3f2e7498e7b5cc692c501fbbe4b634348dd0a594acfe1be47b0613b894e86442

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c56bd0ab4aaceb7ef9eb194d9ecd7485.html
Size

432B
MD5

c56bd0ab4aaceb7ef9eb194d9ecd7485
SHA1

76498a2ce8166a047828bc755e4b7fa249434015
SHA256

3f2e7498e7b5cc692c501fbbe4b634348dd0a594acfe1be47b0613b894e86442
SHA512

fe23922b4e5cf7db7d0fcca6b8e36b5a8d2b5a167a47e1662279be2a593145f7bc8bf74537285b1acac6058b79b4ecfbbb22cbae269f1e5769468ec7a12a2a6d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000047c3f0fadf471922ad4c9780e64ae0eb6547801deb1c46846f6a79086c83ed61000000000e8000000002000020000000d61d3e96c5d6660adc02bee7f1a40ca56f79897dd31cb94f4f3031e71ca4fbf890000000dd282141784cf0f279fce5be04799b8fd18a9651774f3ae2106513d40473eba831fb7857288e50eaf1ae02b91a834124a07f9e017c7d9da24a198bb678b17385bef65ffe2b26e8cf3f60e0ee267ada135126c6e5b1d3f3001f78835568c7264c64a5dc05381336c112dbc2e87c3f3db1fe9dc9b004a5dedcc11f900983f7494cd6d360ee77c6e22d31d8b0ff2f40b9aa400000006f1ad25236f28dd2acce8c3281be71b8f5302e4fc774d9b7b47a46898ef4060a5c79d4c734b22f2fdac1259f606562e863d480e6629b0ce2e5d0b8845b15beba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000cc02cc3ee6701812a04a47aaa7b1e563361ca918ec8c9897b1ae0cc66b119354000000000e80000000020000200000003c2bf553e4fb64794da15cb089c8e310da09660b5132a81e21fe6116a90f88c220000000c013dd06322af75aaddcdb45a4a5fbc0dd0b873ae32d679bfd09c78df5e990884000000042d697c47714cd1de2fc2a7bc2c2fd0beaf6fd53ba9591a55e2ebc1afa7a5b50a3e7eb47de955ca210be84e4b35583849b8109444fe80497e518660f147070af	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1026ee9b2075da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416480457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D708B3A1-E113-11EE-A41C-62A1B34EBED1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2052	1996	iexplore.exe	28
PID 1996 wrote to memory of 2052	1996	iexplore.exe	28
PID 1996 wrote to memory of 2052	1996	iexplore.exe	28
PID 1996 wrote to memory of 2052	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c56bd0ab4aaceb7ef9eb194d9ecd7485.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3bf85a4d2e1edf010291293228d411

SHA1
2de4a551deed2011f70f8194e8ac5839edd89816

SHA256
0e42917170725479a36b78f51f19a8b73edcae3e1dfac2520316ad1a379dab61

SHA512
51f21b53b70e98855cb479dabf78f704b10618dd8d3e335bcae2788fd4baa306763f2e6dfebc00de16aa9da7c7b18a2d69532943918628d7bb305214e9b3d01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c8f30a70a0e09fea8bf64bc91b4b76

SHA1
ea84dc10043871d231698727dfe6809e5d7ed7dc

SHA256
256fe86242518df2538f749a7f8a997f6c409296d0c0d3d7969c80ee0ac7dcb0

SHA512
b41d125618030efa450fa58ca0ffac5f2c1b6dd98143fe26043212a1ae42fb845df1d237e7dea9ab86155116927214f410226ca40a788e62ab0b132a1ff3a294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10dae93052fb8d564f2605d48fb4c149

SHA1
dc609503c4f12ed306cde909f70075c887c1a8cf

SHA256
477b5540afb8bdcc5503840a5f83100a0bbce42495beda76a4bce38fcbfb55d7

SHA512
d2ebb9a97f2062d503e83174675df3af8fe17653000468cddac32655210faaf0a17a9e09b514e8f67b0458a832109d5d500bdeb0b9f034f156b4a6219bcc1294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051cb4db5a675d40e8b8e72f6e5e0e8b

SHA1
4c8ea69170aa700b3f424a7ea24e3b5f23ad217c

SHA256
f8e5e5203b52137740d44336cddbaa62d930b96531927d992dd1a45e94f15957

SHA512
98ddb65198f5c08877da25d6ec545a4ba98f9956ef29f95ce03ea9e77d863417209a0bcfe28facf869865a48bd6a8a31b30ea997e0895610ba2e031b2dd51553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3402b61838ce05028d9df694a5cd5141

SHA1
0275b117cb335a0621a5fd89c4564f4546366a6b

SHA256
91ba5f6486c5ce222eb8edbebf3aa4b02737d92d841acd043f1ca739270dbc3e

SHA512
0cb1444915f91c082733fab696ae5950afdc791ed23a4b6f7db5bc04830d4fa7847875e53be4bb7d55424c47ddfd4e78f947932cc61e26efb6b9e38f369228bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1004350e2dc6a3e631fa66b3e7e4b98

SHA1
4bc13802be1470117803f6a2dc4482ea2d0999a4

SHA256
5314ea88755d4752e4bbcd46d718e9f59a6734c90da4768a93937224b0f2db81

SHA512
e062ad234c74354ddb16d275a2cccb748a0e703676813fbd0948b38d79cb9d5b8ce28aa6f1618dde1c0b984daa2ff9efb5f3c31c58916c939ae1b909791bdbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba67af7c7fbc13b6509db66437d6996

SHA1
6ccee18419ca4f9907e643d030d20f2848f0e66b

SHA256
4e1ec7fa21adb475cfbfbd0e1599930cb3e60a8e89845ef18922e73463d62712

SHA512
daefa1082361bfe8a3672e5a4200b25c424cea125b4b09cf73d35183aa7c182c4c0d610bec177461dbb975d58fabfe817319e1f9049b83564b9fb76add65b4ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1219445c54e13234c416cfb0ccdbf8e7

SHA1
aeaaa55a3c3a99209f663c957742ca2ecc7d9908

SHA256
8a2cdf22662a535afda422fa979546c71190125b246ef116416cee3269716ec1

SHA512
e869c4b993c819c9ec0232727c10d79642336ebc3b07c48ae0c9025fe14c0ea818516358ab5f40e35f7455e0aece712ca4e6ec596a06ac341004bd13f1c9e1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e8c094ca69137044aa75a60e0704b2

SHA1
697077be6b5caf4cb51b6535fdffcc1e3bf8986a

SHA256
43a0c1d81d4d7c7e16dc6753c6e6b391e3abf1aab5f7568ed2429f1fe6924ac3

SHA512
1851dfffacd383eee4accbe5b9cc675ca81d995badb55fa0e1bdfb3f59a53c7fc562ec354b221c08e2a2199cdee927e5ced78c2f41de34cf3cabcc612f32b682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8618b7cec2c21b18520ba32049377aea

SHA1
9976219955c4162e952e8864fe13b25b5e67cdb6

SHA256
af64b4e39b3709f3bdd6e19b5a940cac4ad40b8f5fd68388271be63fa8de57b6

SHA512
14078b5d96efc74016f574f99a72452a849dd772246a5a92d6076a0169da3b083c757e6c99400d0534f974ba28ca47ccca347cb3da602c6483e04e2393dceccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a381c3b478a326f385062556659764

SHA1
7c5f9b63fef2e292e45146d3d328dcd588ca254d

SHA256
3a5c66646b8b4b06a6a93b8f1fd98b542babfd3b53726148ae7ec053ce2e1944

SHA512
a2b50a36859342228aff2ce51cc8ff5ec504d7c842e70ff7dc394b2c59ade293666fc5fac14cb5ad84d8ce1a388934bd31ef5d6eb0d32cb23193c6263716eeed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\92bocja\imagestore.dat

Filesize
1KB

MD5
6dd59db7b9e8bd5a12702dc23a10602e

SHA1
c9946f80a55f2379f78d3cb8b24956174dae2acc

SHA256
d3988ff5d9127f15c6e05feab6d7985a1b16b5c58abf1d7365f404ce956f45af

SHA512
4f48f5862b53dd46df31cca08f0406b2253641e53537f64cc91de3337003644bb93d4456113c5fd1ebef3de59a4424ee77fe7571d48635d64d0857fd5c8e5737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1354.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14A3.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit