e6b0e36eeb7145e99b89d36b3cc3d48483301fb8b1fbc7790088f17fd6499e03

Analysis

max time kernel
138s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49b7d5dd104a3a0c755006b239261bb.html
Size

10KB
MD5

c49b7d5dd104a3a0c755006b239261bb
SHA1

b324b5f4cd55cb79017f887dca71e2718a1ddfdc
SHA256

e6b0e36eeb7145e99b89d36b3cc3d48483301fb8b1fbc7790088f17fd6499e03
SHA512

f646606a0cac6b5b5cf381aa69e7c8bc419c30259f69789a59671221058870cd3b2e0bc4fb1c6a3a9ed68ac0dd7324991da429715886388f972b56b8f373c7c5
SSDEEP

192:csz7Q0fAYS/6Io1Cs1COQUg1Cs1Cv1Cs1CGy1CGyyy1C911Cs7PHb76f:cf0fAY86Io1Cs1Cv1Cs1Cv1Cs1CGy1Cd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ea45d7e474da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0264A4A1-E0D8-11EE-A1A5-568B85A61596} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000695570e7f25d106960d05c07f223cd78e64bce66f45757f8d7be8060cb439eef000000000e8000000002000020000000ff088d99b711c5d55abd221e358a93271a4d8bd3a0e2c59224e48f94ba30d80620000000329524118c8f9173a6e19360be1d978c4deb5eb005c1c3d0b8f22d084ea8f6b8400000000855b5836c84b251fe38dcf13957ed63d73b37b744d9ed99fb170b05fba237b220a2beb6ad7bd5a7fcdea69fe53da6d84307e740a904534780807f5279dbd787	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d225e2dfc5c4f080f9e54a1c862562c00e817d72d464c6ce8241e033f6ab560b000000000e80000000020000200000000148133ef46b0edbfdf5967bf4bd4e53c04a7a68a1ddeaf7092489d5f2d1f69e90000000a05f38a84814f12007ff040da5ec869a068a7d52e5aa14132cd983d1eb2893f847027463608f5d1216911697dac72b1b1f64d636a161ecbe7d04af9c8818e3b58eea063ec1daf6e80971c22c7d2e4df35b8693ccc4d0d96718e67051eebc785927e6f4e7e2bccb650dd5d77fb89e67cf61c82b99c69f15157e636157ab7672944fdb98277d30985e5a42b9d32e210925400000008efa02ae860d36244351cb2aca0f713f1442bb013c70dcc51c34aa4246d7028af4fd1d875ada8a340c5bf59b7e83a66840941e223fa8d367b4048308966339b8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416454758"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1560	1952	iexplore.exe	28
PID 1952 wrote to memory of 1560	1952	iexplore.exe	28
PID 1952 wrote to memory of 1560	1952	iexplore.exe	28
PID 1952 wrote to memory of 1560	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c49b7d5dd104a3a0c755006b239261bb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceccabce1e1090899447c848ef55ecfe

SHA1
70a9b15f2e1c83109299f8f3b1f5abfa347fe5a2

SHA256
c1699d1bbbad5803d68119dccfe6583b49a4ada8c18e55184c41d7d85d6c023f

SHA512
aec7937eb554444666fb01e4674650e25896fa71c36321c9689c7119320f073dd10002b127e4a4239ca0a3176cc79b4cf22da40c13fd785edc27299ddf3b3275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60fe2f7e917c0fdeec7e10ce1b799903

SHA1
dfc22d9f2118f9d22465e8e4757a872749fadd55

SHA256
cc4d679000ac059fd66e7cbbd3d40919870be95354c6c4ae38d1568f864c6719

SHA512
dcc866038d3b8cd8a7d80d10ec9bda22db542d6a4f1192168c43c2ce90666c9bae78b28f37a797677470473ac6dd895f491bd46eb6e0cffd1013fd297582e4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
059bd76e606c439134e14685912e1a11

SHA1
0ccc2fbe4ebf29922df6f0e562c3e7dd5224e592

SHA256
d942dcb1715d8fef012653c13f83bb4c6b4721a74a719620e1f2512461825cbd

SHA512
d8ace394e2fe96e950d04bf4e0beb08b044d87049c985367f3ff373f9e44a14cbd3822613f8bce2c84d327f311bc56f1cbc3210680accb01ad5f2020c8dd1e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f46ed304a1e6749e576a3e21c38e0109

SHA1
3a094e0670b13455deb6baab043f319233550cfc

SHA256
d267f02b191957c258a3eb1d1cf690c9b1a917ab5f1d2a34005d834e8d08557b

SHA512
4aaca7102e243493778cd6e8605e58440357a27acf19bf57899b829f66feb292df2547c9931d8ca935aa52533527424b268de0e44676ae203b374aeff612d034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410d95f2e0d8f49c74bca3383e726c57

SHA1
00c52fb292e7da03b49d062c2e3bf0eced32c407

SHA256
e7819e8205729d968ea7c2376fb2c3ddf9145680f5f0139584e315736f8850fa

SHA512
898407b16dafe15d64a0e66eb06312525a7a1f78d0bf9405ef2f053aced1336560a7aa773bf88307be35d61377b840d69347e237a16365832b8aaba159b72162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b42080473f45042a09c31ade65cd53ef

SHA1
c1feb53158cc7dce3fa38287b57c47b65a4eecd0

SHA256
1f9ffb2454f663fce0edf1216a704137c54888590dfed29b8586552ba1daffb6

SHA512
b75619152dfaae7845a0e56e6294cd19b1729a1453ae6a8ee78039cda2b60cf2624afca3a7540d0060a95c3f5aba3dbbf345f003a94c5ee6a7c241e94f67fbf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab334e5aad34acba8fc98f0debeef255

SHA1
5be1b4b03be9a30909b426fedf127c79d3df93a6

SHA256
3991f7f401bb55848152e18efb1b0a905ce052fefd58a2106d4912474bf71579

SHA512
28f34bdd55021b7305cc257257dbc54cf627fa99b2e7bbdf15769703c644751ffa2fda83a8d58dee33f681602e376c0a4c690bda33589ece4cef6cf9540e5ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d813f11cd1fd373739af847950bb5429

SHA1
0e4eda7094ff0b0dd9857b89c491a1964241ff88

SHA256
9b0b4fd33ffef7f2a932cfb9000cabfd7ac08b2db5cea8dc16a0b182456d9076

SHA512
ae20b85885d6649455010fb66287cf77199b0ed502f518eb24b1c2796c02077019f86ba6c44b4efbf8a38bdabe60aaf6ff24fc5078090879da6574d8b773630f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c179854e2889a5a4324baf2ec6390ed8

SHA1
818989718db25ce57f3eaeb6d593d2f9ece405a6

SHA256
de7de9e053629323dff18533ce1532d48d7826d53a6a43d1a7f7de1b264cd7b2

SHA512
d0a4a729ec2bea15527a0a4487f98cdc1b014572e1fcbab3a85d912bc3f73b607037158ce6c3765239066c8da9491481a0d5f39f4e7ad4d19c2cd3f58fd862a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35a927bea385d1fdbdc9026cf1eb409e

SHA1
dc8914bb19a231b72dd43525fe249464a931f482

SHA256
1e56d2ff0027c64e051929a17ef617d435d89fc029e4c78f54536321f94e3386

SHA512
f544daa1b686d0626b4b1a6bf7e96857b06f54ed1927025aa073d61dc5a2a1ff80b354edc2f3882e55f9cf14e6f0f77fc1b154aec2dacd699aad2adecccba34f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6716adc72f6488e0893d5ffb865e93f7

SHA1
3bbbc33e4dc54345bf0065ac9b8a272e91b93c2c

SHA256
ce476d2b45ba09c0d6d4528546ea4c7ab931ebaf9fadf0daf1af52861c79e63a

SHA512
9ab9a1069293a8f0ef3f5809d55736016675e183145ebda0ff5d22f91c15cf50284c40d129e8fff4b0771d915cde337f1f550a966e21d326034de2ed644e9548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar384A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit