212bc3ead48049a4a09b9bc2fb3d058800a76d73d82fe345e2db931bd270f2de

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loadmusic.html
Size

768B
MD5

3f7774f9ffbb9e58931fb8f77358ee4f
SHA1

ff0d8fd68d8b8da607c5800e574fdb9982f822d1
SHA256

26da06ac12aaa441c2ee1f17ffad0d647c8b53f04782eea416a3e3a2003687e5
SHA512

3ebdf923f5c333dd840343d40931a9fd6ac9fd0a4c8de7c617d17bfcc69fdc59551a0e04c2e43702096c4265ed836dcaeb86d2dad960237a38b49be3680cf206

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0372fdb7175da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000567f05bea83cc54290f400c7c486ab3d8115a7008eaa63afb77a22e34ab5abb0000000000e8000000002000020000000bcac85587ed653d956f886dda16b18e36c544c7a434c264bcf1f62f924659cdc90000000aa6d9b1feba2d3ba4983e62cbbeb85fc341790d649f1d86eda8189471181c4d267c8159e462a07b106d815d17e10ef6aee2e756110cb578affc3b2979022d8b7ee064d4e94f47df3fa94a58771bdd1feb39491ec91a613828534b97bd2eb710b1e2d09f5ab0b39129e883f657717102bbcacc3407eff9a005024a83510f6b2a7b109c19d5ca73acd96eeba0a06875585400000003caf72df25fc72c69593abe0f0140309a46bb87821146c3baf7aad496e273c186ea9b91fce62766b7b8eb14a7ac34a604952ef88afc530ca64b3eb16c6ee40e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d561f966331e2ac0bff2c42a6d8105725a23e8736f2e36f5d3b9ef1364159f16000000000e8000000002000020000000ccb3978b8df26b92d45041444466e7f9e4ab6229dcfa715e4ee3d586dd2ab87620000000de519b8f9958cfa1db48a9b9032c730029a63b9688e19efef02bfafe7b280c5d4000000008bd23ee4567aaf7bd009d4ebbce6afca9a79f2a7b2db7ee1df898204ef2a02bee5eae91a5b1de9b4041a7939a3b648b170728bd280c2f0bdf954c4df458163e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06902AD1-E165-11EE-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416515323"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\loadmusic.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
399d69118eb2b31139af8980b6244228

SHA1
8e75420181860e9283bc7a9d624626463ff537e7

SHA256
ee87a68a6eaf644bc8369e1e371c791e62a0a0a0b9c42a3fe23fa48a6ab10682

SHA512
11c5621ef9d7bd9c6ffb724e721b8967996ab9ecb69c5e7a59e90f4e5bd920bdba2f997410ad0d8111be2a9ce25c284d08e1e2cde380a50d40db34ccb60f78a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51d2eff24c9ea8f421bb97fe062cbd5

SHA1
9af67d9ce0f0f7cae1183d183d88e598dbf5de1f

SHA256
a7f6c77a9d249376272003f5460f9dc1f4045b0e68ec547cf2c4250357b2dca6

SHA512
013386011b1b75578a0b03f485afe2cb29277da27f3c240f7f7c45e51d9b09146d2f164bb8ca45c262d8c5c69b0c6a8316ce79595e542335a62df529633a3ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3cd14c62c16ed24094fadb95ab06872

SHA1
d00ad46463e38669da0c8336e53bf5c13ef927d8

SHA256
44110b44b2f68083a43e5eb47415050f0e175c29af9179b9c2b021bbcf55501b

SHA512
a100a8912ee37a11b18eed3dcfe0e07db86b5cafebc1555f3d5fb7d01c1f6055ae43e381818fdd110a2e00f2652fddf1eb9b90c31d7942d09374d7630280e71c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584fe2c50e4cff9236e22f3888c845ea

SHA1
73a4cf9f5915ea002eb0ec52471a382a96c5d2b5

SHA256
6376947e2f1f555c064916b116dcf20c03dd80ef78f926f502577e3750abb9f3

SHA512
7eadb929f1015a7849ccffe4c744a6e8e742fc95cc728385cd39599c0e01552304d1cfece3770f92c3b5585e8f058ef253fa6d2cba0b1a0c57450204f6f093cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b8eeb7952b23fe4846a25d36b55813

SHA1
230a157fae4ff58667526386a4a1796004f9213d

SHA256
5bcb0ca6018548886654bb4b318a94bc19a41558757848ae18779ecf0af7c274

SHA512
00b282490b5158097b995c0622ec9cb39f039fe172e7fc5ccb891edea7d2aeb4d6e7ff3ecd05e29a27539fa41876f7ba1861b2f3d0b6d871617556a86624f98b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2007bc0788b61712fbeb571d91d0a7cd

SHA1
4e016e8e0a787484711597aa76f13127b33d1a7b

SHA256
c5195016e035aebf5d585debdee12753e16bfab8ca92878dacba6e6f9f7c9a72

SHA512
ac2125289483b798b5effe3d12725908b99e1e4cdd9352fa3a1a52345a8429f5ad8690ddb978828901246ef265685b0dc41f20a7dacc209388510af13b015f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d172b6cda20b402ff38e480ad47171

SHA1
d210e801c8c575afd3b619183734d390d9469a82

SHA256
520bef8335c9d568ad2067df4ad9f13b4ef038d599f9459b18a4e867ff520248

SHA512
d7f84f51ac47181a88e2e23deb4951ebdc205bb3b4c13af7cb8d94c60f461912b7363776106807e0c20cacbe3de7cff9d4498d0995bcb88647e7727b2684b7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd879d31deeab5b3733c675aef0d996

SHA1
620107b56281dfe2e2b0a4c5b7ec8bdc228f4feb

SHA256
8baaedf2c1f03b34f803620209988d7032f14dbf9bf988e0d67e5d678b1fc4ad

SHA512
bdc0c1db67fc76774ff99dff1f6ff6492296349c3984a1372f13b36237fac9fe8cd4040b69c76edfe5e04b2a33147c55df92aa3da39bbbb8fb13b2a153c9858f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abef4ceb9e9d3ae64c30e65ba493bbed

SHA1
131209757fd99643d197f15df89ca6375034ef90

SHA256
9615df122389eb8a5046f95b4c7697775040d77fed93c68e3e6e2008c7049e9b

SHA512
04bf79a9fd8f3e1e7dcf7139ff2c6424552544cea4d8f11044a33ecd6bfc0878e1c03558e1426496cc59b4be8ad211a3c0fcf7ae694439ddc740f67e6fe1eb56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8b15167e7c697cf37275cef5ec20ca0

SHA1
71b012066f9877a3f903fcd0f70b1ccc24beabcf

SHA256
9e92e8110c2126978ab8ebda64ffdf542d281773f31ef3f3cccb5eb007c5e28e

SHA512
9e4d31f9d49312258ad7ea5ebc4a8be422064f8ad722c41a6036fe9727cb54badbcace69f9a9fec9d51a4e62b7ec6d95da811b8a0eae7d6bb95f418f55c519d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec6ed116b33953d059870b90da3cd6d2

SHA1
df1e9ae974e20324564d3aa7a1e37725461c86ae

SHA256
834ed5c1cc76f59894a9de3ef4ac138bff9d1d47d6ac6d72e807d34a965ed866

SHA512
50ac819737403875b0b39f9a5806bbbde9719f63a889ecb2ece58a6404ae8130b0c179e56025dad5fed754eb00510b3d44c4a40c1bd9858bd3cb03ea3e4db7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f7207e6ef59ce71aab634a1a08bb30

SHA1
db3472e42d1ecfd463c12354c9620c2c76a7e3c5

SHA256
44ec1f3ec6727e4980d6c1cc1f4e4531df38c2652b72763727584af5bd3a73ae

SHA512
c081c66314d5aba2d3bc41548658dc2f7d7a2279bb9dcca10c32b7991c2374e4c3009cbaa8505777111c1c45d438a8f26041172c3f8e68b313759f4bccff3066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
295682bc16307cb6c8edd86a875d5202

SHA1
b0673bb02dc621c900f8d405c1f3284dae5c22a4

SHA256
8e57baed67dabcd834be19f7501ed5c527ae79bd996d6d6c034a6c6b9291bd59

SHA512
49d0de939ece172520175c41f6ceed0f8eb625e69122b2ac434a8f0ea68d5afaaef801d4de3033a2fd8cc5f62666bd91da4fe5f769e7caed067d5d6cc6918ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ee4001dc2ff53ee8338f5d06362c59

SHA1
defb8fa90439f90e8c7baca231cfd5ec832f3b07

SHA256
91ef40222b38dad5e4c2ccff47358f19005ffebff71bd7689e52599e6956f244

SHA512
405403e494c4de567731f7cfa5c8f5aca821b96e7db391e814c175ddebc89aa19235113ecc52cdad8d606a3dc6168add6609fe1defa8b965bd700d77d29da68d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DEE.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit