f251545b55289a0c9e620b1fc3ce16d97f29fb16a0e04311db26be440aa18046

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39c12d6b7acaab5a94afbc38c298441.html
Size

24KB
MD5

c39c12d6b7acaab5a94afbc38c298441
SHA1

323084b011739ed314cc3eaa1c330da93d1b759b
SHA256

f251545b55289a0c9e620b1fc3ce16d97f29fb16a0e04311db26be440aa18046
SHA512

f68f4d9a9e661ea143b7c8db945c4658fa31daa9f76f4b1d060d4e5d53c0a057196f8555677eaaa9853f7efe3b475db5c687bb03cc9ffac4cbda007bcc1e77b4
SSDEEP

192:uwTBb5nEHeenQjxn5Q/mnQiedNn/nQOkEntiPEnQTbnNnQoGLnLnQt9qMB9qnYnw:5Q/yGSKp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701ebb628a74da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002b93391a779385c04a5217269edfc932f80ee783fcf78926d620c6f8af4fb274000000000e8000000002000020000000250c2888a02683068ad7c437c29a177f8fc005eb50be6cbd532e8dcb45f15b4690000000c90af4a0fa2456666a9c4bd478e2f3099215c16917d8be8b23103d10152439203dc2cbcac8ce91e783317d4fbbdaeccde1de9008fd3f26f4e96c6bd128cdcb648e478d4c9b30c2a06949d80b422ca08842ea6907e8dbad9c25dbc5a6bf5cc884e82083b4677901ea55cc7d7edcfe2a50d9cd9fc5473c37e88c4b7990057827af9436bfb93cb41fdf1f8a07b374fedb3c400000002ad57ef61b5aecdc1109167a5c23128d4d12755da853827f93056f1a7540c265e5086fffff849e9815a754c97da4b485aa59c65c41a61926e4a658262df31feb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416415907"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002d6c78278800ad0d114c2a6762df906882241660730adc59fd7e8fe522655029000000000e8000000002000020000000dc2ff7e9808e88d4d777bbaf69f103df3a481d015c7ccdf1d2e6b0c24a09bd8d2000000008712ce7fc97e7080a47e9c7d8b7b8fb8db594c40920ff9807c161abf2c2040140000000bb4f91fb4791693348a321a4f6b7eb85b0a93641a14498f5fcf3214b18e85c6218686f14e937663b77bbb76ea83db00e8bbf3f8eb9872183f9bb119c16b081c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DFF03D1-E07D-11EE-B012-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
340	iexplore.exe
340	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2908	340	iexplore.exe	28
PID 340 wrote to memory of 2908	340	iexplore.exe	28
PID 340 wrote to memory of 2908	340	iexplore.exe	28
PID 340 wrote to memory of 2908	340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c39c12d6b7acaab5a94afbc38c298441.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23bd6f6b10a532f1c28637501b3d0fc4

SHA1
450d63a1e4652965eef49c61dfddcf8b757e13b3

SHA256
ac96c32d07895897c9a4218fff214e6f16cfbf05fa8d8a9986a4744fe32475a4

SHA512
a874a14d890796a8cfc2f3bb64fc7b02685400d918b4b37068996b0c6546cb2108238a21a30fa4c898d7ef7b95067fb2f320788dfe88f57bd67d836cbc9be1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd6768d1686396418ede88541f6f7daa

SHA1
c21a21299b1c30fad01193a78630c51fce5fa3ab

SHA256
3ed73ae42ab57b6ddaca5b1d46610326248c69ed9b08af09b7402ad240ad140e

SHA512
9527c6de91febb9d02b3e7e555669daf15a1b34888b119455c9e4d30e59b2b478b9c03cb89766607671f625118f53fcc693d1e129bc4dbda0237d9985d35d6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b7b5a8602cf241c09a62d3c7486d710

SHA1
d28b431a064867d3c49bcefaa28c36cda84d45b3

SHA256
91d2afebb953fef50dcf145f691237434e93e3a27581f364bae752079e1f9bd1

SHA512
bc4563786deb7b81c9a554931f2dfc4f58602bce778461f34affc6f92742b1e27ef6e75e1dcc8faad47fbb4be282a5d228c8bbaea3ae4ccd748f5e0b17be2595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9583a234d0b5fcec051d814772d00e

SHA1
f12436e71203658be3e8b2e94c44ef77caeaea5f

SHA256
ade97f648088c60c4fe0beb8f225499d36075911595ac4e23567dce451e17efd

SHA512
5e4be132f693c21c6de43b3c4b64d6406d6a6fe60c37cf1a2ef300e6249db2e27eb283153522e4decc1dc78c562f0c4c5b89c4b482eb45995828dbf6cbc14e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dbb174b4beb62c899d496e10934a7b0

SHA1
96666c2ca2e4b6f8d1b602389f380bfafada8314

SHA256
75b97714d64c6ecaf40ed6812b9416e5b6c42c337dcc650830592c953ab102e6

SHA512
0fc2bf71bc1982a180d75fc200404e15e4257ed3b2940a998af2b7e5ccef8ebbc3903d09488a62f9b014311bf2c05f5a03013add95897b91d0b4d7aa578eb452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5da8af8715dd866b1b6c08d90f8b80d

SHA1
9cce263068b9729fa191f066b6f7786ae7b2d961

SHA256
848abff83930a0070d54b6c4c459b4686a2c006c63fd9757d3009b851022ea0e

SHA512
1e4ef4dff849ef56de85768db37df5eb3f560fdfc531f4af30c2dd5b9ea0dfa9b6641456c1cea0813b0fcf26f4721bad4b4e436beac45743d02342680fd40dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d95ea6185ac4639c42d6c75dc43371

SHA1
da5bcd68c0b0228579c762d686c7e83afb48b855

SHA256
b77bf5eae49b5d11c6263e3bb939a8030a14ef22de1eb3d9e1d18f5b477a97a2

SHA512
fc7bc7834c5875fc7d8b5d585ad28cf795fb5732aa990f06806b2c38ba2a2f0ad112bb0c2daa8babb55ab25ff0d479c8012a39d026709635f096fb728c04efd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db6f13b7058870248e513a3a6f0563c7

SHA1
d2aba8b8da8c8f3a5e68b58705238b985293fbfa

SHA256
7fdb98941c3a90d5655fec19add678013e76975f0d8e16136ece2643d4870231

SHA512
3715ffb9eb43eb591d9fbc2fc5d4d07e7639aceea01cdf57e9220521b90efd2a1b8e652dc5461160aaafeef07e5ca93ca1ca65cf84600f74f8243b6ae54bc011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af30211991f7ba5cdf775c9360fef1a

SHA1
06f0610db22b52f2b299aa054919764548950373

SHA256
9f485ddf513b359635f8ebf50b3604be3e737d0e1612efe0007773528c134a92

SHA512
b804b34148400b12ce4c76e6104afe4d3606dd3dc7aadcf010bcaccfe64bb0afe1d5368dd57e21f3cb37e95e90c1d3ab2749733305dd57551341bd985434ed1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a1a052a18f50c4bc2a1aa0a025b43c

SHA1
426fa9fde9382fb32fbfb045a27adeb733df710d

SHA256
ef855f5c215d0b7abf7f9f6e485c72d29ced9ec1cb4d7c8409b0f188ef7f65e6

SHA512
175f62925b6a57e9bcf35bbf84610a4bfb1996f0447c653136cbc37f61bc2f08366d6dbbb6a5a9091da330076d758050372a2889a4522a0e334a733ce1ffbbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2629.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27D6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit