aa1d74170e0c64818ae501d0c795612fbad47d251049f09cf310f1c8b4b9df54

Analysis

max time kernel
138s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c643db855f7e2dd5c82c66f1b7285f8a.html
Size

101KB
MD5

c643db855f7e2dd5c82c66f1b7285f8a
SHA1

e59e03039da10054ba0aaa0f05a05b2eed6cb37c
SHA256

aa1d74170e0c64818ae501d0c795612fbad47d251049f09cf310f1c8b4b9df54
SHA512

d909d1d358d9bfd950414ad1d677ec148e5ca8a80d7459252652af650b2b14e122c4f1e9f255d381d758255e73784bb2c30b83e956dcd5afe281f60643954205
SSDEEP

768:LPJc3PgHF41GIM8ywjBhOlE98ZToT8k+J6hiF38Vc:LPJc3Pgl4NM8jBslPoT8k+J6hY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805e40095e75da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003473a1031d5e301cf4e56e772b915218c40f3010311e52e9378337bda7e1a157000000000e80000000020000200000008293c05d26f653d5c9945317c0197c4ac4b6c01bc09dbaf69064309ecc6e5a612000000050a9384338d37ee2eee7d4e9e28d0baea63aff30b4fb47aff4dd8fa8e0a3f04740000000bd52d2316a0cf37f7ac777d4b091af6333b9464e9e85fc7133ba4ccce6033b45dc10413476540c99757bb4879221edaa6b8d1e72e6d5ef2179909af838d27666	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000069e0e79fc8c78d8f838f5fc7312d9068e6d2704920a16a7959970550d3e3e79b000000000e800000000200002000000028fd118c067facf54c7066f6f1fe4da79817a73099742f1008c19977bb0e8dfa90000000f19078585809929f700d9376ded2c2e607dc4f2e122fd5cf17e1cc5fedc18c6d459e1a95965f84b1287d2832d11bd0b9285639c6f50298fb05f612dece3d1028b0ac334b4e7392144d9903e16e91ebdedd0d344377d72bd00943691704203d8430be334cf804336b150188d81af4c25723107232060e4c8bf19b1adccedc888567845a36496c95d98958a479d36577cd400000003c66df6acb8e0549ea42f6039b8adfa4a2eb84ffecac522eb8e9c86839c7b310fec6734cb19302c6eaba3fe309961d4ea2ae744a0581ff1b7af1b97b8950687f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416506807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32789561-E151-11EE-8859-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c643db855f7e2dd5c82c66f1b7285f8a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc4bda786ef0901770c6546c94a9787

SHA1
51f523fb1564c75db96243fe61a916b56bcd1eab

SHA256
5579f131621b2a72a979655c81ebf0569eec3064c7cbbe0fdb627131b624358b

SHA512
a1def6c92e4b439dee62c0dffd0853d7cb494164adbf681bdb91387a1d6887af109bea7df1f2757665a910b34311b3974371c2391da69f86178cc05e6a669b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f6c65d8c8bfc322aa912ff8c02f7aa

SHA1
a206f9a770a05b3b7bc3e0b66fdad78a674cdaf5

SHA256
96be34fc4a9c037cc9799bdabba2b153bf0daf88b1dd6710322c8281b7443e39

SHA512
31a256042e8936333cd0a054aca5c24bfa6b33f6de9ee7985fdccf29f2540d1689163a0c5c07b72294101b9bf41984f0ea1005c77933793402ef371ec4437e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8191dec5599176a723afd42b460de1

SHA1
51d1cbae88071bcfd6e7c611b55f1d7baddf3cd6

SHA256
a80c212fec08f1a9c2b23ee00ee769115b66e561e7fae5926f7cdf05c00d28fa

SHA512
4cd2499f63ec8b94d25e5665a79bdb7655eb9df4093067ab93470184dbfed8c112b571b15e93e754d3fccb851c43089e6df26e22fcbe2bf85860a69d24ad15df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a28f87bea19f4fb78ba980d47caf38f4

SHA1
40fd08f6dbca06dab90c288c099e235429b60aa5

SHA256
2f9622f44a1ea39cbd60898362f2b3c138017b46d53a5141f128e695b061ff7e

SHA512
1f8e40eca187cc45a02054b4f530b3092a0622342c4627577b793528575145785444adb149b684746001b16f34b523a022fed0c59780dc8f63a56a5ebed93b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bff74771f3c889fb974d83b8b538c4f

SHA1
c6daf9173082440348dc84970ac9bd73739945ae

SHA256
bd01ac189e7b6e858a5d2db183f41c828f21620f5739a1451dbcd7eb7bec95d2

SHA512
24d1c9506c7cca173b0ea5ca03c2c62727955f5597d4801faa630bc60533386e56315a70ffd4677b4c988f2614d61d56c9570804420d1d3171fbadb9eff69eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8e4496575c353778f5934bfc13cc5a

SHA1
20286c6dfadedf12a1af944cc48e242281bf869f

SHA256
5a9f6262dc2865785fbf504e1fc346d1112ee538201ab2ab8f3594e9b5c2b7f3

SHA512
e5378f9ecaaf5903038ae8e932010544f8ce8d85aff5ffa2ea8b2d249e81211e4bc208a1b8bce0085e30b0778d0a19d8fdd6d85b25d37614aa99d2dda3759e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f71cdb9012ef4c0cc42b6111bbcaea47

SHA1
cc8599f8f1c0d4401d85738e3dd429d171b2565f

SHA256
8b92c9bc3e3705503ecb2ec56a05f2e74863e6db514e062276ac5631810192b8

SHA512
d3a89050c1b690458aa56447940d52d67b62d89347a86c35103119bf69f36c44e01e13f27e5ecaba6cf358458ee0b69401acf2fa6035ac897df945fc3ec38736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e89e15afb0a2a6ccce27892e9bd708

SHA1
e22c073df37ef7d6e5f6766bd55c84e13866929e

SHA256
f4d2795bcb304e588eb6c3661befe7990502545efee5bc5b30697df6ae8cdfe9

SHA512
57d1aa7f27cea9ef23b4ce5302c7f20e0e0df33743fda9eb4ab49601ceae2d0828a61b439c761d6f543d0e9aaad28ccb5d4fa8b973004a505ab9c666465d094d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af573c1aece91e09dfc88c57394f529d

SHA1
70e5c13b9cb03faf7d0a4b7c65ada64241471871

SHA256
88734bc0b721dd70aa3bfdd09643ddf55c8a21288d5a0bea0b634a763dad4f66

SHA512
032ed321a872e544a3635cd3675f17cded6f50233f6a748253a7a83de0534860e3b01ccbb5c52f0f66801c4475c7a326835050a1ec6baa688d83612c96ff2958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42dd555ed3ef78707b3869792c303ee

SHA1
df5852fcffb0a048f1eabc6a9307a46f11b3811f

SHA256
35bcd60a8468f29f38b649034c77fa29f0d33ea18070eafbba0eb5099f70e480

SHA512
6d78d389daa8caca9af3b2288cc9781585b27ae7abc8f6002516bb35025be71432afabb43cc07f096a1226e8025dffa1d65178daef5190c192be5f973db2631b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5caaf1324667be420949352a969bb8f5

SHA1
a6837fe8e643826b030a0391c68abc76a87bff05

SHA256
0e44f59db4a98cf2c4bff5110676d327617f0031c4b8348b33b70e949dbd48b4

SHA512
295315b3cc78a1754cdc8a5109c97e2e410f4925296eb116c2fbc274cb389f91f6f9f7f2dab2088cfb2b78edeada606d421363f5dbf2ee4ec9c9e22457c6c95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8737ccf6dfe79e7fca1b69deb4e5c120

SHA1
27cbc73dad375f397b62d2078d266b82481a4a85

SHA256
e8788c5a0814598db576ff95f62a2b992044c8c0cbca9e319d74aed0883cc23b

SHA512
391630bf7a163eca3f97b5c4ca9a5f7b4df8d842fbc4cb3eec21cc9de3688052cd1730eefbc781761be04dbbd4b1cbf04b997f1f777ecd7e84b0b926c7067b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e669f96e7eeb9681deec113030aa88ab

SHA1
6ec9e1b16ca63bd2639baa1e84c1cbba0559ee18

SHA256
b08cc56ac0971123d0a74af02c9269dfeed7a5480d43d68d01b68bcb9a09a40f

SHA512
7c04e5595c6421532495d9c4ea867b16bff47ea58a8c2bb7c0b46c3577e141eb445690096456067b7cfe428793cccf28d91464faa516583dfb496e84434adc4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6dc7989f43abf541f79254a71d0c878

SHA1
670358ff1764e1e463c953b64eb5d9fecb8e4737

SHA256
e89d43e83f65e4deee9942efe875639fe991cf97cc5e83d09e367bdd2be81bc0

SHA512
93c545f2aee3dd4b7bd07a2a65e492b618c9570a411d65bf1923fb01ac260257cab4e15af42d857f96c19aea2d9d151f16d7ab9414d6d4edd7c12cf8923c62c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D1C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FC2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit