87a82758bd4b00a3ee8271ca8a872a9d74a4df39bfd75d78b743871f5b30aa18

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c59726b67a171a3b6c605ab2c57b62f4.html
Size

147KB
MD5

c59726b67a171a3b6c605ab2c57b62f4
SHA1

b00f0207da2ef09536a2adb3198ced228cb3d2ce
SHA256

87a82758bd4b00a3ee8271ca8a872a9d74a4df39bfd75d78b743871f5b30aa18
SHA512

1238f3217f81c587f6e285a7622275b03af08558fadd86f927fa90498a111fd463b54f2db2daa8d69c8e963631e9fd692b66672d8984c2557883264960779ac6
SSDEEP

768:wq/P2T6nXr3D+1KzWz8i77wDDvj5AbSCKXg7UxW9yeycUi+LiFJd/cQtU86:jmOXWEL27Jd/cQtUz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C912E5B1-E120-11EE-9CEF-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416486011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000009df35ea0ad90d9f2999fa4ccfe08d9a33e71ac335bff1f4927c81156089f33af000000000e8000000002000020000000d5a8f4a1ca988146a9c482a6ee6f4e01b7ce69dd618703843c99db117170c5d120000000c0d3292df3d9c4371c96a3a7087dbdd3068712393a93a64f60ebc833b65d731b400000003a84a5609e79dd815c60dacb879fcb05768ce511845b7fd2123b55ca96b40c350761fdf02e79ae1d6404009becd50c1a2f217912de65664402af5bd330a002ac	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d0a1a32d75da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006344a691954d241b7d8ed9f9f8448bb8467ebb065a9e1cf71d90393356ef0191000000000e80000000020000200000000b22d8ca04bfa38af89832df228612569ddfccf81b331049e8a96abd63445a6e90000000f774a7a4f7154df10152429239a490a647a7e2a8fa99cb4dd3368274fe1eec19f6f9ebb1f4114a7218d4a19b764b3eadf124156990012e3fdb12c3a14befed3dbd1bf82c5daaed8a2576052993ebe614ce514192fc2abdf2c5afccacaa999d50e3335a01544f13ac080407e432a95919adce5ecea85756430529e8206c1dd97919bacd91061a47ad0e2609d7df81793840000000610d6e601db928c325b0a07a6f62eed5ab1b52eee0f99f57800036c04cffa41804a47f289fa34cc4d88d5a2185aa78cc59fb4f0902ddcbd6912e9feef68b5046	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c59726b67a171a3b6c605ab2c57b62f4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d7821754191d514942cf7cc9cdebbb

SHA1
a8cd14f8258c6dddc9de9f0c0277fb54bd117c7c

SHA256
440767370fd45388340ef9352bb3266ed14bfbae2e23ee1b47b992024bc63279

SHA512
c06c6baba0013d1f195a12bc05eaf397d0e9e0fef041a28839b1d9a8c782aafee9da26bda577254994ff272eccfda846b1aaa6d88c6fa24a1a691c6a80cb7999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf9d5cebedba4eb349ad77d5f0eaf1de

SHA1
c65852f4b31df328a82e1d9d3efc1fc7f886d922

SHA256
383b002162c2a75d0bbaac0ca606777638532c5dd48c6818ea35fec48e8a939e

SHA512
cf786d639d2904d5f7dd0aae9abc062d43f34ecdec35669a820f727d6b922cca8a47b287a17601198ddf6a497de15b075d889ba9ba61babca97d76ba08b76afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113bcebe05411e9807afff7e3b789128

SHA1
ff4757faf0d168eadabc885b66f3a1b31dafdb8e

SHA256
d8e80d9b5f0b94fcd5636ad76e515329221abbf47908f609b261200f7f1f5c24

SHA512
77e39e4f5cdfdc58435ed372978a79ee6d81b3117c3d5b14562297a05e676911785b7b25722b677c387b9baa8936626d345edd5dae2afe80826f8a7e35090690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebbec93af5f9fbebf3a282aa5dc3dd27

SHA1
7a82160e8a313586452de926c127b0fab0619d89

SHA256
0e2a9c45342e8973350a7961851fcbb9528622a140471ad1fc525828a314abda

SHA512
95e6be5fc024f639dbcc06018c9a9c5fb2552f12b67b17f1a93496dfb6cbdafb46dd4895c98bbf1796d23fd4f5aa6b109238f2d9c2ea82b5d7e694cace4b13e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45fd9a4a06280834b90469d9d2d3bcf9

SHA1
f5f6bd3b5c524ac3e153c110349a85e4d4b8f255

SHA256
9a1236c219c80b65eac1aadc57d1bb596a2e7c16319219c89f486118c6372a65

SHA512
985c3d4993ba0c2870ed28540cdcb391715fa8f887e9261c71bc5fdb3f5b13c5c7728b00d4352bc016cb40b7fb026e1fa8a175cf38991e2ee102c9b1a562644e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d264aacb0cdd6a2aa1c7d741c7172229

SHA1
930a1820480a8d43b657a81977795c1c19163f4d

SHA256
2471f535ea5b7b258f1c74a57dbc4ebbe2c3477d359bc8bc0aafa8b0e8a851d8

SHA512
20bc5db5199ae90902a51d549eae1d08a4ac0936e84e71bde39686f3d1077359eb7a09251bbc3ecbc29a666b00bb48de668eba154cdd56d58829d0c8614193a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e4d2b7c7aea1c0b7d5eb8f785b5a64

SHA1
93164f3bb11a1beeac7255d4dacc1981e899b9a8

SHA256
68c8f1226b733f84214808999eec72f61222d0e597781909e37f1b32e4193a51

SHA512
18c97854fc109ee925067ae59bc81b5a70c73b7c7338279a2d1d9d0bc4f291a99ad365554b38b190196d616617cee1feb80d675c04f6b06a4f04e911809a9dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca5e6b33ab853da1d7af5a9da9c5ec8

SHA1
0f6ba31a3b3df3f06010c71697c691fc11963f04

SHA256
3cb971f55c47541b4e1a66583da4c7328ffe9bf57f23fc0f369faf3dbb921ef0

SHA512
883ff8e6cf6c4b1fa7a8745dc149994361e234983fe5fd0c5902447bd16bb5acfa8c25f750a19272a46a8da9881f73b75742f3e8eb45a63f2691c2e024851d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e2e15845cbba71d8bec6aeac29ac587

SHA1
3ba7a0a5380cd783cce1606ca861f0824b1c9ba0

SHA256
416d3b038da855ca38b54b01c3ee6983dd11f1c4df9fb03ba74663e53cae4b88

SHA512
f883cbd447598b9e6e4fe2ff1753fbf12b642afac3f99d8a1686fd175ee255971aa462300115aa7316a71094a6c79001cf9a94764c567863b3bd34db6d8e66b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d3efbd7925e6ae6fd4dd81fe12ce2c0

SHA1
cd8a0866cef545ee24eb7a1bfeee34ae08bdfa57

SHA256
2f8f041b9dbad5fe94d893dc7c7f78203d8e6cec513819e41d7665c213bcebf9

SHA512
a24068d0a7fa14f349549652024301563cc6edcc495a82bb5f7231d2be6c92de11a41dfa6c2b132a4c757fe43834164a2c4d9d552f29f87b75e6d8c7dd5210e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e07517d0ca2d1204e16b21cee3ec32

SHA1
698e8eab54fa53567ce84cabc1ec9cf51b0fccdd

SHA256
ba2ad1db1c46c39a80a0ece0bbce41173cdab099f59b7f482fe0c97975719542

SHA512
3da4778635b63cbcef4ac921629fc72386b649b4783024a9ecca41cec56687877f56a7fb6b33e07b2d26bd11d870dc4cf704d7493b94b018337829311739dd52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bca79ec13514132fc1058654e2c50a9

SHA1
3e77fb2e5df3aa75a51eff31a04d26766e0ce182

SHA256
adea351d53a7ac5d6fa79c99d2ee628b5c3066e56e22f7bf35d7b796d6f0b1de

SHA512
23c0922e989d9a6cb9d0b163eea7c177d88c9aedcb944803bfc1181b5aff10ce1a5efe1dd4b8b4aac3a82c17696f1f29ee1db184e6fcd59e773eaca488e9859b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc6627fca6cbe7e4e10d4c75587e50cf

SHA1
22e2948607b38d0cf7e1fa33549556e1e8467a3a

SHA256
9034ac27eee26901c749145edaf63a132cd8a6b342ef11ea136537b81bf104ab

SHA512
146c915c990761161a2e4dbbc54cd6fdd4f15269f12e61b1a7fd91895c8d1c2cbb7bc6ceaf29e855e41f57f6552fd3ff0d289d5acbbf2f358858a82da3b87648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac60caf30fb1378c2052d7176191eb7b

SHA1
516dc3ed15dc7f3976d46965f38bf8a18330f0ef

SHA256
3e9e7f2bb7acadfe44069a8ca06ff10c7c72f63dadb7c8dc69cb1d91cd6accda

SHA512
38a691766923892ade98c73fbb86003aded9bca85cd104c8a607947cd9d7ca2d9dff6bdbd5fe07a5f1fd9fa2b9370bd5a036a785db5af6f96c937f35a5489bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0db44aa207398b77c4fde1d9469e787c

SHA1
28da253a0d9761b34f92721e3e1c1f22b95fee45

SHA256
ed181ff36a0371b96e40d78c3dbb768002ea02f6407a8b50f9363b93ea03219e

SHA512
31aa525b387475748c85589b34bf6d2307402f451b29064ec16cee2699b6783a8f732b2761d0ea003a70156c46d3ab918fd1662a24307d8dfe8f653b0f117bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d3adfe7c51e70d683443a044ec239a

SHA1
ffe7065bd91f92b4ee282cd72dac1893d8b59b39

SHA256
b08773a1b8e8d0bddba2e05a934f7347012a53a0e1df692b658de84c9ee771fd

SHA512
5025984773862f5ab43debe182f7b68d0c35edf657ad88bc53cf3c760202a701efb4ef8d97b5cb72d01b3d04faca66c7a82698688a9f687a8090f5fa2dff6864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49EE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ADF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit