cc05f1ff0797cd5285e253d83c7c89ac9608abf7c468ca21d85b1c313481de6f

SHA512
03f22d876bbb576f11241bb5d766b4e1d66aff5a48273c769e1b7411ce9ebef931112d16061766586002e680ee70ecfa1048e83fc575b8060a70ffa33611d023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece6e5cfa515885286c2597a6e1cbb6d

SHA1
7113eaede1bcef36d15b4d243e04545d7a8c92d0

SHA256
7e102405efde8dc96e2372b96bfc8cd51c65ac74a11f15762dc86b689aeee377

SHA512
92d89d73152412e846899a0981735ed97e7333962af17ec1837e2d396cf826297b01894e2870a3a1d9233f07fb02c2fb56ef046ef031d5f8853f602f3f3fefe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a26443921ac29ab3bf8d604017a8027

SHA1
71b3d1bc6ee5450964d9a3bd437d25ab5ce9e3a0

SHA256
afb24b86c1540a7b616a26f7a71eb18ce9f811cf099db9d8a75bde53699eb88f

SHA512
1858b22c5bcb86307da5331653ef4b9d25b74f51a54986e3bb3d009f2c8969f5516323093d45b07255403485498a7b83838e096bf607f5b0c7a4e98ba0c548de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754a4df1ad9f3fe6979b1382af73feed

SHA1
c6dabf3f1eb6c9b8bc4ac2a1f7630fa10c224b2b

SHA256
9a7a56e0d07644c6765767436b8bf9293b30b76330d0793cbbe09cf5820e9d1b

SHA512
cc0bb0687b257d775d83837ebc9dd8d0e274da500ca7716d2db8778f18de7ba1ab693ac502a517aa07b0b99459fca7e4e4d8171aa04d665835cf1a7b84d49e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab568C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar568D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5889.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit