e1d71a02dbd81cfe9b784a3206b2c7eb1de8f7489b198a78a231b6014e799a35

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7273563593c026a9bd3e6835f27d4e0.html
Size

56KB
MD5

c7273563593c026a9bd3e6835f27d4e0
SHA1

4f62f2db4fb44b2fbd99a66631b7f4a64d7cb055
SHA256

e1d71a02dbd81cfe9b784a3206b2c7eb1de8f7489b198a78a231b6014e799a35
SHA512

ba84f5db24bd55f2c64dcb0e2b559eed40893b459ed942b7390620615c0c1d56d041d481ff4f1057f359a8717ac13b915335de703b8483f0c1d5068854b6f1f7
SSDEEP

768:Zcd9QZBC7mOdMYNpC5I9nC4J0obKVi/HU18Pd:gQZBCCOdJ0IxCG1x/48Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E910AE1-E194-11EE-9F01-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003d2dd569107846c5383f52c4e551fda984487245d61fb878df314d087a4f9f41000000000e8000000002000020000000f8053661f3bc3e04a744fdca26103913f58ab27276a483e22049ad3e63c96c9c900000007ac1ce6af20d73cb2cdf3ecfdb915432545becf8e296adf9d06abc7e47bd62760395035579d616d73f9c839680c005cf4cab39cfce7ca78b2d1cf5a4361d4fa224cc337c7796c3daefceb1826f3f82a73f4a5f5333c95fad77cb12d9b7ace575508e54857d5e1c1fb621551225d204ad2136d9ec8542e533774d51d743b0cdc9fba2b4715d8b6f32b4eb138dbf1a0c2b4000000042daafddda7d4d6e3f7d6b81a417370f99590fd9e21a89ea68604cfcbf02884641b5918529a4dc5f96aa5a6c024a6d24d91116fcb852e994a5564523e19dd9f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000da7daddc12c5e3b102063645bf475b8950fb136917931e2459e718bc3433cb63000000000e8000000002000020000000951dbca59f17d0f7d3a0484cdf0f7e8108a5f902b573f03d11b50ef485b594df200000004c3b886e6b3c84bfa4710f83a23a9e2a2587c6860451c4b6faf9adcb33ec136c400000006b3a2b77013f4b5d86c61607abaa8af2dad8e837dc5e0a6524d308abdcb0c4d5dbae212f4ecccfee3f4587d95e82619918663b0d61d0b3a08b70a1df93a86186	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416535524"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dc27e6a075da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2868	2748	iexplore.exe	28
PID 2748 wrote to memory of 2868	2748	iexplore.exe	28
PID 2748 wrote to memory of 2868	2748	iexplore.exe	28
PID 2748 wrote to memory of 2868	2748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7273563593c026a9bd3e6835f27d4e0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea372705372cdecd00557db1d1fa4006

SHA1
8a25964667e3012ce7d7959b01d2ea03f93423b1

SHA256
1667644ccc04dc02a1828da78679ea3d953c0423fcaf7c11e133b615251ac049

SHA512
5b2f4d6fd484c5a57e1d92137a75e9af1ee9ea1c0b0d926ab13a5a7431d59e7ef3d39b0d1604eebb26c75041eb96b54724b3ae3a91c5761fd1dfe15a692c6ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67091169467e2426e85c48e30651c9aa

SHA1
45eea4624142b486e5ab66dd6ea1eb200bb33452

SHA256
fa4d43f7999ac7f288b0c8f14b7d563471680c88eda9ad992e9cde80e90adcb1

SHA512
c25245cecfaa6426db5f3a62514c468ca433bb952e5a9f9f3fa1c4d431da514c7e0c2a49df44b684631c7270f8592b377f5a02c7f1dcda0583bf859b2213088e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8270b462e585da8d693bb23ed5e5840

SHA1
14bdf1de1a7832d2283c5e6a9750743c110ead28

SHA256
fcee179fd077f24a6b09dfdcc49d797de8366dd20947da78d64d169f1ccbaf3a

SHA512
50b609a8a4bb28b2fe66692e1fc8aff6b2c115a08500acb6d3365c5b389f7ddb03e170fa390a0b7fc5bb424a80191b9d9c5841cb6ec9d1d86edef6b78a7a36fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e3e604e93fec6f35ba32a47a50e55e2

SHA1
6b356fbfeefeb57a062d92053104670025c4bd99

SHA256
302d0620511fe763bfe4baee8631caf465177562c17833b4c6d3c4161f85808a

SHA512
b404afd548a211e3321cc4c117b5b323b03efc8528d3eeee1e5752da8ed149a0e9796eae4f393f8ecda0d5231a463e3c99155da49896a309dccc939c53c97cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132b28ec8c1836a696081a55f5ee0fa5

SHA1
385882eb9d75105f266200f607e588406c655ae7

SHA256
54fcf843e776a0007cb45427ed53c2ef049c03b62997acafa5a548a122ecdadd

SHA512
111ab1187af313f7ad750b83f277eccffd71cf3ad1cd74f25feb1193b5796fbfbdc515d4b5b8689ee58b8dc9b578e025190f761bd9dcd9423d990a8bfd734ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b11c5323637fb1119913415701e1771

SHA1
06491ee0348fbb4e79994a0b9ceed5de1ce2196a

SHA256
e92facf0b6120912a83dec55066300cc899fa6dddd63350104414b1c5924ea1e

SHA512
f28893ac8a112de2983b271b34b6781aef9ad7ee86733eebf5af1bb60075aa6ece8aed464f7358a2ccf5e2277c6a8540fd4e4a5abf0ed2def0d646c3888054d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a00b04b30e7297a6a86e2453df0d5262

SHA1
2bef768183ddaaa4432a8ff53df63bdf730f44c4

SHA256
ec05a9059e76ce2ac232d679c4e467b86caadb9b30457de56d9b9607b682b778

SHA512
728daf4c704a96caf6fc4c9feaadd92e4012f028539a39d7b2614e1cf42eae7e036752245a800e5a3f9ad878465866e28adf809bceaa499e7160fdec1af2bdae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdfef547a5c6d50edca2908aabc474c2

SHA1
21c55daa0aa1e851e44468a46c4ea0be9bedbc90

SHA256
2fd54559d9f359d71fac129d5bc9a3668de8292fee7aa4f6ca0e53adaec32557

SHA512
014d7fcf65f2a5aae05c1ebba32d5898e36ffe5a4825cf6c3980def3d4ff9a024126170b4a45057ede2acf071c4f8553643dc7e93b8f81acd3cf0aff8cde7456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9af405321282e0ee9e71d4252ff7cf4

SHA1
a675b26c46e8ea9988ee15a27174bde691e17d46

SHA256
dbc3acd090745fffdfbb6d02bed7ab77fe6bd623babf32933ea62837c24dec4d

SHA512
81ec5d2a8ec607b17dac28e830c121530a65d6141255b7232cb51059c3de1a42e8ce0f55de257296b128277b64f009b73677a2583af2af2009a0a4c3e709ed4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc020bcbc91999b31cabb94117cad4f

SHA1
41e8a86302830ac78be2c4ea8d58755641ccb346

SHA256
52154ff638a5fb6e299b6911ab64f5ea63bacb7c7af6816ad6c99a66d3792bc6

SHA512
ccd7358de33e0acba775fd64b3a38179470ab4efc5132a7818a97508971da4a97b84963aa04ed075b55540d9613a74aa4340f4b80d9319fb5026c5998695883b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a82532e2b087e35e3446c1c8ebe005a7

SHA1
a10ea255c687b596493e1f4aa13517ce1a0ea815

SHA256
c5ac7b80fd13a75fb5a90a3d5880bb0f429163a4809aa3ccaad62bb199df3d35

SHA512
d79a0df25491fc2c93db683801079cc3040fe717b4351272b250ece930950fd08cdb69111752ab65e3d1af97ffe1f14b845ea1ec30a30ead8e3dae7993c173c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3735bfb67eaad4f4c527a6a1675380e

SHA1
2d8329e52a5afe415e2979eded2dc695e404ffb3

SHA256
5b5584c2f5189a6040d975faf89ffc5d8184a1477fc52b78b27d972fb24dfe08

SHA512
ed68945ff7269399cf6a8fa96ff21bd42ee0a6a5dce7b2941b634edcdd592c53d4cc83627c638b71a71639891c86d6961d5145d52ab0a512003587fd04876cc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989c0ba4d395324ec636dc6361e759f3

SHA1
21e659341aa5877aabe369ab635b9b29331858d4

SHA256
f2aec3dfae2af274d7c9c109d69a36b8ad5e0239d89a2dd2b69c0934d5d25c24

SHA512
3b3dd75ef6d8ab996521d17b24f18436703d828c153dc4df4db30bea77d62f5259d3467597043cfffc5b70add1dc59b67c4e508ba3f8fb1f272c11d7f4c19a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8c668c8186cb0995ff6d4e4e653f2d2

SHA1
72cfefea5ec87983554c85e8b72189a372563283

SHA256
4e81babd428becfbc381c17a80a4c89b8e5f1632ce8bc4c133968959dab4bd39

SHA512
321cad8e2f9c7223d79458ddf764452a253a889157c89834ba2f39cd12f72504a21b68e7df384b3ae52d6cddc5988a7167397ea53ef90fc7d1e1c0418520e201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71388a56650386c8af47d25a47d261cf

SHA1
1c6a56f4cd7dc7e68e9f26b2632c43486a622e3c

SHA256
fe670c48efe578d3e5f9e50eb5188d422ec8c19b7ccb12b18f5c06e63271c2df

SHA512
38b808cfea218f92c389b680e3628ff8f03fd3e73372069bcd6a8c139cfe321f6947d4275136a744d1fd38f6d1f0ed7853af656ff1de2094da996228a5174ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6765dbee80e3d32c0cde5190ac114b5a

SHA1
e63f0cf5a70f8ae1a9a5029c1242241c31f1d479

SHA256
0edee43c9f5c7504fffe845e5d4fc751b0dabeadf34528714e50d733c4d35187

SHA512
dd9df8b5705ca03ef808af22b464c9f57f2c4ee45c2aacb1030753f9e32a448dee122c4de04ac74d9e4a62a4b2edbf6da4858d2bc1c16789a6c8ea904693722a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC711.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit