f0200ac9d86b13e6a0b4e1c1cdebca163f3b1c44b05f57a08be37f38141f6d4e

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2eca5b7361e3d742673dfbc7b15acb1.html
Size

17KB
MD5

c2eca5b7361e3d742673dfbc7b15acb1
SHA1

64cb7189c03ecffaa8f3c1321a6da2fd39d43f98
SHA256

f0200ac9d86b13e6a0b4e1c1cdebca163f3b1c44b05f57a08be37f38141f6d4e
SHA512

452c8fd6f6f32faecfe6343239f3d8bace8e781e0372600d1be44bb2c04715708b1254270639a23820ec9da544e43755d065932b8bc76bafddd4481a2c50b015
SSDEEP

384:3IkiAiLo04kgmwpaU9jmeHpa4hV6uKbx4AZkzRzyY:3hiJLo04kgmwpaU9j/J/Au2xJoJyY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008bcf59a1bd07a5f3944b3e467863e07b78681734210cf0d220e164496471bdec000000000e800000000200002000000026ea9cc5d3b9ab4e5d8cee8d5bbd009cd09702cf4befe907e8500c10c944f19120000000fbb43975d1971be5680d9dc24f46947e7a5a053b9a9b28b3dd19d1145b84c3a340000000191739e04590edfc5d51a638cee6b2e136df5b06b72f92be34915b79194e334d5eb9bfa8dca171bd894114a040d8520d154ec063482e26640774475d2f1f7f1d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9028431f5874da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416394273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31861581-E04B-11EE-B20D-42D1C15895C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ee600de6b37ddcf635ff9dac887b2c5278669c20ce835726625c5c15bf85b03c000000000e800000000200002000000052f8d924d86f93a866ea69a13eefe64a44bc0fcd43caeaafcaf2094944218bf790000000e2d52b06ca81ad0333a44036aba1be902703b81abe900c9df7958f80034007ed371b9209b55b5d0157062a5f36db213838676051dbe00567eb1ef87a676740a63831b92f560a49b68b168e66bd41bd247661ae5140cc566222ecd29cb657afb1da553da1d5497ad36c7a2b137be663b51f97fa64e75f7fd15f4c1c127cbc09b50ad252437d7f6515e919d6f1c22818c3400000005752e316f81fa0336b92588ac84c391c22f61d1777bf74dccd085243bbad1a7d0bcfb9ee325947c39fcb705055eae793a2a52d81c46f6ada378deba9fdaadd38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2520	2972	iexplore.exe	28
PID 2972 wrote to memory of 2520	2972	iexplore.exe	28
PID 2972 wrote to memory of 2520	2972	iexplore.exe	28
PID 2972 wrote to memory of 2520	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2eca5b7361e3d742673dfbc7b15acb1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
412c0aa10491ac4272490aa779de1d45

SHA1
18f761712b25b118fb898e5e69bac45e3ebc2a9f

SHA256
32c490bb06d325e14eda6489c48a59c23069236da9877ee2dd94b885446568a3

SHA512
5500c7dadf31f5f64efd646fb73521c7f5c2bd069cbc87e38e94db75964fdf98b767fd007de8e992996c2e3d8ef25c81345ce83cdc6329c527349c7c4f1373d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d56f18cdedb6ef4cf28d53590049db

SHA1
c2f175fac2ea62874e1834f28d7fec55fd40148b

SHA256
5ddd0e81f2c6e3b29b690b75ed3869ca6c7f703f3f8f68cdbbf731ce66dc157d

SHA512
0c34a4450bd313bc862a618fdc697aa9490f159246672bca027410235d12522bf44f1ba31dad7fe9471ace9e1f305f4ea79fc86dcc07ace01100986d7f2f9305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78eb163a41e8f3b830d96c7d643464f6

SHA1
115e3ae2f9dff1a1b476967c47f9d72ef61f7db0

SHA256
250c3d274065ebc57a51b93f114a16ad73010995ebf476ec3e225c00273cda4e

SHA512
cdb9abe83af9be473ca021038017369bcb686b4f5a6bef1955d3a8cda18545ed2c12195910b62da10190886de30de96a33209ff3a8785b84ade3d5f485741607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3380f75ff0a0f76c24fd41c1e5e730a9

SHA1
7628e69ced0eacf1e5f928433fb02190d7f4ffb6

SHA256
75dd7c808fb9023fc3c4fa44e3c50ef76b534918ddcf8bcfebb7ee566960a42a

SHA512
a8773b17b2f8e29f42d0d8f8ccbc86ed8e2dd55dce82d24337dbf84eeb793904858ac45acdcda2926edb53c286075cfc35d0ad160edaea25f8e8a63ceedbb57b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b252920f8c71081f251b8a9cb5eb96

SHA1
5908be039d9815e99a8f1cd6d07994e2ec723a17

SHA256
0da996149419279e20618a1479b5f8ca39d9241dea4f27353168460ce323d797

SHA512
be773fcad5ffb289a71df842baf3f53bb55dd73718e0a2606f1928045ee527d206f99ed76f5c8a01af0e4ef8b585a702f8ce3b9fa342cf8ba9597cfabc19bd0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
955be4a61d434522d8378d8d4d92ffa5

SHA1
c7f4df4f50a6a1ad10c4b17f7a26f80c090f7454

SHA256
c29bc592a0de977f62776065a95d5b642a7a9707a336f1159e38d9f20b387aaf

SHA512
585686b9ba8c94be02115ba27dd81ec7baacd82a0e380501a0b2fdfb7ab9ba2a0726a35efc0034952371653be5300b36272c6d000f015c6b5ad9dc2609df2d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af1f3bb15e428fe7d1b88884fc4cb51

SHA1
d827bfc3db99f643b0536647f62541b16aff5880

SHA256
62acd7c848785ffd0c532ead8872a7d84deb49094064060668d9ed1d8b8116fd

SHA512
47fd57d754331d11a2d2397815d536a24ed93f43cec4aa496e40fc57821b66d8c267ea3dcc10ea5c5d0943b5d1fe6426d02560f674badeede30f360e26eee34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63a856e1b857f0f4277c16a10c24217d

SHA1
a287aefbc5b6a8438061361d4e7639b23fb120c5

SHA256
3b278a6b4c90f80c8142a4fd015eb760a147ffb0390e760bcc0abb445d5c11aa

SHA512
89b620a93aa29aebe57c00c448f5f3296059ea82fa85f2db69d3a60a59cdbdc8581693fdab00dafd472c187a4622e8a2eec78e39172fd1b05cb9aaa41d57912e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188c90dfdea2844e273bf646f59bd885

SHA1
bce01a925f924d9a723d7e55b0990c55799e2879

SHA256
38565abf15adc6d0f1b04006a7d676ec12d9b8e85f9263a9b061e00cb40e8db5

SHA512
7ef8d6edbba4a0a813ab793b79c759573606d256b173f0b11c7e3cd6687dcf976676140a3ed317705f5838ee6f4093a939ac21d4f178ab02cc8b81aa4d743e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14474a2e212b27de69eaf5bc481c7e92

SHA1
ab00845d7b15bec683d814be514802308ba54dc9

SHA256
fe2a53f959c46ca7457c8848777269f7dea3c249bf0c576c96446e167c6cfab3

SHA512
f058ca802b1f97d7df0d9741c41c714a0d6940b5a7cb20fee2d267c7b6b583c2f4962c679b66a39c2d104bc75ae7476c2b30a210f2dee3ab104e84e56af931d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA83.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD19.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit