100e48de5ac8055d46c29974c670c02d4392c3d05190f7fc41d39f24ec6be5d8

Analysis

max time kernel
129s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4c0f775c0fb8c49b545c4b7a982e34f.html
Size

55KB
MD5

c4c0f775c0fb8c49b545c4b7a982e34f
SHA1

c305b21fbcc81c4dc8a8176ab4c4aaa233860efc
SHA256

100e48de5ac8055d46c29974c670c02d4392c3d05190f7fc41d39f24ec6be5d8
SHA512

c70acfdb1e3d696b583cabfd3ccf8e7a162c498a79dfa5ecc9845c22993c6b07602812601a48a39dd8ccb98664cbe5523b1c48542471eadb04f075371a65be08
SSDEEP

768:2rS0pHvvCIoo13pyfSBYmnOeWHqlC/sR62D0nA:2+8Hv7oa3prBYmoW62DL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416459097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DD88581-E0E2-11EE-A3F8-62949D229D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000adf970f377482a6f19ec76dfc5f7aaeeea2baede60dcf90de1bd18cb068c17a9000000000e800000000200002000000045354603c7072b9b06997250d9e2b6c9db94bc461409f982306ded558a9687ba200000009700872b58d1b7773e7b7f9a46c6300c0538593453437e220a31f612bfa286c040000000b46d9cf79596e294b9ccc625b522ccc9d93c9f203474fd6cd70e2adf0db57deba9182967107266ebdac322daf30fde0c95c0ae83dc6412f745720617efc55ed2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cf4f63ac12f917f01f58abb228cd7ce51ced08815605b81bc8e843c566583ec0000000000e80000000020000200000003a322bda611061e85d61bda1e3bf321a6532763558201904365bf51937868511900000005c4978dd8c9721c2d9250b169e6319c8a7860ec4ebb9eea0962e6443bdd9d007fcf9529bf905b3e6cc46e8bddf63be987616131b72ef6f6941753440d84e395c2040b3187dae4b2cd0a5f0ad10019dd09fa2107b294c65079b2dd7584c9ea8ce83dca6b57537ca93c319857a81209f231b81c6e10552390ce712042fe7fabf7c2ad7716bc9b8f2784fe23b49e57aee0740000000a137df96893cafa5b765a077ca28e7a7d0910f06d7e64ec0a87bf3b2837675054997d03a203c35a8771d7d9c0775f817671c8165eb91f6e79d1e13bcc5fdd7da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b97f11ef74da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2524	2740	iexplore.exe	28
PID 2740 wrote to memory of 2524	2740	iexplore.exe	28
PID 2740 wrote to memory of 2524	2740	iexplore.exe	28
PID 2740 wrote to memory of 2524	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4c0f775c0fb8c49b545c4b7a982e34f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f14ae5159cd465eb44db19fcca668da7

SHA1
8d156d59825be9b71d047bb701fb7c7f3cf265d9

SHA256
0d1b5ac016e3a634564238a56e2f8d045c8088f49b375f60ec492f3da2c6143b

SHA512
71df0cf8edc49d4024246917f0d15b7f5138ae17f5a1ed84a99f571d637b470635b4d735b42bdde76c311d7929f93b3aa5fb767b6655bff57264583fc6c4027f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e62aa95ba1adf8672d198b6827ac87b

SHA1
a3ba8e7aacb6cb30eeddad2cc0acf16626b81391

SHA256
65bc99d0c1fa67a63ab7b9242e01bfeb0b71022a01eb82ca91865bad0611a246

SHA512
a210493ba971d3602eeefa73d27c1b72348344905a7c4415d02408381b7e2b6be92e6707264a778d0db361d5406ff6e47b0b41902d595ca8c99e9204a8596f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8172f657657ee80d447e1328f83ed36c

SHA1
ff14ed0da1be8af78f5cc798fe0b42e169cdb341

SHA256
cee883d511554046570f8bba17d79a17425e40517af287076276faef12440deb

SHA512
ea7e7b9b5013d3e2625021b0709f2948f1b795a87dccecec1731c5bbfec6faddefc64cf2cc06914ef767ea9360dfbc7e1504eb88a8355778bf2d77d70e92921f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e693c11f6754e4fb158eba4ae0b8ca3

SHA1
0c99814889497062450fbb95631640be290c2046

SHA256
ea01203b8fd261b436ca6743b73fca6720e87248fa425d8962b587e4ef3a2729

SHA512
8c4fc37a6a4a12d30e3061a3e89f4d2866f1850b3f90855e1f3b2172ea46c30aa33e0e00724b6b68180d473970e221935242c2236a1c4cb0db50f51ddf4f5eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f21ddc585bee5e9cec8801ef9be0c0

SHA1
1214e0084fbf9e280a959e84cf029b5704119d85

SHA256
9c965ba4167f9f50cb332478a56a3d15e1fb28a2bfc42004005876fe81eb1144

SHA512
067ccfe0db034f2997d1459bb469524f02088912670f7b00e0f716e8ef8d59468c3998fa838cf65b9c61c9f65ba869097aa34669ca1a7a73978bdd90ff13d856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2330e125a5cf75eddb328bc1c8dd9f09

SHA1
b6365f0e8f4c8cb29da54c543b1dcb896a737d72

SHA256
fd1f08f30a75a8e8639762a2a16c230de983b446502e8507667eb1a540ad319a

SHA512
273e9ca33d449da4292444002cb99acdbaec72838f986f62b627e2e006d5e5181bc97b2ee8442a14ecc73895a2c0301821b35544f520751e3f5bd648029eb891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dafbfad2c4813c4f26c33179f9595802

SHA1
9c96bd92f49f2a98fdbcbae68bc5eccd284dd264

SHA256
6f92edc5f575a839fb2509fc9a4e42f2b4900daa57bbc20c642ee50560e91a24

SHA512
1eb81bcb463d80d15b9384799dddde2e6eb1ff2223513b7cf85d411b35429e86c042751cbc51e6ecfee166bb1f545e556453d2588a2b1db4982b124f76346ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c4dd14b299362b7281c13126567732

SHA1
3c10bae47b477ea3ac5d34335182e9aea4a424fc

SHA256
9e1c25ce7f4d119653edfde22861cf96374d19ed1e71a91d247bc09e5614847a

SHA512
ec1fff66b3e4a82e37db5990e201b7bac43ca8891790f1b215c7a29bb249c8f8aa3400f2eca998c102606291fb1e6b1aa37b39d91e76c1a3c6eabf2ccab520a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8dbf3036f17715fa2a023f23972c232

SHA1
1bd69ec21fbcc3e246fbc49576e63f6cb0897b6a

SHA256
bea547cba955bd54dbd2705372c22b8a0f1e92ff045a27203ff3be9398cc8357

SHA512
ec2fcc3e60d6d15dae30ab441f963a04e549ec3ed0cbff02c5141a909cf4008a81fa39b5a62e590b8f6bbeb4084dd513b84390e0e03c0029f90fe0d1e00f800d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72b3438dc9bfa18005c663d2038ab78e

SHA1
4f3baf13727a916e27e7f54dc5ed54cd9380ba00

SHA256
97e8c5af23db15bbae9f843aee81904fba514fc1b0cc92f10520d01328ac67be

SHA512
9de76a7adcd57fdfdab01467d1917bc588190fb5ab08cc00180a5490d16859c142c7024c3f05cf0b7a85d94eee7e3e1058b80be31356ef5639f446e0f0c5b862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec13f9cc54fd9347c337ac3c48ee9fe

SHA1
ac338495fd6cacc9b8a4f34c48d7380307894efc

SHA256
af544f8d7cb5f40d5ef84412d1a942325389be1bf06be2320711185b04d43207

SHA512
3d57793521b3bba5c1983c2a7997a2b78bda9003fc0438987c6790cf661c2d2a206965273bc869c9f56bc6eda8c4aa2a2d634672679896c54472d5d713a7d80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70ce935e4a4959eb264c5799a7a05c65

SHA1
01739d81877a3a243320053b46d5a2551a1d5f1c

SHA256
24de96f25d452d57692c71a6967ab25753cad4bbddfd9008f7fe6de47ab228a3

SHA512
abc856de7106d922c8689748ce7e15318e5072c6b4857c3af4d8dafdb454abcd710e73ee2b7919012f69a235fbb95155d4530aca7cc697ab3d8f9759e71155f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\cb=gapi[1].js

Filesize
132KB

MD5
c23494121f5468488a8e79a6268f4648

SHA1
1fc2646c75df1b8528667487997ab1f5b308133b

SHA256
100700c4795780ff97f999795e8477954da09fcb92a1131cd17216203914c425

SHA512
956f396bef9df5a542ae410256686e2259e1ae67402615f937c2f2c004ff2f3de5f5767200661c0ce204fed9b32b1a8707c26a566da1d3aa120d428901c39769

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1067.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar138A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit