c5d5b24bf8e09a8cdd2a59fcee1dedadc86b47baa016a10733fc289d38a131da

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4891e9c5c887c04861cbc20ec28b9dc.html
Size

2KB
MD5

c4891e9c5c887c04861cbc20ec28b9dc
SHA1

8be1c93c19984ceb7780d8b550f0bd40277367e9
SHA256

c5d5b24bf8e09a8cdd2a59fcee1dedadc86b47baa016a10733fc289d38a131da
SHA512

413ff62336a540a6b83bff92eb0c8e13ddd404a891594ef93623e017e2687aa73264765e6ffdbf982c9fa0fe7d9f34cd5b1ef9ccebc6524fae447208b1f4781c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b002eea1df74da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD2378C1-E0D2-11EE-A450-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000310a90355fc1ec5df85c99f8fa66681d4a74c7b1ac9b839cbdc2fde71644795b000000000e80000000020000200000005b0430fb58c232121cdcd77464bd866ca3931fa9126b432e881fda7a290a753b20000000fab138184b28bc7b729a1972d0bd0915a280b291b86f524af6540adfd0fddfec400000000ed8e0d8811d557318b58bca6498fe2fba2e850d4a9647a92b34839edc21074ea92907bdcda8735a1240a4c38207a30d815aa13c9bb88bb9c57b3732e478f587	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416452518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000073549fe1baccc193ea66ffa6e33cf1ab7114e68423290a4fdba30503f944fd6000000000e8000000002000020000000299dcbde3141ef35652386e7861ca5e8dc74640ecf73dbb11eb7bd908f99a31990000000f8331c09c48c22002bcd6932d67474df97d1f298aff7c2ffc0c93ac68483b6dd64b350875f6f2963090cec141386116c62cdf2dd3fcc50b1b5ae581ed71edaa3163803b6166228849b369e176fa8d0ad180408bb92ceeaa5b4b99eefafdaa7357e522d735f9b6d7d7895733ea8a02a520f1bd81028a69b07f9ebbea9e2adce5cda8289a7e1f4116715bcd04effa22c054000000009b731b3d54e2d905b42e5f9168fec537750d3965f5b7c0ab574d1b672b8cc9accc608bcb7835920a145b2f2896e3ee6e8bb918176eb10c3ce4082153e75c9ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2956	2672	iexplore.exe	28
PID 2672 wrote to memory of 2956	2672	iexplore.exe	28
PID 2672 wrote to memory of 2956	2672	iexplore.exe	28
PID 2672 wrote to memory of 2956	2672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4891e9c5c887c04861cbc20ec28b9dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9abab9e16a27c9cf5be6e3d2e71bd3e

SHA1
16dfc3b7fe9888f6350287f3ccaa1e8aec16de0d

SHA256
aa4b933018f4547d5316a2f962c6feae5bb057d0c3083b4c3507bbe18b385967

SHA512
397072ae8a0d4900f5500972634333865c1a05e40a011470d11e2cce6c07e67e91a616740338871ca4f3ae595e9e0eb261c070efe7cd92237b343b63f5cc0fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d136632820d5d84efd0cede76744f01

SHA1
7b25b2bf40543ae56ecc982834e307f9a0ffeddc

SHA256
4fd7d9465f0f5ae6472c41e08a117bf59280b28575641b49b7f816d490ce29f0

SHA512
8ee50151d5dd8d31b0859cab60fa3617a097edf92eedeacfaf04b1d6b92a2c08e35a65f5c9b7539d4f12e98ad9e34ffd3056b1e07ef28d01ab49d77e79614f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091dbdb0b06eb983097b014fb6888029

SHA1
f9c99e753908bbba6355c4cfb32e4169e73dafa8

SHA256
d5f627b4ff83d6ce2cbf8460f7f83a7e61992f261bae8526f21d4a83c401cf91

SHA512
1e5ffbce8594ae17cae8544bdfc2eaef444bbbed19313d8674b87e0bfcd52c2f15288162015b5097fd84cf57ebcd72c20e0de83340a14bd03d7449c8c35bbe60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eaf7699568cf87b237acf7406c407fd

SHA1
612d370b565dfdf989dcf663188289d33d98a0ae

SHA256
a169b5ac1c03279c3509a46c0d7dab299e072a25f198f0fe6da4f8c36fa155ff

SHA512
bef6ff1b094d45a3550903289e892c932f4f070693dd10258dad5d5a1b698bc4d845dbc2f83e5c53f0196facffadefbbcb783a55889185ee1de6f34f299fc63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54b5968f8caf1e777322d6bc004a9de

SHA1
e06de9a3ed435f9512834c2e576ae74ac1fdfa98

SHA256
54217eb80637fd13f1dde39943ca1eebcd5c32c633fbf680a5e16edfd0c5a199

SHA512
57cdfbc72255cc7b99575f2263d9f3c2756db905eea16ec96bd458b7c463d66eb0a13f71ffa155ed6993cdcab898504ec29c1569f9b7dd7a6bd007248f820843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a486c347ca940b9899d33e51081d0b4

SHA1
6c9a113cb3cb6c7c96154bb253f7703695afcbb3

SHA256
45325ce170377b09b71d6abe974ab0a5b903d7bc96cddb79e4035c8b17c05182

SHA512
bcd3c29ae24cab3b7ad80ace578cac2a72f5aebc94e844dc65de93b987e329633b5b947edcbfb79ec12b3f2c498b6c1f988305e0b7edf693df835b4406339e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1f52e797aeb1fb4e182dd8f67ec5c3c

SHA1
7900c372bb5732ac96d931769eb5a348f889e648

SHA256
f8d4f47978b62bf5817054a8528d75a7a07eb4d004f35f5fadb953c673afdc04

SHA512
d9451a6019519aaa0981552899f27b89d6efd568c0bf863e828b166f2cb1a341edfbac97349bbe9f0f106811fa5d059f3a13193399626de57af36ccadc5a79f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e1801a7382cd25ec74fdd1ba3795ce3

SHA1
3255dd03d5c3bc68345eceff9b4c418e27e5aba1

SHA256
60df4e388cd73be14ef495e745a856bd237299dffaa970fd477635687d6367da

SHA512
b11e02056ce9ac0668a4a2d856faa03b9592096ea1743fe01e74cbafbd2a8096eb57a34f8694badeceae32b19f341dc116d0bc8bcbd84ccf9c5cedcf74d3582f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd370752c527d689e04013c5e38b2f3

SHA1
1e21db911e47f26e67e92a948cd7039e64b1a1a4

SHA256
e795689786d6fea7e844b8a86091b0efd8b11e4744cf0880994f8bfc4fbac878

SHA512
23ec1aa0bcd0e00b6521099855a13d450ee6c17a7d058076a005c7ee655d2432ac60eda5d0149e3f9f6de7b362f07058f4875c23bc27b471161f99bf453fdd37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39908ad0a05ab52fa088f4e191726e7

SHA1
6c9d80bd614e4ac8efa2b5c586b8ee33814f59ac

SHA256
7a34d3be08985d52e74d0c2194255a67acd6693f92e337a6470a4cc805868a86

SHA512
603ce6829f8dae2cbd9adf096663f73f192ec50b9a155eecfc6c43c8c303f0b7eb9c43d8f279c57036e17c74bf6354fd70a041cde37ea294d5d04206e58bca2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd77558feb8ce0289372dc8f9e1ceca

SHA1
b9753d4d2313f6baea56c705c2a804523de0fa9a

SHA256
bd7ab157d6b755dc275870a5d0407ea9fba6aafdfbde0d46157e2654265a9894

SHA512
c9f5d3ee7472149e4672e06a1dcbbead2dcb81d235935d2ca9d05237f6425ec5736308d86c7213db470abb30b1c290e7141562de0031316f0ddaf008e8ce1b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45bc8a8b0495825be7f7656a47e6f84

SHA1
8899898fcb6f1af10cb195b8fd18e477aaf5c5c6

SHA256
0914052a4af94927b9abdeaa350fb57af47b2e79ffc912bb17418b8266407b0c

SHA512
431b117d808d7f0122a77b84d000735d09940f4f95c9007136a854320c5f1b2343d13e89adab18ee25a4cfd140e59b8d70f59017b2fa3f56ecec3289caed118a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49a6acff34e3433f0eb3b8310a4163e4

SHA1
0bf984ea863e7459edf0d92fb3bd08aad65c8236

SHA256
a133d1e98d8b2c6d5d33a5105f38d26349fe6274def2e100e019b2ff1d7dc3ee

SHA512
4cf6456986a4e4a77a50462459f03b37eadcaa0fb92ef6323a23dd396c9b4ebffbee54eb10d249c756507781212011d3ff2967ae2d7bb6b087a9924ca452635b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
861e50a7b5dbf19b3c62250d1178c97c

SHA1
56d59b4172b67822eeda4aed7f0a53f6fd4c0fc8

SHA256
302a1922c77e29fd164f1751e126f81dd8b5dc51f9dd891f71e070fff6d22c62

SHA512
c4818534cef2e2cf7e54426ea64a2bb8e89d5a3bda868ca7673db4aac6aaea658072d5736fae6c03ac3d02aae1f36c8c93dbf1111c22623742aa827315188db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25349158bd860537b08349e8e2dd4ac8

SHA1
3bc5cd83c8f9ee915128d5c6b178e4e75d659e8d

SHA256
b6168851eb73b58b044b404ff085a92e9250eebb509e7ab169aaacdbc446a8dd

SHA512
52338827f81c5868fc45a2da998beac7794ae7dc3974efa7b729e96715b707cf77d6ecb97c2be94d885d2fee9310af4b9c705c8efd6f424657c0c04839f90f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d0e82eb5d86868d0049fc5946b05ba

SHA1
842bce1cbdcb8ba5ac4175719b2cb6c045ce77b0

SHA256
82404dd05dda6ce24aa67a06dbaf758f9ebadad5d3a6e99c3a0f94333bf3637a

SHA512
396cc912ed7df32ac7d0dea36aa84885eb8d9db9bad0dc5e53bae2fdfdc6005e8437535dd885087b889d37a349630687dcc16ad90e51899e2c9b7f09a26734fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b28bae91b0510b9226ac37b2b2bf0c4

SHA1
acf5ada791ff47d2ca911f581d505e804064aa54

SHA256
434b696fce2063030c07f478967949adbe02150cf34c762042524f2b9a8e0e0f

SHA512
6b167e50dae7919b84fdcef74fc0ea34275fb6987f07eade4d80962b5b029305a4baf970390171f241d23870128db32e4a5c26581be33c5270516d7b6276a3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB43A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit