32f4ac816d163927cba586113940ffbc5de2f60ef024f39cbf891f7393d9aba2

Analysis

max time kernel
147s
max time network
141s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2fe0218f6877d1c8d04af159cc0e0eb.html
Size

12KB
MD5

c2fe0218f6877d1c8d04af159cc0e0eb
SHA1

a3c0143211fab89bb4402895a286ed66370e0a6e
SHA256

32f4ac816d163927cba586113940ffbc5de2f60ef024f39cbf891f7393d9aba2
SHA512

0efc295eba75d8dab2fe7fb64d33d3acb0c614c5b41e1df947b17267017b2c3601eccb366c48338e75521fadb338102b621ce44985c261cfd7c1da1f152041b4
SSDEEP

384:zY8DkrqFOxjvzYbCw9mG6IKdXbo2QCQ7bxjvxzXJqXZzzd+Stiy:FDkrqoxzzY3Q5I2Xbo2Qn7bxzxzZqXNn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92FE7051-E050-11EE-A4DC-6EC9990C2B7A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002a9f32c4c5a5d766ef253fe3b106ad91f1bb59070cf04fadcd5c55c3cda55600000000000e8000000002000020000000c51bdcadb9155c77b815f115a86df50271d0a4918cc150850a0e1232348ea56e2000000017f1491bfc8a7907206ab6a506c437d139062d75ebf846fba6f1b87fcba5dcc84000000047e61c375a39afb995a4aaa12e7196e8b6d8a4747239e2677b9adae4768b5dacd36ee372bdac7e85f194b7e2bc04d85dd72a309c2ff1ea32c5592d623c3ae1f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416396598"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01e87675d74da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000571ef7a1d427a8eb4093fb468571368e2669ac3025f175319db5b0d1d241d89000000000e800000000200002000000045d2b556ba55588d3483179f1d5f9ff8be9b6a336a4421946954d3c5f9747e2f90000000b25d24f8d41740c1301902dde19a0c74bf46bc30a66f3e54ef4a072420ed639d5f27bc79fdb4401bed8969bdc9bd22d7d222cac4394f17b99db996e65f3629952f48a293dfa61a159b353341a6c896e81baacefa9ea99c4795d73fe570474db03cc840745ad22f619a42cddb210fc4ed48a6f8bc869027891fb90ef20959c71112e36016a1e169c76f6f3f52c5047c4e40000000014f6666877a95034282a532019580ed3a8f8e703b368a416d1dce5f16974c9d82d8ebe46813ff05b7a074989257175618151461f33223b3fd7ebc25fc1dd28e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2fe0218f6877d1c8d04af159cc0e0eb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139b13a03c41526020a513c399e16b7e

SHA1
5675c5e726e28bfb8e1c46f3f878ae802a2d32dc

SHA256
31d7d30dcfdc19e67bf92756e5cbb0d192c1ff8f8a9e2dc5f663d7828b5d9871

SHA512
0126b43953aca928d6fd1313d040aa0d1fc4165b42e86474a452ba656e3e207afb8321f83c4586775178f35f02f494e272a775e9badd3d46b3b6d4007624a55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f9bcce5b7723edd624b3c82456e9c74

SHA1
b9762a9d0d2352237dad058b5373de29db2d4c38

SHA256
b349ede6dc8a0a0d96d2ddb199acf311f6e476d426212a1577697ef662f048fd

SHA512
09f5f35b5aa78a51e9f046f4fb1f4d6f252cde84bc014969966b5fbe41a4b61ee7597a59583921bda1e8b72f1a1ae2c0a1b48bebc3ee54841f9602a843752452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b453ad2a7717b142eda0660b658402

SHA1
243ff07452839b597f7f171a68b651fb08735d03

SHA256
02843f51f1d61095aa246728036d0238580b0c87d86b102153e8ae61005e9781

SHA512
f4dd5b33390b5bd85d13e09c47ee14b189e2c9ca14f6fccc9332292bbea9e8bd063530c64494f46c9a163a39cf978003d346f01b6ae69396ea98ded6e1e71c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
296033de3022571b00ed05ce25a004ba

SHA1
04c845bbff2a71f56290c32603c58e16844a4d43

SHA256
61527cb9d002f1cc151d19e581dfd698cc935eb7f01ea522e3ac296c7bdececd

SHA512
a3d2690941f83acb1d52c5568c942aba60733ec22cda9c8aed4febce17c783f0c5fdaad1f2cc3484ae27e8cab5bc320bb2e04c9d1a40c983fcfef67bbd2cba74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a19b95ef456655504eff03e3412f7f

SHA1
46ce542bfce351e15c45ba92e821b30c7c5d2bec

SHA256
7587c6a694add2f59b8ab588b05ee607a34e669fcd33bc3d8fcbf92fe16cbcaf

SHA512
11df5f9c7501c41518ccc4a695eff3ad9fad977ac84a31117cae1d91d16715d9d252d85cdb1b513e0eb58344e3383d47d14ada46e716bff9d525dbe55ede2dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204e1203a9dd3e0c84a9417463a165f1

SHA1
d4f1be433c9a92102215f853fbbe1cb6d8259052

SHA256
3644929b148a61e049b3f75bb5254811e8ea5ca42cb3574db7eda08a67091c10

SHA512
78c62aae18fe560b7a9c572671f926e0c5b8beb347d4cbad05684b70d4f63525d50e0625c7ba745ada324032fbf70e024a19f0c34b3bc4155b80453625de13a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5821378b5cfc6ade3f08fbc20c64f26c

SHA1
b394dd3cca98b4694c3ccfce5f8c50ca77b73225

SHA256
c9e3c51b840eaf855112a5369acd608747615aba9e54906ce00642df98adf24f

SHA512
b96a089323d1eec38a1dd45926604cce400840664be51c9ddd1a89f59fcb7591957dd0131e2bd8e8bbd6ebb3b62fe7142561c17599da17d685d3e6d5c7787c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129295faef0d7a4f463fda1e95dbcf88

SHA1
d52fa7590f2fe47ecceedc19460df73b4f905f02

SHA256
c04cdbbadf2d8f04883e8896da47e3c2e8a792c21485391fffa10fbcedd77ae4

SHA512
56195ff56f03c2f9f15036a9e80e6481b7ed23c37ac2cb66bc635d0476706984c966296ab13e14e6133448bda35a40fdb96cb64f18115a898da7587b8c470490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53bcacf024daf12b594db1457087368f

SHA1
a4efb2d1dfa2a0cf71b237e9e76893cdb5ccc4d6

SHA256
fe219806ea9586a2db36f632d4b9e202c02ad9ffeb4a488e0004e5891ee9210d

SHA512
aedcca8f5a17d24054f115a8bc9ed05f4267569c7fe4c4dc8861978276ab8c47d54c10a9c71ce9a8020b75a0d763e796fa5c990dac06c64af90cc24ef50caaaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f8e95bc44ec09efd44d4fbbf5c5e794

SHA1
0c7f3f64fc3024d6565ffa78523732eb5b34b4bb

SHA256
83caf5599a68b09b8b3f8beb531ce8eea019d9d0191c1a6edd5ce5499eae07b7

SHA512
892ec7147c76fcd9d60c82dc15f556200f175d0cfc65ab08f7737085c8ea7b036ea63a9abbfb75e18f7f3c808db2b744ac6f5a45436bb66c11b76aef79075a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a7604839326b07f54c1264e22efc2be

SHA1
3a20f319d7876b1c517814f69aee9bb8c72e83f9

SHA256
7220f405e44a583cd55cbba0eb166ebc78b093c73651241bc55138628c1248ed

SHA512
4e934cc1310fad3c4778d77f8acbaf663b669965536a7046ca9daeada7398f0d1b5a49d6a2ed34d2a12c825a7618ae44e172db26896dfeb1f77237c2ddb5f4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dc88ce2f6600ab2dd3600a7bfacb46a

SHA1
fa9b156743f91b14f92ff5fa3bee8c32f1d6f2bb

SHA256
ac121aa5a05db369d17bdb28c99fdec3d033add1d7b0e80b74c087a8639dd99c

SHA512
5c5a8912466e605a56d7659766f0d20a6cb205c0ed590157c482ac17eee2ac688d41510a1ecf96e356046b162e849575bc2e8d446b6ca6ced7f93fe5dca5cba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d128388f6462b58756f513b0d4b139e2

SHA1
83ae436092d28db08ed9a9cddb9198feabe63062

SHA256
aa0507fd66adaccc6685e1d538c6424c5167271711297ec3b5cc8714c6b0f215

SHA512
bade1056956cfe7328783f6e22dd61b81932457dbca89321a49e63c795c42651fcccb0f910b1b00be3a4d75d32c5bddbff0dcdd2d6533f6a0895ab33d9966b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab403E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41A7.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41BC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit