f04a3e61a5031e903825e53bf708e2ff04e00f606ce728bd11a7d95b06ca5094

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c499fcb51bf89ab17b055bfe69006fd2.html
Size

26KB
MD5

c499fcb51bf89ab17b055bfe69006fd2
SHA1

dd57938af8d940b472c1a29f426cc46a35879c79
SHA256

f04a3e61a5031e903825e53bf708e2ff04e00f606ce728bd11a7d95b06ca5094
SHA512

37bb109e608e772994abb4fd65e12396e63ee862c1053dade4ea4d2605e9ed3ca4f34610dd194d05907c58f5c7200b687ae24a505eebb2dbb0debfd046247e18
SSDEEP

768:ITVsTLYwP/iWFgx0ysIbFmZs85O/bPEvqDZI:ITVsTLYwP/iWFgjskFKs8I/DEvqDZI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000cab0af4e52d854cbf25d53f7107bb32000000000200000000001066000000010000200000007a8344a6000b7f2c19ac243f6739765abe3c96fafd468ee9324f52a8edbd64b6000000000e80000000020000200000003467535bf1c1da4e2eaae7eea6bc58f60b3a147bb779bec021022ba20dff644290000000d0ca676d1b5b8b6b201dc73394851b9650559ab93e5de3966a955e666f02daaf26267aa7ac96b4bb47eb8b1cd48a64ce5009b828eaa31890bdf114ce4e614e3e88b5fb620ed59fc371c5564da30af36a964a23b3fe7e136209e58192f320b24a62fb43c90d5519aa3542c389b7f6f6619d94fdf0065db85fc1fe7bb8ed7bc58b8173876d096775cbe5e59fa4eb0fee52400000000e6bc51f84431e6a99fb0b2a5807532bd85935d3250014ddef98dd5450b31b9c1e1cf8cdca162ab2f6bc7bf75b20573404f4213248d81c80422706d3cfcb2928	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF84F1E1-E0D7-11EE-BF0E-72CCAFC2F3F6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416454616"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0fe4987e474da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000cab0af4e52d854cbf25d53f7107bb3200000000020000000000106600000001000020000000e763ece9e257c4ba6f35b28b379f79dc9770aee1637089ee563170aed89c1540000000000e8000000002000020000000687369acf42e9b4525c35ddbeaff18d1072b7c251137e75c8dba7ae7fee40eac200000006c4c48c55faea23d3044e65a518e4f3f4b07610dbd2990f3250282e9b0b87e1540000000093017fcfd27f439966dba7e1c4b76aa0fbd6fa854d2c4195c057fa6354fef1aba41ed800ff9e92285410fcd619d71c64492928255ffb067cdc6a79d9df4d9cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2092	2968	iexplore.exe	28
PID 2968 wrote to memory of 2092	2968	iexplore.exe	28
PID 2968 wrote to memory of 2092	2968	iexplore.exe	28
PID 2968 wrote to memory of 2092	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c499fcb51bf89ab17b055bfe69006fd2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fb941fc642db33970553e3208c42e145

SHA1
ce6fb877ab443f664d4ed779b5fe644f2734cd68

SHA256
eb9501aba2cf2a67827ff4a9e43eeb362b98dd03cf44fbc7b5188cd5c3dda887

SHA512
6c526c41793a71e9c91d13ff16b239f7bf1fae41bda2433db3e6201ce0d848dd584210fba7b77310a38e4db4540f6bf8a77eed0e88b89adbea2f538fd5262d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401bb589347a8f58bea4cc3bb3d765f7

SHA1
826a81d622729f565ab24b7fb236f8a062b70506

SHA256
3d9c3c712199992d074f1f844186ffd23b3e00b0746f19128c38e665741f05ab

SHA512
395eb40d44a757d86285effb440f37d8c918fa3bfb7b45cd0d7871ede9112d515daebb7112e565488de2399869d110699c8f7565ad8e5e13e760128e75269cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f4629cd151a30578523336b04cceb1

SHA1
6fa50c9c738e27b200cb3fe2f10c42073838ff3b

SHA256
e5a8c15bccf97065d9dc7f752246f504290a106078ed8e9f89cb84dd0cabeb7c

SHA512
1db5bbfe17639d84f923f8dc497c85fe2ebc63268ce686d1a9a6f6114a9357926e47a493b80fd6d561b500fbbd11808f3808503ec828f76ccbd1ac444f9672aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8a84304a08bd7d5f479aafd9c9a293

SHA1
2a18c79748ca60b0a419fa863052ecbb12c0c31f

SHA256
7cdef18a51161e507852922e3a6859ec8405f4593fd8d91aca24c3d67c1fb00c

SHA512
8a77dd827a6c224f282234752e18447a7c5a87563e2988e6cbaf29dfb4b5eb0d1034f8b76bdb76a26ff10793878549c008f8205ddfa477132c5b154f9151bbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39cdd12072828d4e9f45bda82fe2e577

SHA1
3f19673b595528c97ac9ad13c69e1304ab0ec76b

SHA256
5e828d02ca28e28785e12d88e773af60abe272a5746c93556ddf846964c6c20f

SHA512
f8a1ade7e9aa584704aab267f0626593af2fb41c2755c45f911840018073d084bbe388ca12113285ff8b63f4a109a09dd770d4d7885c2d104925af3d97db3623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a45b29ed7f3628083e12e9b9bb34660

SHA1
e6c7a2c7f20c79162d56a8fb6c944698c269629e

SHA256
8145c3d4e5538786b736436e08ba4db39821c6ea7105e9c19b0f34d63537f6a7

SHA512
e1ab866fcae2e68b520b3247076c581bc7dd8e6805bc2bc0b86218d90f8e6d06d54467dd2ab9e92ce073118ea290f12a0843975d3b1f22909c8473e83804d40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a32c428718b21a4b6818c1dbdb50a8b

SHA1
09f71eef61ca14e56cabf8f75f809e1fa24ebc1a

SHA256
ba0de4be0df14cfdd79db75d9a519be31585decced7f747c575dd07aa11f9ac4

SHA512
f6f0c90b3a2b7fd1ed3f157bcf8285e96084d5fc4f0e58cfcab487d9fb5f0124b286ec7faa1b3d1c357d320ebce5ed84586463df22068d3b4904f137e617f878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
024b691d34e14fe6f323a6460316c5a8

SHA1
9a87aad05637f72e7893c75344a14b0d8c0cba9b

SHA256
11bb0ecc878bd774df98f4c18cc0298507fec65ae595a2a1e994f2d1d310ae04

SHA512
40492b461f0c9b31da174474e2c511afefb104a8635030638916d36432d273ff82fbe7b88ad9d81683b5f8835d20eea1ad04c516b00385d7c72db2ddf6ca7822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06815dfe772ed371586c209b63acbc42

SHA1
d8ebc57bd348d70c0c056593ae878eda697660ee

SHA256
2c7d1e92a445c1a4c8fea5d18bdd4cb18619afe0197a90f89789583682201a0b

SHA512
8b68c46bcda9cbd7a371d7bce87625224b05f64e18f8ea3fc7f44db7e7eb1f6021842df49ed044ad1792ae6f4f0c8395d473e6070dd137410463940e4a341872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
22bded32543b4cf6f43a8c703205cb08

SHA1
6cfe36dcfdd3e73db6cc55da3199a5f314515452

SHA256
2d7021f36623817c38c881f1149adf728f19396065db3db493b058d37f43e8eb

SHA512
bc55fdf13be2738c5363d03e0c28927400920f13f918c9089ff01b22dd3bf645092a8f559fac7356cdfc51166f3a211b2de5c4c7a095c3a4e7a1d0a604d27346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLX33CJX\typography[1].htm

Filesize
95B

MD5
9c8e0593ba342152a39c1a6d38740218

SHA1
6241b5ac27502551df70ec59281a04cef5c91492

SHA256
23bc66f1fedb8acf4e318dee0fde6eccede3c3bdf834f4e3b36d3da4041d7c81

SHA512
8ad14a0e02d6601926e8c46cc9d102244a0e306ec90da5dc7b9d40bc1a30fc28f93afe3f1b57801ecd8e48ee7e5619dff89f8633990ed056294811d9186e513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A7F.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit