c937c2e519072ffe691a2d96410ed966092675f6e381c21d92c2c3e1d9f64dfc

Analysis

max time kernel
140s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c320717a734a3be893426755bc05a037.html
Size

3KB
MD5

c320717a734a3be893426755bc05a037
SHA1

25d74debd7f5db0c6f7bffccc7111bc491dadf82
SHA256

c937c2e519072ffe691a2d96410ed966092675f6e381c21d92c2c3e1d9f64dfc
SHA512

fd4e25a3bf6629a420675ff20897692494cf34fe3781ed72f8ee1d7ec1ea50c893ce27657e875c4ac41a2f6c9ad023e73d1819b7a9a1a91f87b15b531ac80b8f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000010f3fbf4de24b33b2a2d4784f13e24fca5588227b3f2006bb09d64547c2dd77b000000000e800000000200002000000024929e29a50c5172381f603324c8dbd6d9f754ab40a27f9af95890ae7855135c20000000c4af454b40af3b8b40ad0c3203209c2dd34055030bbdb402ebcdb0bd0370ff444000000073293efaac1211a0fb046057f40d83d2c609e7a383435909c77b18752403dfefaaf5d457274390e884baadb556ca11afd6d9708ee6023dac34ef820ceff7f539	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416401065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c403d86774da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEE77461-E05A-11EE-8832-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000a1f8fba9c82456c2257ac4d5153dcfb92302ba12af4991f4cb4e1b23f9f3b36f000000000e8000000002000020000000c39ab4c1f1debcaf7b0abf6d99d9f05b9f67b829ee993a2a693046644139fee29000000097206d359c991df01ef733c765c3d09dff1a19bf0504eaae84ecf4c59d4f34e9b0724b6f0069feefa08aeb149d3bbf624f1f09bbb96b4bd77ee08b97efe55953da6c3c3261020875499356e7c4ae1bae52f5260f54639d4e0ce2765dfa07259e45ed91d80b4ed4a5c2a84af8ce3a95620fcc50c7d809c4069d97e65b93421a99f3696941df69b97263d81a43a8b3e2cf4000000040f67e3371e2c628ee1688c68facb636a6f937dcc69c5d1f4071b62b0c23d6eb86b41d0c513a0fe43467c986cfd9384453d163a3cacf4fe8c8f67091bbb5747e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1292	iexplore.exe
1292	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2500	1292	iexplore.exe	28
PID 1292 wrote to memory of 2500	1292	iexplore.exe	28
PID 1292 wrote to memory of 2500	1292	iexplore.exe	28
PID 1292 wrote to memory of 2500	1292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c320717a734a3be893426755bc05a037.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc0c100cd0338d516f15424c0c6199a

SHA1
852a32bda37aa98f2a6a9208161619f0e0ea2c39

SHA256
74bfd5bf561c37b8eb8bb4ed29c6a83649ee3581bcb69caf4ac27de61765899d

SHA512
017b2a53af0e6eef4cc72f350139f1854fd065e0a7239c40a10f7e341ec61360da36c160bad3c58b6b090a176fcd27e6d9354114bc080a3658b6ae1666b63102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd793b024758cbaeb7733c294259be9e

SHA1
318479cc8cb4e25c49976a1288118bc14049d6cc

SHA256
33fbfdd4fa8d6a7443995fb9b5d13bd53e8b2f58e3b2c618c323ef9a2719ef40

SHA512
fe864b371d03a7fe1901ff81958f0e69af17ada77c8142c3d01984bd404bdf11e73e9134feb9c02e46fa0e3763907f521132bfc91e0a64e3528fc928d3be7df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46bec9a7c694f346c00c2f2cfcb33995

SHA1
77eddfd715c5d26b26206f81465cd8962cea6733

SHA256
9883e21df71924bc2c69dbd02a81f0549981225470e0b4003f87849b5c097d3e

SHA512
c99a94fc49831e67896f0e0def8a64a8f603dea4b2a2a8080ffd02167142fd0329bafb1c0e1d23d40e8f1ada42f343d3c8e89cb75e20bf74ed734ff039b6c5d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855adc9ac6ec6d4ad0d5b3c4d1dba729

SHA1
26f1910944be76fdd3ce6abeab97044c7bc31938

SHA256
8084424956ab6a5c74fdfc463db404c566dbe8dda360450c54d08b9896db7a29

SHA512
3107df63db81372eaaafa40b2f04daf96f20dacf4723c1e979a4fd0254dbb7c8ccb6d77f378bf9863d197315cfa9b463c3349bb5dcf669292018fc0981ea9105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e494c112c228d380c52d218e55a3f1

SHA1
71ae81dfd3b1dfa9c7f9d65072b136791d9cb4a5

SHA256
d22b567e35c5072951469abb03212faba4cef139e093545ff1a62c606bad905c

SHA512
5355419dc5140fda1696d101877075c09560131c00790fbd1fbc39c623e111abdeadeb6dc579ffe5568e671ef78ae2e283f0750170f43cdfd75ceea82c02e6c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de67c33a8ee9d1da6d7bd9da26b466fd

SHA1
527e20ed55da00f8a653f0ee319040b539d733d7

SHA256
fa702e696a8221d4f3a44946a8df136b00002e3d755b5ce454bbf6833800d55f

SHA512
701b99ba8b3a4e4ebe2c4903a4b335b5c28dfe288445947293da8c02a1c62bdd596a4ed0a5cdf5ecbb667ba8b36455a4288d22f516ce9738de29b2e72b68e9a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8259fb5df43748e091793be7d100c92

SHA1
4aaa867b0d64b26ee1cf13947c5cca14c4ef5318

SHA256
db3763fa34d86a49fbf7d58192dfd23fdd1277fc3b30b6238c3211b0caf55910

SHA512
57986121ad175b4bc5ee705f40d8445be6391ad9276963c2001d4b06e7f3e57466fa89771162a8428c53f601f841ca5495dafe0d55366f1553811eb22a1285a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee7727dbb2f09e83def771dbb16e410a

SHA1
f5e661fd6772f5f67f6658c63cf7bd4f388fc668

SHA256
dfc5d0463e9215937a13875a46c845bfca86ab8445060475e443f09a0961b960

SHA512
886a77b819fdfad2a49a328c72a34cac75736122a6a75686dae61a6b78ff8c92f53df0131ab4eb9c5d9eb8051a35d7494de8dd18f75e4d1c2539dbb00218cc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f676acdc2167c355039df4e3867883

SHA1
ae9de7005c69d0432be2a3c0d16956d1ce025b99

SHA256
26576c830f3091a5aff314e3d13c699ea162b5e1955c8bf77f3b1a2a2749e0e2

SHA512
56e0ab37395e44a577f89d11a217e4c1fcf7971ebcc0db0789e89f762e44165d863c3c2ee469f72e784890639f7a3b431a3c8c6853dff230767412b7997f1282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6abeec6dbfcc193b02214dad6a9cfbce

SHA1
d32fd6ea2da28354b2deaf075214e0cbe9c5d268

SHA256
2cac9bfaa32325bb3aa3d74d24c9c817c9ca4c4d6cbd4eafb9184b6062456800

SHA512
de13569cb8eba59e00370bc050cd71b0e47ddc9eb5d18865d8809c342c23ebcdcd8cbd580bfd9e545f2793f98d25e858732431ae08501553289a16ee2eb8cd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a01ee961d7a052f8a8516eb4182ca81

SHA1
c2cd0e466e9a7d49f095ef6273e6c5afc9693a66

SHA256
70811055fd5cc68437785a54e45588c2a0ec1e484314c15f5c3b60e0f1e0b8ac

SHA512
e9b539279f8528f22656e48aa6f3e48f8a79ecca914955040fb1b152cb9120b148ae22b8e51dfeffb5e11e3e261d3cc56f9cecc56671871e531451029b7d733b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
183f224675d68d839084a0c90b0033aa

SHA1
15ab0ed55b15534985b3eac41b98597c24bc918d

SHA256
a671d8235e3df8d00672609c6b759962d8332f1e69ecc08639efea67d0bb16ab

SHA512
9e0332f01ebe3880f84971c911de6f77548272841967143441b22957387928a7b7433083b1b4a801af3d1558cb3111789590bc99a9ba542acb0969e19942fa6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
815b08fe19ec1133ce52f4653e41a1f2

SHA1
829286c95cd72fe651c3c1c89962c032c5a44b6b

SHA256
2cb8f8397271bb91c56ba208b39ebc9e00434803e1a2fdee9f29b72eb79587ce

SHA512
ca991f6934bdd67ca500c75c0e409e607f37cdc89f11707a1016908010477e28915969c1d1ea98c600d1065c8e36da7864b1f9f95cf00fa6673ec8b233809fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b1a7d9ec0849a6e7274d2639826ae4b

SHA1
ca1f60bbb43a456912bd9e6e8c34b225ca60d305

SHA256
0b91f83ed92d78ebbddcb593bc4f69cdfc109e59974c49650982f08618018b8d

SHA512
5f4be09ec933c411d97fc192637aa2270b6c907d66cef42845253338ac25e6f36a4c42929f574b230898c0a4a5d857633b4b51d86efaa840010a5cfe9e793810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d5a4a2ead1bdba657db88625d1157a7

SHA1
508bc9c6e64391c8fb3f5751b3e28f2bada36c2d

SHA256
aeb52285630f8121eaa1d218ea90590a8a81d51f60860df262df8499bb23f44e

SHA512
0b9cc8c567942040a4717c38f18518231eba7a57fced66cd8f1f11af937c38aff90b03dd64de4f9797df59fdf526006e208db50732fcbb70ef1dc6f64354ee87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82CF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit