d4b30c1f2c1f10f46037533e5768b6abba1f60a613e779d871c21abe8ef02d48

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/web/index.html
Size

3KB
MD5

d6cab7cc7bde2509cc6ead43eeebfa04
SHA1

d0260424df4bb8bedef2b01289309dc9c2c0e1a0
SHA256

1a1d929676dadb553bc7507efbcaf00a83eee065f65025f5f4f410f5c18cc193
SHA512

eec2bd822395e29e7c51b814e619c56b9aaa5c2a3a4e38a186e733cb9a733d3672f86318bdd357ddbb480d1ab267dbaa1a04721ea51693d5962d842185916c20

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000035679c9a9605ca80b2f1091c829290dcf2473c1d8c96a53cb2deb02bca576179000000000e80000000020000200000003611e1631e2fd8d584f662c79e33f6a04a4e39744edc05a37b3eaa369f484c6790000000f58da1e928057908041cd3269c6d5f8ecd876dc6a0548ace343743d97b2563ae2bd7ab4996c81b99eb9f60a71ebbfe2fed9231017b4371df5d3a16d843f4e3cf195952b408a714bbb803deeba611db34b7ea8ebc90685772ae5e3336dc81a27802f46cf3004d84ea2b07177ac4ebe11bfe7b4bf8c48634e40d907d906c10451e566d69cd2911736dcb61c1d6abff077d40000000570fe7f9f8f502003105c54c25ab074567a6d81af384205f8b2e72f9ec96df74f18bab3e5bf03d4768dc8b26614bd958c551ef93c42a30f2c81b4a9e5afe2bfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0697bb5b775da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008de57f55e8ba2722b93bd356324a408671f09699663d0b7489760fbd192193ac000000000e80000000020000200000007f863a1af68ebf381a20a10f22dc7cef4c9908463f32132cc8ed2fd78006c70d20000000604c105eadd5d73d30829d368e34010e5ab9ade906f6ef5fd9f861ce63d0353740000000ad466c50292f608120b56370dc17948531edff7ccd8ca94cedf70e56f1213905631106c583bc13f88aaa33e1a56033401760a4eb987f78edbd51f466d4842628	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0DDE341-E1AA-11EE-805C-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416545321"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2804	1696	iexplore.exe	28
PID 1696 wrote to memory of 2804	1696	iexplore.exe	28
PID 1696 wrote to memory of 2804	1696	iexplore.exe	28
PID 1696 wrote to memory of 2804	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\assets\web\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91f333eba346ce4b68a077b84341d222

SHA1
ad8b57ad1c3632a40b9df24969bc1297cac57e7e

SHA256
ae2aee1be5478b7f1a62c3e213d91b87449c78b62138acc6005981050676e6d9

SHA512
f202367ead2dba9e2abf83245f6e19feef1e25980608089654f220f3b84a902af81b3272b274df6a616b552a8f087a31e0d68dd23a0dc73980069252ec910768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7588e8867900b8607029e3cb0f041cf

SHA1
d5d4bd1b19b36744ea6aa85a30943769628808b7

SHA256
7489c970f39e76ac576e878be59ac2fc419942730571b82d09c8661e02137890

SHA512
eabc388aead7cfc9dbcdbc611af8cac52fdd03dbed8c0e5592505296415dae373b74ec49f8e572a3d626f15975b52613f701b0def47a1da548f54ae635e66e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b97aa32bbbfc32d9b4b041dbcdf7ec61

SHA1
292e992ced2c9b69362a4b8d0c57a5bd88a6fbd0

SHA256
b4128332915d5ff43ed256925119af1ab997dfd03e801d5b626ee096d8e70e16

SHA512
c3921a2aeed0d902dad4e8d9beab1796f375835b23542000984b48e409dc7d574e6eb514dcbdf3a97bcf1e6550f699e16c6e09ed0ff6e4cbb5cd5f1262dd30ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05fa8f167838d8d9c25aea8a2f3247df

SHA1
36b6b3bb4126e89ff22643e41b418aee459a9bc9

SHA256
e8dab9516160e270b2c05bc2f56433211da45e59284f95eb5df0c78b30747319

SHA512
3a41dd045e68f94bf7985fab5b83a48d3fedd4f60254be4fbb6386de583250236d630572ffa06f412c2bb41dc7a4ada957bdfbc7434d523e7e588a38f884a358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943cb3bcf273a308c1c5ed43c8a6ae51

SHA1
4e2d19943471eafc2e9efefaab1ea476d0b0fd0b

SHA256
a0503133324cc06e651ff2080f024f0b3f04d9e2571272062105c99eab48db34

SHA512
9e94e216b3539eff2f2d04acaff3d3acf378b5356f89d2e285f1e4e30022a71c77fed5ee6643f395179f41940a25462b310b68babb9e40ad4b3d2f1ec62b006b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1c8ab74ecad4c79785c9093e3b765e

SHA1
0706ab3680a4bee990f2b45d66f40504d79e6c81

SHA256
9e07b959a8350ee26f86e4163ade5b5d7444d5313d629c919362c9304825b525

SHA512
d73b1c809fa7ed87b29685fe95c30ed9d48edacfee241faa2090d960111838c9355a4baead1f42fa8bf7526982e59f72d12f7ea767800de205527aaaa02ac497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b844e66268a0648940cf15031490d83

SHA1
ece00eabdc77156a8704991b3cc26b23920431c9

SHA256
b281dec9aaf800396d4e3d06ae0b5c17f3a3aec1bb1aef02b27ce539c70fa204

SHA512
a5cac332f3594abd0dfe0325b38c1d20fc16f5b8c08fb568eb46b25b1ef3789d5a647be84f4619c7117d0282ee8e4870efaa7676a9f303ba0767ab6cf0214816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7b4cb4bc3809f515a837d0adf1037c0

SHA1
f49e0ca9abf40c1bd4189ab35b4dd4c05f67acee

SHA256
ea9723f7ca897335541e599ce280cb4f00958f85129a64e46c1402a00665793d

SHA512
a885d85d8d2b25be43e7be22320ced093b914f47b3bf8b9bdbe546ad5761370c7195d2c6b00fc1764185855699ced75a4938cd2510d4cb779b23b1230bf1d277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fef49e3d4cdf686dd17b29a94b0378a

SHA1
d7908fb7bea6e0bdc2edcd0edf22b0f6ea2fa63f

SHA256
5cfeddacd919bf771b7325ced1caec9390d8cf46c40b007fe67d771f50d1f701

SHA512
c55bfc05bd9da984057ef9fc63543c24b148b8f9e9a11ec05ac3f696082e6d3fb9be910fbcdf4258aab09aa54ca3f8838e75da4a710558d139418b774ce11e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17247b86dcadf66b6fb004a94d26528c

SHA1
2abd031b87f29fda1a09c2c1537fc5f9ee14749e

SHA256
c697af68882e46ae42b3bc2c16afa02c5c4f0d9ae5f0971b41c1f22dd0657d7a

SHA512
2c6c9dc0c765037b1620588ae35319c60c9224817a1fc1a25fe693d96df0015df2a8ba85e7f0bdd5a6a16b9b83d7f0b9a4acaf7d8e07a3223fc1884d9d003f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83aa502378e3cf58dd84fc8bc7292b2d

SHA1
278ff96b84d4d8646df513e287f8a81b6fa7a145

SHA256
6055fe5b07ea4e6972288862b5a54f86eb4272cdb46b855c2b27f7757d44836a

SHA512
889c17728bd44b7441a96763cf6c9fc92a1498eccfd6aca6841ef1b3d08d4ae0e9f5c212e6c4e824b4604f57eff682700b4b1c1c844372bbcee6e49ee9a99013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de627f35ce149ce9075b11ba7495e534

SHA1
1ee4107eda1f698af5f2d467423490c657472637

SHA256
b020e132220c7f643e86216b0b430362ba987fde3a8eea112c649cb9b35e86ae

SHA512
b9667b6712af7102269b043c832765870c8dfb86281a8cd72d4f3039bf50496a4f638248c535a53555ea6c7b082c5c80680dee6a958f14745a0ab6e3a07bffcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcfb9799d92d26d443d44d2bdc4e103f

SHA1
cfb73fc2946cdfeb444c7754e639fe3940e57035

SHA256
bdc69213d0a6dc76bf4d298f3a7cb598e8815592782d574c221baedc416b689b

SHA512
5ef0d1d7f5b8c0fc448c74ac78bcb20974da11ead71bc8b74019f8ae16ba1f83c12a7bdcbe2c10990d9c0a518b6e6e48b5c60cc2d016501a34af3f9ab0ff5f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f36b654a5bdc87825f9723ca5b3d1ec

SHA1
50f9fd56e8ef01db34f0a083b7995bc9aa02ee06

SHA256
ebd1a7deccc12de7f29485c2023c17310f5bf2d311daeb665e0e59b2d280f3ad

SHA512
6aef634db474f2d3c92380d919583afaf4f3016403c1716e2f0aa30b2a7243eb1344bbe68513498986434ec6740ae46b459087a8397ae4efa42ebbaa57855a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B20.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit