214a02a97ba6d1cf5008268b67d3d9095d92d2c7880a5f675502fb1ca9a5bf9c

Analysis

max time kernel
122s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4036f9b270cca992de433be70c01c52.html
Size

1KB
MD5

c4036f9b270cca992de433be70c01c52
SHA1

0cb42f06cb17a89947a7dca03512462766eb0961
SHA256

214a02a97ba6d1cf5008268b67d3d9095d92d2c7880a5f675502fb1ca9a5bf9c
SHA512

21c2f45bf8cc7f7ad695a2f3c2dc7db8378f2a0e56af05cd1bcec15eebd1b6f93f1c261133455d4e161836a1517a602539944ec718ab6cd885c71a37716a729a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001b7f62556dd6ca1383a86782c1b294da4b94c200b118bd06055a01275fbbe289000000000e80000000020000200000002c38ab536b41fdfacc568150f84d1a2b301d681db46489500e5549f08e736f4b2000000019e3abba3c93d69e72f0944280417c81e58e99f21f62b7393bcbd3675c1d4679400000009c7010dc7758a43bf0ef3999679fdabe3219dc951be56fe33c25fab2090d86881c0f21cc836e354bf0b6b13fffe34f2a74b5a425d2159c8b09343cfd2bf3ff9d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416428685"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e22b324667063bc83469f553bfdcc20514592cb5fec8dd5b753fde6eaea58c6e000000000e8000000002000020000000a7b7d95d7b9cfe26223c9812bd36dece9b42075d92f176c786ab3a109ecc337990000000250bf8ce01087373cbe67c597454363b0fd43e1b3a8836cc36f4f1d043ed9044462e724728176881b521bf3155d14be7102c54c2bc23bdce380ac2e0bae8a666e975e68b5d688e225fb1def297770ef02b2edbce4b3b738756537d82295c116e1117fa6fd654a7a5298509d956b004880ba9aa4e42859ea2e770f15abd4e0706ab269ddb0074dc8114677f95b2d324a5400000007b7b1635ad64906fd4edc24199871a0e123d20c190c24e74858bf3f8cb79acfbf29b4a232aabe2fac7366fbaa45ac75e0e8f5fb7371b359a6a6e9daf07894eeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0004d208a874da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{455C1781-E09B-11EE-8FBA-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2968	1876	iexplore.exe	28
PID 1876 wrote to memory of 2968	1876	iexplore.exe	28
PID 1876 wrote to memory of 2968	1876	iexplore.exe	28
PID 1876 wrote to memory of 2968	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4036f9b270cca992de433be70c01c52.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d907800e5f390c4753c6d34fb9d0d7a

SHA1
0de2bb81cc1cdc3e73b87d038ce5a54da9ff31cc

SHA256
58ce1825ba316c2f07e2e5aa21f2747b97621f91d34e68b23790d3063d784ea9

SHA512
24c3c26c5227b380c9c2078d0ae4175053a4e6be728029c2ad99402c71219bee6cea85e40c442899d86fd29cb7e3cfb661e7ef53ab5033fa245299671013051a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb802d0b62c6cb473f210631951609c9

SHA1
b1ed534a194e1cf34e4487cf6dd3508fa3ca28d5

SHA256
b254434ec1c4a3436c37ac09c533f05ef3b49eb7704a8b5c13496fe985ac8a18

SHA512
67bfa5a5f201dda1299890ab791ba927d621034338b98640c5729a74e49db56ae9a46746b34a272c5945aa6d0f4eb2f1dab84d68ad7f391e43e264ceda397673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ed1926c946fab9ba72322dbe612aa0

SHA1
e1cea7c2222a52c0da8bbdb1b66728552a679543

SHA256
66540438690142905cb88b88045bb28521fe4a71cb49069af8e5c0e364d18127

SHA512
eb84dde4c21889de40f778ef73d9c2bb15951e2b713388e4cdbe7786489114a9bbdba0dfa53dea9d274c625d26d7b896337c20e432549666315e1bcb7f1ea708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4523b66a2c61f1194fbbe7d6c5fc14

SHA1
c7f888652def5bf4ce98b0c3cf5663ac39c263da

SHA256
4175d41c0c092118a7aaed60ca8f085b0d489d0531405a2006dd38797ded4fa0

SHA512
f655935df35a1ae3585441e73844b8277c5eb82097e143f8c8a13e192abc1c62dbf881972753a347bd998a7d492397089c8c9f9908fddc77c18977e81d943ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b5f7d31b69f5cf4496e8b4f0106b2f

SHA1
365b70b1b485bde6a8e9bc43c4d6a5f52579b67a

SHA256
8cb898548f8ccc639e077afbd519dca4a1a16ec76dd21f5c16db4dbbdfbb12c9

SHA512
3d09321e68e9b5c43a9585e60b1c2a8de4c17e04cc3ca09ea59130b5e489c06465840142e1c7fd16c94ac330a9da5035833f280d4b18de342e56acad6f4a8732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a0aac72dcf9b9a15ada5ecb2c5aa274

SHA1
9b9db7b90fbde3bc399f7db09d2af4f15f1a9a1a

SHA256
379e24c85232ff313a651d654857e21613051fed087f80aec15fb1dd5d96d57d

SHA512
11850872a10eb3dfd00b2cc58b87ae7e2ed403d665b32cd7ef123239c1bf2644b338f0b8dfb01cf931ff8bc7a177442583d3d2cf70ef8fe7bb6e517fac18e80c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3404.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit