799d49c8a61771bb3a43953cc9ede22df6d82dc3acff2e455bfafd5751922b84

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c5d03f22aef68b9d89fb4342442fb166.html
Size

29KB
MD5

c5d03f22aef68b9d89fb4342442fb166
SHA1

228e2488a7a88c0a7126a4d15fc80013ce6618cd
SHA256

799d49c8a61771bb3a43953cc9ede22df6d82dc3acff2e455bfafd5751922b84
SHA512

6caca1b9f54172c6fec4bd53e610e4a4cfcef41d7f273e3cc82334cb64508f75e24ed51042f057902cdcc01b798793982f1dd1f6c2e384c703a0969e5c867230
SSDEEP

384:SUvAihLP6mw6tdt6p8zT3H6LBX+3ryvqS9uC8XGVDqD/Qkf0rpE9IZ3rmbsWvQL:SoLlXUBO3rySSHnZPWvQL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8037555a3d75da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003edb17291c9ae6c23821c022db72167d3878a8b64ffdae0e7df00448f925c241000000000e8000000002000020000000d7ec99f68b928761e9d72977f2daef5c44a458d55090700bfcb898eadd3aae64200000002f33c27255bf8250657dea3b08caa976d3c83fdc4e08034fbc87538f51665d7f40000000dcc4bee9a880988251d4e2819df0076b077cc88a68115398a9b495c7503412c7894a7e0fa195e0bf499a14d227d1a4855031e1f58f250ec9d7591e855cf58e85	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416492766"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df1b897e5c6227c3e3de37d25af142c18adf77696107aa2fbf2e2b959bad8780000000000e8000000002000020000000c3085f74b40d82cbca0326cef540598aadfc98d8a77cbe21beaa01999d87a84790000000e964262af3ad59722c31a4f53e0d5dc8b31dfbd7fb7da17c45790630d1cf5b93ba7d8f33b587135d3128acbaadba724dec9ea95a58d51b5fc8e5bf7e433654937bb204e56804565cae9742d2d568cdc22c7f4f82b3fde060b000e425dfb6e0603ba46dedc4fc24f2b3f15c94807ad6e7da6c5bb43194a82d08416a44314ff0972262873775e6755c83ba799efbd42f2040000000c0b1c4cd09808fdc77b533d1f9e397d64c385a81d8ec8709840a9939972828669e35c9851df5cf48ace2bb6641100ff1277ff2da951569b19540c7ed089ae283	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{829FDA11-E130-11EE-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c5d03f22aef68b9d89fb4342442fb166.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ed98467e7f57cc9b4e2e8a39c721f0

SHA1
de1c0d14e52d255bed022100e68928a4b1226d7e

SHA256
395712b705739480ed58576cadef2c2f6c90b022876e1ee5ae77f82cccbd9900

SHA512
6bd551680cabaad92027568bc04f4aa8393b8d2d76c1776a39c80d70ece7164551d877683006adebdb32709323bada608412c329893e3b19750c4f69bb140a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20979a831bdc80dd9266d50611246907

SHA1
28fec2f9d8a2ff1b24b4e261a61783616f745dc8

SHA256
0be2c1d884bfee6a669f3fa31d8fd7fb4eb04d96a5525c2da093c95a4ebb28a1

SHA512
fb24497053ebb48be3009a16e70449530bb79ec08ad3191abfbfbeae24fe480635a2bef99badb6f9d64145ec6e7ef019f70b127ab9cd8caf261dc7f558f7e934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4398936a8fb0c0d41b5f0bd403b684b0

SHA1
ba41bae0ad8a1a12ef29f5c6e7bfc54798bfd43c

SHA256
548c7e3e7429b53eb4ae129358e1665acdbe993070e8ac90e8ef035f27c944d1

SHA512
918d1a47ce748c2913f41b3d36d7cd09c9e29c3edb94bb0d5532858ebb3e196e60c98bdc8acc876e4bab55427a28f3acf122ca86ac10f2ba70676865c4ef0f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c546f37c7e53eec55449f848c4d0c4

SHA1
494ab22aeb4fdbcd94ca2efd9be0ef816f7ee87f

SHA256
5ba21eaacffd4055506859d5530be74ad295bf5db826b6f0eee04c9875f4f213

SHA512
51e7396f89599ddf0343334ab42802c12b4cee5ca8406d0919194f4190342e906efc1656b638a78b0ad2be6449a0429e97ac426fccc299c12b892b254515d7b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af3c828200a7d67c499e59cf9fde19e

SHA1
800ba4d39b58bf1dbc0b8587cd359edcbe8fc691

SHA256
62b176394943338bff149c9f79c02f151dc38111376b911b97582fc8446cd844

SHA512
435df8e9cc5b21fd3cca3d811c810e40558aff7035d1d452e5a1787fbc953848a1180e0fc65eb49887f292841f6ef9e0ffce8840ad46aa5792aa0484ac748af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b5cf051a9554db875ac72ba4a430e9

SHA1
7359d1a3eddb3e5af4d8defdaada55707778dc24

SHA256
d4795d17445a294a41058c7f33f72913674399cf3ef0ca53ec901c0698abea68

SHA512
30580f13cb3af8ff5a5af55571ab8f17a12e45a739dc00a6e2cce53f71bcac256a1e8aebaebbad136ff29b6292f8c5cf78bad7518c024cfa106c5f83bbb2aead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
435765380c5b35430a40d749834a2b9c

SHA1
6897ef76f9ed8c04f91d898872e2aaffa26a8783

SHA256
e88cdc5e5efdebd8747564d03bdf80d3be89a2c413af22d56f4e09709fa2e69e

SHA512
cbc3532f1e5a0985a03823f971ad549a8de390820742d0eff0a767d40962f6c01eefd25d38b310221df8e9ab78d271f48869962294b2b2c56f6c652a6a7deead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d79af88bdb6e38526e39701e856b3c

SHA1
cae4349184d1df96fa99f67b9a72cd59425214a3

SHA256
c9c2ee37b3f98e0c5a85a59876218da6e92288bd11eb9c914c858b76547e0b9f

SHA512
eef7312779c8cf03e662ad059d650ed48be0849c30ece8b97a37ce7c5d03eeae77ab32ade392de1fa61fd905a8d4ca5d2efcf3fa1ae2040b51e64468f6753c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e8e2dd3189a0727302e28441c77b69

SHA1
b004df3bf7f88a8f26075375ddf5559dca0ae3c2

SHA256
c3c9a72388e94970a70d62c5af61120f350e77be1777cb5b96f37e458761133e

SHA512
7e9e86e877f25a7a0322680c65fec28032328c48d50c254b2b0a9d582def4d11dca68ba64df53a43e4d5722f5db5b873a4612f0fcd83a013e05ab062fb30f2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e40c10aa45f6f08e9930efe6a00199de

SHA1
bc09f714badc0c433cfb6eba0ac3d2e3d436693b

SHA256
8cc320e8569006d98a50951c2d1f7a2dd5c4207a648de4111c4282c92b411c10

SHA512
324b2ee3fc3fd4e2f10b4a236da9b9c9c5aea56c06dcdf94758cd1800264580223400181e31c2029092dd5cceca96519e47b4cbe637a6ccfd0c504a83304728a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff83b0828787f5b2747d407738057d9

SHA1
807e57c19f692eb245013e23bd1df52f204054aa

SHA256
934bc643a9a5066ec4ee55431e21aecae832c1898dbf7bc0897639fbf0ba02c3

SHA512
481438add49d63418e9e063fa61ff04e4bf1cf8f0afbebc660ddabfa2f3d4be803e165a821cf0cf81ce56fbe0dcd9ed3e980120836045076eb7f5f4c307348df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC6FB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD96.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit