bf5375ab02b4b2c031822e2b71c02e46dc14b29c1cd2a566fcc23f207048814e

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6a89e878e605c7ad91009764b442ae2.html
Size

10KB
MD5

c6a89e878e605c7ad91009764b442ae2
SHA1

13b39782b671e8da748afad2d9d08daee0ce5ea4
SHA256

bf5375ab02b4b2c031822e2b71c02e46dc14b29c1cd2a566fcc23f207048814e
SHA512

9d4cc8a17611baba4aa1850152644bb0341412051cb50ca95eb5695f16b4c649afbe25e04e3ca9347e69ba9cc6471031a42c2119f0151b616623854a25927d16
SSDEEP

192:D9VUEz6u4YKZDBZTWNibJIW6raSspgYjgwgSPmK1QRcgOaCcZgLgY:3pKJBZT0i1IW6+6K6IaCP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416519088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8CB8CE1-E16D-11EE-8A90-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06270bd7a75da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000072fc1e712b4cd451288086ae2c92f456b5227de5f266101aca757c604915cdcf000000000e8000000002000020000000aa123c9d5c7cf9d925221bfd9b072430a733dc78166d28b1a5b9225ad3ec4a13900000007e6d886e85039aca1801d1724daa4094447a7f7db8ad4e35e44ca27df7347904e6e7af903bb0faa11aac00294c03ace233f6ab88d6d1d703dbb368d13ccb11a1398cdeadee6cd5e430cbc3560551822c9dc4cc33e7b483ad5afa0b4fb0a6a10b5e7f1a5c65529c83095820ff800aedafec9c7ff3109f54f490b4ce0050903c01f367fd2980ea4e6992b7bfdfcc390f0f4000000089cdbc21a7d8a5b8531a81dbdccf0a58617a5e7e917e87d477f3ae06476bde6bbdbf84f736484f0b197658f72b2b93c090a4536139caad05491a897c2f8c82a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000001eafcae64bdff4a60750b35adb90dcc14f72bb593f5893cd4d2baeddbe64fc04000000000e80000000020000200000001c7a843a081f03e4c21740fde3993a806436cbdbc6e58fe6fc9ec85418e64c7b2000000016e480bc0b626e87c902ba4746aca405c92fed4d80d068f546f314eec13e55f24000000091fcd243de62fb7e201ea7164f305f1534831d25914f7022f65ade15ee888899dc6fe40de076f8c4ebda39644fe4b9811cd276dd36c9b077dc262c0107279dde	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2392	2252	iexplore.exe	28
PID 2252 wrote to memory of 2392	2252	iexplore.exe	28
PID 2252 wrote to memory of 2392	2252	iexplore.exe	28
PID 2252 wrote to memory of 2392	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c6a89e878e605c7ad91009764b442ae2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10a0c84196ec4400fba389464bc978f9

SHA1
5e40f86f3f1d9dfa108aa6179c452c0504fd2e7f

SHA256
2e9a90e357571fecd727f84cf7d9fabc8b512c62936e3ef9d5e82b5d2e5e8f7e

SHA512
d4416e6e014726bbf3b3155b6e1dc9fe2a0333ff5721a89f6043ab23bef53649a62668a81a035b2f474d41dba352e352e33f85af4efe24886a2161f1d77082cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffcb296b6fca89c47aea038c48092b94

SHA1
d147912f06509b7a116b318e34b4e0c6b6813e72

SHA256
e521b0687b0fea925e94dad692478b38aefb411d2257522b01a135d54d446f0e

SHA512
3bb35b276f5ec6d2ea2a26a9cec45c91182dfb6dee85831a99a4aa7222abbc78d74e526a3e30c46d5fe6e0b5b8dac18a70b2801919ef16cdc02c4f3113a57b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc4cb365edd84230a8cf724d1bfcc3c2

SHA1
ff18322f6e0b9b37decd496b9205009a350147a1

SHA256
858fda7fc69261758a80bb4876d0a564fd550e581d2f0955d406c08013ec29d0

SHA512
77043eef9b373af5b9c3a4268e3c87d07cd7767b22f0fa83c692e8e4b59d8504785efa686055f77da203afc8d9bba0e90647ebfda04ae5f94ceed52ca354888a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d46168ad398a5b08b40a44da4e13d2

SHA1
5bb1ba1f4cad58f76bdbdad46a6e919cb89845ee

SHA256
f03c54f7aed36c5e01f040aa55bf15f78f4d20842e4eaea48d3bdd0730fad69a

SHA512
1fb068e4a66162e8d596df1b87a0cc43692029314876dcdfe96a254e8f026bfb134eb51eb5917ae2a3cc0d10aa4c47ce3f0ba0c522e3e1a05398a8de82f4e1a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cf046fd93c24f0f492e8137aa492ebf

SHA1
4300d9c11e05e7e929e1f1cfd2f4697e97f0ab35

SHA256
58f46a749548abf9711eaf0f6511bd33c948a8adf989ee9d155bdb08c491a5e1

SHA512
e12083499448ad8031a2ca8087802a39edd020d5ad76d1aeedaefd93fc966c9bd31386631246d94a9357cd361034ba9112bb8b5303a465547e2c042a2b9eb0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40cd4b7214f2875a0ad89cf0e9674016

SHA1
bbc273e873f0bef0e0cac3d557fe0fa42458e584

SHA256
d802be2feb614b95a5b5687553f2549fee20b1cb606e54ce0344169714c23823

SHA512
378bd9c62a4994d4ac397d023e0c10f4712c76b50e7291537495f9db76fb684cc7fe8f9fce31b563c2477f28d91aca1cd63545bd87288f94dcaac1b18fe62c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8e88107f2296a91167920a926ffc7b

SHA1
0344cfd7c19823f2a578180796335adedd3dcb00

SHA256
3f7ccc7e38dd9a0686f7040b1ff73aa9fd5b2a08ff48de456be541b9745ecace

SHA512
06748b4387356f6c8e548826343adfec3fae34041f9a0226304e39d623a9b64678da595aa84de9bc89d42dbc5a0ebd31c59ba15b48f3cf9ec755dc88cd235d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68924d53c7bdaeee8eb19c59a5c5515c

SHA1
91acfef49bdc291a6e165d46e3a48f700bac813b

SHA256
855010aa9b8ae3840c2bfbb5fc7844db871e48bac3cac124c3cb8eeb0f39ed69

SHA512
d6f240dbf00983ad26bdd0135951bb3d1f7ff97982e151a610f2db064733ed2883069941bca349389f2e03f9d4ad1beaa314aa07e9a1d31ef5a2fa4d6c997fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bd9f6466efa625b5589baedf8cd9484

SHA1
f29ff6c72764dfd9319ffe33d38ced147e23eb96

SHA256
a179e0f9d27abd9b8a2051005b760e03eaf20ba6d9452770d119c8a1fd317ae3

SHA512
87754ac9869bb9ad498ad11af5ff46678b08932d6802b6a550c5ea0365f1b5890dbfdb9d3c0b4d0dc1feb1991eecfef9d0124515d3e148f2b8d8e9f717e1464c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d383a9c01c62230138417a3174552c09

SHA1
28d1428eac05531193135ac9e7100c21b1bf3204

SHA256
41f78edd457ab6586ec97eebae084e02ab935b84c7c2ddad08e5818723a7daeb

SHA512
29eb4f53329473254810343e8ddb896fcf36fc17eea210eece97d80bcb7aafd507b5e130d673f3494020eec6cb43e8abbdc3c9f850bfa4190f411ccc2cf6c529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29755e1d4e36d7f5d0ed645d3d5f03db

SHA1
cd2e85e236adba7a1a0a83b94e3922e2da490632

SHA256
09fe7ced9a6f74f7fbdd2e7007d63535b45d31529b56a0353916bcbb5226019e

SHA512
c7ef086cc2dab804fc562738b571dcc8c46a6629e002d1eb4c3934c69fa4f291a6e878fcfdcfd0255d793f2eb1096e59abf3f980339be508f7b91e58fd1a9ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca827f1892977bafa1b7bad8bc27bed

SHA1
f1fe4344b2731bfa4678e5f4b71a7e7940c04775

SHA256
55a7f0c22e47c7ad11bc1107c2c21571ad13a6de2c3b4240f7ed58fbfc241adb

SHA512
ec6bbd79b3173b500fb787102a95563b7e67affab16d80059f78fa4978a74c1b84ba22fc4a862bfa87f30154e15fdafe78243845111f92f72c70134524cbe34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc61f3d4a62505bc993e96a5395c5481

SHA1
92be3cb503696ce2885e4d50981922d5b875fde7

SHA256
fd444df0e6f80c1acd7809767573c2bec0e5ed8d5eacf07ea4d771ef0c704808

SHA512
eb013c39d143cd2a14178d6223009f2a7e09a14bf34765f399723c7803eb55ee5bd7530a9330ef7460254820b56008acaf98b8c9f02a6e8d3352b79841e3bdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab366D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C8E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit