e22030b5cbd31d3c0dc4b6456ebb8365f2ff07f88a11a8c8b5c47fe40dfc152e

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c629c118edf02cae4fcda9e52d5310d6.html
Size

62KB
MD5

c629c118edf02cae4fcda9e52d5310d6
SHA1

f7fa23cfa05e64be6b59f4481f1c026406d0a196
SHA256

e22030b5cbd31d3c0dc4b6456ebb8365f2ff07f88a11a8c8b5c47fe40dfc152e
SHA512

134099451a776146f67753d7c51df87ecce290ef3c6262307c994b1a154e611685d47f0ccfb004f853a987df815b4a7d4d3aab946f7d446270cfaa4a475e6235
SSDEEP

768:FW2Y3evwgj/Sbjb4MOXO0io+rIc0cm96we:f96we

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2D6B041-E149-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416503613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000af0c37d6fb3f5862f8706aa6034b1ea98b6f33d56378016b350cef9aaf4b9bfd000000000e80000000020000200000002c1ef10956a97d12c36f58ec00226a4dd233a8d91d71d1fea7b3cfe1c95b6f57200000007df61953409c8fa083a9da810313e342aaf3fe9d65135f066f2e5f580307fd5540000000cfba14aa1f3fd04abb5c68bc7bc4301d2ff5c2fe6aa6a858bc5b01b222d70e0ef1ce1562601cd24325a404f07d91b57264a9c71cb4436b9e550629b2b9f33a43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000fb49d3046d3b89ce636a5fe96ce0fc111ff0c3688ad58666e473ec70878cac11000000000e80000000020000200000006c5d2d00cf556968d9cc322a362a763662f0e22b6ada60c887b6066167a39c1a900000001a76bd7d7541cfd24699bb2361c42d903e9369d7928f4ec66a248dc9bcdf5a1b1ed88937667c5cdbe8f3e1617a7a6b3ff1c9215bd3db4abbc1f3134ca57169955f8648fe39f07e70c627039328e93a1acbd1dd3e712c6ea1738abdc75eca3abc491640d8a4c6980dcaa6b10fe008d994c7de9ca4b7657276208f2bf145d2982328df981c7cd25f3ed8b7b3d8425c73044000000091a4d65231188aff5022d22f6cf874dbe165dd32dfcadbb2c0547214ffd9e0654422a365189488bee7ec92a271d97f94b34075560b59cece1ea6866693b44023	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04071975675da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
776	iexplore.exe
776	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2620	776	iexplore.exe	28
PID 776 wrote to memory of 2620	776	iexplore.exe	28
PID 776 wrote to memory of 2620	776	iexplore.exe	28
PID 776 wrote to memory of 2620	776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c629c118edf02cae4fcda9e52d5310d6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae6a9d56f7b18148e67c2e1bb6a53b2b

SHA1
3aaefe1fcc241e0ec5d70a44c3b73b612d7d406c

SHA256
af01f5cffee9836a6ef99c1b55068d3f64fffc902ca3dae0d33682d4c2f32673

SHA512
f9334ec3116a0668a8eda969fcdd5c4086bcf249aca98ebc02303a85c498827d90222d8aeedfed508722f96abf41af1927ab957cfe5ff3eb6dd3d83d5b515b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b04c5c301cf0722c7a86d4981abe5a6

SHA1
939d22b57c4a1a48513357ae42d0b9e7f38f478e

SHA256
51de783b88393cb0cc58bab817a1334bbc3d210d5c7ebd36993c67bf93c7c850

SHA512
b2f5a1c34b439d59ea22aafb2ac562a5205dc7c282543fc420297d2a856bff615f2822e046c2573eaf62e31b0d6be695ceb84154b1c4310c4cb72bbd1fa00737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2944c1ad6cff7c032720eec5f21ad7f4

SHA1
b2180355188a2d00290a6db6591a6c5b1d297fb1

SHA256
a70bd8baa21a17c782130e3f489de10f72afd02c388bac139022cef31685c206

SHA512
e6f51238894fd2bb3bf9da189b6e83b598fa7fd8849103d60902e8c4e38ea9d3652b6a80b08cbf7d13e7a566d26b04f8147db7c928f8086b87fa484123ef9d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad7d8d8a6e75fc2f17fd70fa64f6ee8

SHA1
84bc12525725055adaf6158af093203f1980617c

SHA256
12d7b08dedea3b38bc1b47d71ffc5c32c253ae3ed01b873c53e6a43b1af4a02e

SHA512
43320dc025f7597559e927edcf09375a0345989aedb589db2cfaea8a3f0fe3f52779001f93cda1be9039d57c7e26c109727163fe8d3c8060e5e510b04ad28eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5807a81e3b663299381bb63760a80c

SHA1
ba439b585b5ed4a9da80e2fcf8768503acb024ed

SHA256
cf43f8cc64c67d48cd5df7773b748657990f9e3097fac24a2c38e52b1d4616fd

SHA512
d246b2de9dcd626eacf66554ca761583f4b23f5169fd665cecc20fdea4a1da09b5789716f53b7187f361661b0e4d4a5d3d29fe6c7ab84b0b8e45932ea9a2d4b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfc0a8bc3b1d12fdbfd4c2ae0659a029

SHA1
45c86e2cb3b32e895cc26007dd32476961f041fe

SHA256
7fcdcc9a2740ea48d6c9f831db587085ecde4bce3621bb9ba07a88b3eb6ccb9b

SHA512
4a696a26010ec4855befaf3fbf2a6382f036be728ed7644f28d818835019df2f728db6d3b797a9e18dd283757914d6b99e32d62c62fe77aeb00243dab49e0324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
880ccf106fec926c9bf4544978498da0

SHA1
ac3edff3fb5a7127a8f925522911e09b4385c91e

SHA256
733f07b4f7e3b77d3f3604c3f11f8f1c12e4559190a84f2c5863b7447cb1d075

SHA512
017e4803a5ca7a6f4690d9696bfd2b0edfbb72227c1ee12b9da3dbc783083287ff0d3a3611b2c486e252d5610ded23dbd94fd1ebdc31309bb08fa7726773a23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565e95d66eeb8fa4a9d19bc41258e767

SHA1
42249416dedc905b8765e0bede5b8e6d957ffc57

SHA256
43e171d00586e36d49fc9aff3adde2d2cd003696f0fc0989d9e97faee3bb8c74

SHA512
29c982b459dbd29a8cf1d8f070a49b6fa39660a543a32dc4c94841cda566dbaed3449ebd8996e60e0b4e862c797d177b646a0b0ffb8cfa1704795b87f626ec20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ec971b62cbeb811b98f38947c00d7f

SHA1
3156ce31bc2b81172f6eee7480569db6b774dc8a

SHA256
2973c31cce641fd5485bec98bb85e74581b07c35d146c878ea8e6a991fd419ef

SHA512
7fd5c825ea8ac17f7ea928d15bc01272aa239f6828ab8b769107389da0d57aada779ff36ef8a0f13b58d18d9385ce916f19b18526f8268c5288571da255a6cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c018360e323779560a74cf5b6750c48

SHA1
b1be54ee5af9abdcce49fb0f1bc71f0852d04844

SHA256
bee627e7d3e3f395073c70ead136df371dfa3de0e9c3376dfabd1f1c8ed9c75c

SHA512
7f88b4c0c68f7fc21af81a7b238f682450d677d2183b3076d90ca5da945cc055bfc15529496d5cdbf3470ea499504cc7fb58efc8f4e329e6a3d1180c060a9b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EE0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3000.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit