e094771cbcd8f420f184f6eade4eaeaa988be2061cfcb4abeaa73140cf72408b

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c29b6c8ab01ae18e0843cff92aae8daf.html
Size

6KB
MD5

c29b6c8ab01ae18e0843cff92aae8daf
SHA1

591760ff5ff96320acdb0ebdd0487dac618ef5a2
SHA256

e094771cbcd8f420f184f6eade4eaeaa988be2061cfcb4abeaa73140cf72408b
SHA512

62a3f6b3d6bf4808dba5aa29dde2ac3da22913ff9593d3eaa0a06be6a4ebcffcd258ba2fdcc86495d81741086407239fff9912208fa4eab4ea9c5fabe424d5e5
SSDEEP

96:uzVs+ux7MRLLY1k9o84d12ef7CSTUFjAcEZ7ru7f:csz7MRAYS/Jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005579371f1a40d948ab367d0816d636d90000000002000000000010660000000100002000000097b69472739e4ef92a5525cffaa07b05690a52d6aa14d7dd11bb252495cf9dc2000000000e8000000002000020000000e42a75f9090ef0cd5e4bafaedd3742e8bcb9688a9e40231ef748544212ca902e900000004a028cacb297324c54f260add3351a590bce925197b6fc88e0c11ba667e83c0822b0bd2b596aef8919a25a12a3acc3a510684bd0c6730977f71590ee5399895ad79d765021abe9f4920c1ba3ab5a54bcae921bfe8b067d260724478c03777102c72c06884a74b91535ba8f06c55b118a7cd75232ffdd0d5f83873992f419e11710e7408420e5f518c5183726d1f6b5f140000000808b16faf75939e84a3f61858b70a0b58e6d0d649e96d2449b94801fefbd59bcf1af8ba24d3166f2efb548a2312e2b720c807e73d1221b77c4094a941c832e6d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B02C6221-E034-11EE-AC1E-72D103486AAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005579371f1a40d948ab367d0816d636d900000000020000000000106600000001000020000000ecc0c5af398dd567cb5b44b83f5f27f6257e6daad9c949c713d6b5b850b88906000000000e8000000002000020000000975ecb9cd37ae272da4586046f975389f7b875f2d3d1f2741f9eeeef44f3148220000000fad2df82aa7a6eb99178d740ceae84cb36e53623621beb3c922fd2435032d20b40000000e39d87a6f0eb54ba3c313d6441b6483787b9fb3fe98bdf3c8194f30f032b6d48ded77427f10910a0320d0e61b512fa54c21bc8fbd01e72221e95b809fd1dcfb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01b77864174da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416384609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2180	2264	iexplore.exe	28
PID 2264 wrote to memory of 2180	2264	iexplore.exe	28
PID 2264 wrote to memory of 2180	2264	iexplore.exe	28
PID 2264 wrote to memory of 2180	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c29b6c8ab01ae18e0843cff92aae8daf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0b96a00cbd77c65d1e3c2a679286edd2

SHA1
72b26b11ff407ac3625d492fb974439d4ffcb613

SHA256
05672473ccfd33d4c658ae046e9028837fa846953fea51e4030175fab6d10911

SHA512
fa6506c2f716986e59f72e786e707437fe0941c729449a0284a253e520fb9d8ea85f8234da4842be415f520433524a1bacf8ccfef480910c89752f2d3d3b875a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7df588e175c9b4631acc9171ff9a7f86

SHA1
042b19ee5de7e6a6bcd2d1d584d7d163483d62db

SHA256
f3bc350caccc19d5b5e4d0c7ca176108980282ab7ee7949790054cd3ef96e68b

SHA512
3b798523af6582290bd64734bf87a3cb82227cb63b4a8b52468e9d0e23abe6d54183b451b32a754e04675865634191f9a1582c60a5ad00eb41e194bd3ad3d952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
902d73707232cf1a7fb90e588096cbda

SHA1
28fe74ca6773b8a41eb75a85278c38dd28263b2a

SHA256
e588d832d76756cb82db0eaadb380ee62450cc99736a2b12ee9ff3f684b95e56

SHA512
669c72ec26ba564aa8fd0489437f83bbda57184b9a48988df8976846e5a5ded9307d5dc3c7d2e3fdeb6b9971860d072a4af51b4d3a4a148ccecc98b31b11da58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f8aeed9d865140e8d3ee35fa7d8283c

SHA1
f5665701ab82d4d2169161fb0e546d567c3d025b

SHA256
5b13c838ea2466dfb571c65d9119bd73afd11c0e7fa4ae78dbfaed40c44ab379

SHA512
f68c605d17532b481595888d095cfed2390d52cb92503064998d8f76829966319a6d793f96be1dafcf82616e6031cd7062d83574cd1e15dc3776741567dcbe81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2214cf0a96f065a63d44aa2fe7cea9a4

SHA1
fa1671dc8248c11bcb851067982a9a274c90a124

SHA256
c79703b16d35d45614d36938d712e4d4af504c2f1fedcb0fc576c81f63bc872e

SHA512
c4b29ff9968c41fb98b80a0f5c539591669ca89e19ac28978504e3dbf9707e43a742a85505586365389dbd5b1f70c4f89088a4ccb1f526a2690fef105f9b06bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fb25bbc1b5f9ddcbc9724864c5b11920

SHA1
64c9cb7a480732e673a238506d7d86b3a73d9e23

SHA256
2835d217200c7060793cb16139c775d1298349ca0a907a3237c6913df4b5f1c4

SHA512
35f3497852259610f14484d33b89a35078d1f35ad3b979bf7477aeeabe2d78d5e0893f4f32aec68d9e642974df2b39d27365f2221bdcaa46296cc7d8541ff2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5c76abdef97bbafdb1e35faf42fd0d9

SHA1
f1b8bc8b1356c5ead3c68621a32c65e6bc7b88a7

SHA256
b401e17140835b9de4c304b483e20fbdeb77a1967476350c52c9172b97950f7d

SHA512
b7ea14dbc02a0800c463a46dc08af3d6943372ea2578f2503963938b228822bfd5de12547eb3234c7e7b3b81add387e7fd3f700768ab1cd0c88bac88771bb64f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6b358367d9ee89f1174432a476f7d433

SHA1
4c1508ab580f5a87af53f77b39fef1c4f231cec3

SHA256
0275ecaac664db315fd869682903bac196598d865890c9e60074a29554456eb3

SHA512
fd73478a7e2ec2e7c0229281721fd48a3386ec6d0b52ea5833ee1108366dd7f0a01d512efc533d0ba3fba57b64ef2dfc927f128faba025a7728dc15b613bf868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
490540bdb60d0ab48b32c6a5e05f631a

SHA1
89956fdbd4c2f2b4275e18f8e71161f1a5d29767

SHA256
507ce1f94d2133ccfb9ca048adaa49d293db6dea8a62433795b4ded05f7cfceb

SHA512
6d637d056ddcd9b952419006565a39beab7774a52b116420de9e261db8066d5c4e20fa723b84a42227805df15aefbf8aeabb56d56dd390d05441b4a8192a74d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8d8cd8c473a409ebead2d0e744e0d366

SHA1
d7ad470bddedff1b4a127e831cd3245e73e981c6

SHA256
7a1c9e1a1180858fd5958d08f928b9b519a7c3699da3f150ef1bc72bf669202b

SHA512
da66cc1af282fbbc4def912c30fdbfb75de7de9ed0fd147c08feb90a6c9551c300403f373c78ce5d843d20c2e62227ea6d9244365d68dbee05237a53978db362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
72a4a8cdde4cfe2525f14c26f4c005da

SHA1
54885466c3488aa656714b97f3d5f61ebfe19706

SHA256
26c35715549c06c5f1c5fdf5b84df98a182607cca5c387e1d141bf1d3f0c09f7

SHA512
e6b9054ffa71358b6290426957e3ffcb5abf5bb3b52097c041982c9cc5e6aa01d6c2fcf05017f0a8b53275533e71a76c70a307f810a6a9625b050c12c59b30df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4eff46bedb4a662f8f4b5240174da53f

SHA1
c571a0ca641428839e5b0cfc2437cf7ea568736b

SHA256
fd13a60b373e725b0c9a56e8fac57e069563d37053e4b5a5a8bffffa79ea27ab

SHA512
ecdef79280f46a067cc2c5cc7fb1bf710a1747ff17850fd05ab98370d4a21e6b8d3f01b896cd42de10f331aaf21c1b1e140d5f3adbd3e8eee8105009aa3e7f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar268A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit