dcd87169a5740f98934d5f9f007027893fc8944bb1bde2dc3e74a1063a8e7680

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68c29b8eb071637dbe12a0e6a135970.html
Size

6KB
MD5

c68c29b8eb071637dbe12a0e6a135970
SHA1

788502ff83bbae39bde27688ddf2c796f43e97d6
SHA256

dcd87169a5740f98934d5f9f007027893fc8944bb1bde2dc3e74a1063a8e7680
SHA512

89848b8ce15c65f13c5d370b1afe398de04a1d0771f96e17ea00689851c6f19947e6edfa8bbbde6a79749d9bae9beca4af5841b513d548d4bfdfe5493225d0dd
SSDEEP

96:uzVs+ux70lLLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz70lAYS/ub76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B66A0F1-E165-11EE-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000a144918844933de0eafe57f0f95d7ff47ff1fe0f8c23c113e60f4ae4daed597000000000e8000000002000020000000e2e2e8441e02ab30c9006e923c78539b422da15d51036ae97ced36d4d2579d412000000061f6b8179fcaea92cd756bd102e0fd41fc49eff9d149e5e3eec43c950d76fb3640000000c4b272bc5f6260b52ba7fa8868775bc572edeccdb6e06a1ae83f551f89a1295222599f9bca980e8ec7e28d2a5cf33b258a68889a3ab1535651c087d7715c9605	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07588517275da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000063dac59486b61e26438c7d179b12ef3a64e07bb719f9c618ee2c2584a8ccd84d000000000e800000000200002000000070d04ce9780d0373da1ffb006b16f622d19315cbeac3efa36264b0235e595bbc90000000b2fbbc2fe4ef2c15531cbbe6db7cd7287bd814fc7d85602366e2c1dbb649902b6867300de3a7b2b33982fa8e7dca8b68ddfdae2590fd577a80e1a937f4b9c99fc3fc26ca2acc29359f931e4861fdfaedf73002998aae231a1a0005259b49b5e695a76a5c9543276bd941c2a7ad17d8c599311f4987086806cf7bb5160f2eb68270ee12278864e86431874a4bcb5eb85640000000b43dc8ccd6088a28a259cedb421208165c9848a3bafc6dea8c8bd2028fb2a9de3eeaee7740e023abd24aa5142d128a5f3857fbdfa8aea8f9cb0fa9e02ffe7d2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416515517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c68c29b8eb071637dbe12a0e6a135970.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14054955b168bf6d95fda3e46e4996f0

SHA1
220a5d995993e07a4c4f9120286cd96b26feda94

SHA256
66ab6061692a0b2b0e57a771a348e007380e881ef3c754e86d9a15c8b6e5df3d

SHA512
52bbccc0e29c1a3ff7594770332cb72f5e662c3c781372b52bebb7558a9d5dcf118e0094796f25df193dbd44888283002bf6595fe0ca5f8e28b840d8a0c59063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce5240e2f81a119a85876728f29ab82

SHA1
800ba999331e77283000a2e062e95cf5f31986dd

SHA256
ba82c19b8857d4a5a852a263df5fcabde5806bb4feb4095c6b3f7f47a041611a

SHA512
12e5561b24ff0f30191ab1467d6c208f3d7f22a4cefd1c1f03b029e0b935ae38a9f1f37ff7f5c78d67f4df62809f0863e96f3be9d9155a9c219f02d892f36ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935704186f5421f830813f24c02d3514

SHA1
df321684eaa64132711df49319beba123cde1837

SHA256
c94e830ff382f8a1aaf073637a664510043106764472becd779864dcf00f68e7

SHA512
69d4d21ebbbe243a1a934189cfd8503ec8f901413ca4bc0aaf03dea1f94b2a2ed7acc45328dcbce33a6765596272036e48a248599845f0ca46adde97fd064129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4228cde3813bbdfa74e1e489804f8c0

SHA1
a70140a2759a41055d3b78840d5e9ec92488cd87

SHA256
504a0900ce28f0fd3f6ccd350424e44db4854685ca06b964b12d2ac5ed333ea0

SHA512
cfc9cd99ea242b2fc7ff4a5cd6a6104f32af6fa857e3c9b75e8c0ff4874a45b9c0bd0bfede2e0c7c717a0ad932746d044df747501cf9f07a71184d9e7bf82968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35bb1b08a0c2d534150f2c026ba96fbb

SHA1
e333449fde0870e3412c6f253e313eb3608f6ce9

SHA256
6833a2de827953b4e5053d78eef441b22fd307e2fb2a043b5dd97c3dc8fadb2b

SHA512
9092c1cc3747b9481e4cb0a9f5467aca15df7c794ab9ea588466cce44fc3ff900079aeda1c18647dfd5b46b0bdfb17ef978def0165f974c5dfb5e9dd03ecd852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5ebc094b048d1188b0e15a0041e3db

SHA1
3a5b1d4c9adf701f8b24882d476e5390aec00863

SHA256
78baf29aa6698fdedabaccf7e8d45987465c9947783062c951d3e67d1603abf7

SHA512
edf7d53d9dc3b210126f7d75daefeb5bda42ffb5f77e63af72175b24fca218ac0be71fc74f61c2163e189850ca9b10400365e4193828ccfc5b0f11ab635bc4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d55800ce603861453ceade9271c29fab

SHA1
527be8cf7f68e52981bc44ab0676de0ad4b347a9

SHA256
db4cea35e91d7d4179626e11a3a2fd9e29c0183bdc45725ce2f071ef7c453dbf

SHA512
94025a570ae145186338eff003d280a5c8433283efac39b682cf2889a7eb6f60358c0f624a0256b0e79e4d5dd87f832a12bb01ed28315cb3fcdd592c31027be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
300188d1e7e7eb636434cb024feb2f07

SHA1
9dd1462ccc8377d3e4326be0bc39cb4f827761e4

SHA256
9cedc750595ef0d89fc4f9f9a1c109a48d40c1b5e3ba41513a98e359246b73da

SHA512
3a6040d00ea26d29f8bbf7dddb5fb28b4663cd7c2cad763d46cc1b77667fe8ca2ae5365b9b9b74be386d696d1c00eebe0b6bae44466abbcf7e303f5faee8f44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8339a2d9115a2678b0746b33b12eac

SHA1
92571e7eb7bed35ebed64b500e8f999dfd537875

SHA256
ec86bbb284ec491533bf5c07057a59985ba14a275831754a39e5bab9eb09c8e8

SHA512
e5b3c3657719927b9681d9efcd6bff8b3a44ab231cc1d10fb87bc85f83d88f11ecdb15064dcb55fdf103b570684bff278b66c7c49baff19dada4d802b73dc935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89336a7bd3dc32acc8c323fc00bf877f

SHA1
dd67593ccc678883d97768d2868430fc5c598cab

SHA256
d645647cf33dcc5adeca393147246f8987db725aee75ed8547910175312312d7

SHA512
fadc83347900dcadf43294971127f66d9ae77b755e43d92481d4cbcd17159cce8ad401c8c8142f4dd084609db89fdcc5bce5e27c6b89e00ed22c4819fed8f6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77533a1180566fa3df5b6348ac89315

SHA1
695f487861c4bc30157388ff988232d217ea579a

SHA256
05188f38ad21301d9741cf2614074df08321d07a55b78477080bd9e24e09f1b3

SHA512
2ceaae7a8d5f0f5a2dce02285666320af6835d5dae9a7609f2b10a0617b993f2490142b09c3f1677a9ed4987eff9516761caabef93ef9182718a9666040a734d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32601f6517f85cef8a9a952663b2e5ca

SHA1
e6431e57addc0e8e7683474fd2897b855709f8ac

SHA256
976afbb7022a82b2c8abd6ea4776fd22aad4269ab89c4f2bc3feafe7f143315a

SHA512
c8b5250f5e10532d14bca36f823b1dd6bfb5ea613adee3478bc90287a1890061a25f1f76d48475f183963aa9946643af4bcf236c77ff30822e087ecfa0461c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48215bac64ea8fa6f93766449601854

SHA1
559fac8183b2c5b8e4d785c5b34b1292235a8745

SHA256
9bd7d5305e015153627fd57c53901799909e67b4813b14385e501bbb1da92754

SHA512
8ec6ab3a0f6ce37a170586f96cce5bab35670d15da40466651f9860c94454cf3655ac1994a6fce6ab6c2c30d3785d631a7697c46b9dc78242948dbe065499c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3065.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31D4.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit