e7ea9baf01c39e27a9aa125870043ea3736cdc655af16a6f6b722bf051672811

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c23582f2179a098261eace8acb270a37.html
Size

53KB
MD5

c23582f2179a098261eace8acb270a37
SHA1

e1fb2b73557f36d25f3c533f89152261e0217f8f
SHA256

e7ea9baf01c39e27a9aa125870043ea3736cdc655af16a6f6b722bf051672811
SHA512

3549019ea1d19727e542bae2605edf5f1a6f4c28b83ea00b4ab19cbf53b16c53ce4fdc7edcd7c44d5a791f38b0975fc7a5fa345040f5f8cb8a7bdc3ffd3e722c
SSDEEP

1536:CkgUiIakTqGivi+PyU/runlY863Nj+q5Vy0R0w2AzTICbbxoN/t9M/dNwIUTDmDu:CkgUiIakTqGivi+PyU/runlY863Nj+qE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f730d32374da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416371824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E81BD301-E016-11EE-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000097efad428cf48203262b13987a34567a518549de4b876a30ad26ee114abb175a000000000e8000000002000020000000efa796a88f70deef914fa3dc12fe6b38b008b8e1b8275e11fd01ec5412d45f88200000001a295633c9083f325b1bb308cebd1192f310c437f82d1bcb28cd8c27193dcd3340000000b9ce2e59b4cecd4986a8d823487a8b28032b5b420cdbd5b16765fe8c0fd540d95509afc5ffef6094e8cc3d55468530b60acde9c3be9eb83e51b7e546db6a2ac9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ad1e19c153d2f6ca03352567697b0af96e4db1cdafb329d1b2ce7e5596f0179c000000000e8000000002000020000000171da078f958fe3629b85c05ae4eb898300ab981a73a22581043e670e2359a9f900000005e60116a288ac90762456b366bc3bae21c460fcced3c4bbb5258f047644fa313a277bdee95b7f5b20d1d777a942a11b6b3f12b6ed705ccf76c4806e5949e8e63a5df38cded03b1fd3deb7f1935f00dacdbed485e7655ef1171aef32a37ab5433919733ccea2dcb2d387a0ccf7dbfff71c6808ae5cac02b20c0a2ab9a1ec685db6e0731488ff5884490e9ee122c8b1128400000009f95dd7221832136347f5bf7a053b41d58856dac5395b8a3847fbb9ccc5c7e66ec8ef7711dade185782ec219b7a3ef198a9550be93957258a934d21a3e301255	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2232	2452	iexplore.exe	28
PID 2452 wrote to memory of 2232	2452	iexplore.exe	28
PID 2452 wrote to memory of 2232	2452	iexplore.exe	28
PID 2452 wrote to memory of 2232	2452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c23582f2179a098261eace8acb270a37.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
62f96b86a4a37c33d9e8ee2aa68951e3

SHA1
0ace3a4a1fb81a51c468b60aedc7effa20e4a61f

SHA256
0282c2e26e3a14de2916fe40a9f38512c44d25cebf1555e22c58d02453f92010

SHA512
2ac5379158207d6f31e1c5ce4ca3e2d30404a059d844ae42e4ae308b9508325e0f5398faa9ffe6548862944f18c5b462a0c237e4e2e821f1a25fcac82bc0b293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c6bc05d5ee77c6e76d310a3b04b69dfe

SHA1
2861840e089ae45a48baf56be81b484a51cca722

SHA256
572e40f1e3f67d720586f45af606fb869ea13dd4da878270ad9f5d12c48e472c

SHA512
ae9374efd1fca2de579c13b9b248e5092919121bcef19181b6a9de39450fcb8b71b2c75fef83f4827c7a8d19293a042e21e52263a84ccf638a70a7a3f828e909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4ac530ca05d60b1d121089b78dc6c1fa

SHA1
e5507554bbb2544465a19a09c8c8133d455182f4

SHA256
08230e541859a9284e6efda045bc878332aa3f9a10ed0c13d1617d2696e57c74

SHA512
378f258d08ea05f9d7acf5f9f3915a07ee04d5d5724120ccbbdb00ac82467cacb29cf1f8a03722d077d753cf35b84fbe76d4bbb954c27116369ac989b76089d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ec11549d04cbc168fd085b457425109b

SHA1
60b3276a59a628ed6186dc48b88924ee1cddcf13

SHA256
9fab1dd18983c8f6f5c41cc1211d8cf12df20ae7ea1840c01efa4057860c8401

SHA512
ea39e3a94c88cccedb545fba2a32e9ed1e5f26ad59cc1c761c9ecd61831c99270c9ea30efb9de535c87714745aa7cdbb1ba394412c1499be41dbc51abf84145e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a5ea21222861055e139630eeb70e9b0e

SHA1
85f65cb8646a67673b63174b97dfcaa3688f29cd

SHA256
5cddb130b8f2debccc53590720730c9487b6810e6aaf0f4677da0709549b3c0f

SHA512
9ae756b81e913d64ba7d5115cbd38753331b47a5b3cd9879d67fdd2fcf056e4ccc1b6999f58fed2dc1ddece1bb692b0d3f300136d96b86a6a2b4004167b994f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cc1c0aaa443992cc098d12f6a38a1792

SHA1
3fd6d1318b696091b53b1eb8cdd19be5335d4861

SHA256
3af0e78e7db170fe50c40636f0e46b29b83716e48bb13426976211f0179081eb

SHA512
2fcc399079b029b902dafa3e6fe30dd3c3a89c1c35155269ad5b2263e03f81f43ae4be137e484f584d9510b3f77e103a81d9a518fc948df795141942012cc89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf6ce74c47752380cf5bdd360669c0b3

SHA1
4bddca8cede5074562eec5a9596161d5c5d86798

SHA256
16e07301e58ab8014316922dd401bb93ea9474d20b25d99d6c10b84827dd30ee

SHA512
eee0a265fb8f01b7e40034801608d2f6df6c41ecce4f74f86f8d07a71aef976b3d8caa3853ddd044baf31a303bc354e816d80be24427d32cf2dbca37890d8f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e74da9eeb923be6a038e75eca5e44b6c

SHA1
fd97e3f77db875438f7b50939794809a980c3a8c

SHA256
f6a7ce9171a8712bca8b4145c3f29721e69bdaeebcf67b50b2de52dda9aeabee

SHA512
587e3b42b990e71c8af1e3edcabd30594ca117e454f9a834caed9d29ec8dc9494c6fdfc841698c094298ef32e8fe5d927b50ca96f349f8ff4200af4a08b72c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
85270ece4112c008e296c0160e6b45d8

SHA1
87ac8a427974832968e2c15e0bfbd35fa41ce897

SHA256
7aa48ae6ff09924e85cf8d0539a7360358af8cd3c7ac6acf4230fd31b84b3e06

SHA512
01880f2535e0beb3e3b7a0af4407afe9f1cb9b5dbd15cee0aa1ef0bc8cfb166164456d92e4910b3b244dacdc3a2910367d81203c7e9430db7640fa098a496763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
014322d118b4c835520eb8815248b754

SHA1
3f989797572f0136afed3ed05ed30d4b2d37e006

SHA256
f6814726aafaa5ffb6a8059c7cd9234e61733442a6584f3b2d20cf9c74497e25

SHA512
6102117b8f58faa55dd0f0efd7b2089e4f66d10419450968d1d4e49e0cead11dce6e5b80f61ae04eba45abcb055efedabfae447dfe67aa436987043dffb4af1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2eaf61f06e32fd7824d162755904c2a7

SHA1
6d55885fda5681a66eea735db4f1ed11785ea826

SHA256
7b6ffb64a757d4cd5aed12d2501f3090a813926c290457db34a1c6e3c7ade2ae

SHA512
4b168055b53b72ecaef0cc94dfb3a3d97b76e84fe72beadec3bf12272cc315f458e5cc01b6e0984b2c88c275ecb968e6b16a3200ea0dbcdd2a44b4ffc603954a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc8b30fbc6cbde026ed98db448afcdac

SHA1
603b6c5a162986d3e64fa61780896035936b0c6c

SHA256
6386c2ec784ba6a5d603bf89b76a99811abe24c17438c0f3db6027ed100b8a3c

SHA512
13e9d17f13d48c40be3aa6daf6491aac054428421a21379b556a5384c43cfa1367550987b94a1832d866c22f952d587ca6c92856522e22ad4f194b3f19c73c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2ae86d0294b4cd41bead3322e56f7e93

SHA1
d67d7df75cba18d980e758b91512ca5556b2be44

SHA256
75d77c803446101691e9528c4ba68df06d916b3526214e500a720e8671ca8302

SHA512
0c120c020066629b0f3dd35b8f73a5746e5bd3f283cacc363fc078662473a28bd9f4a3d22b66797eee00a3e1578924518ba9ddcf57180fef8bab5c8d8e5e5414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB4E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit