e33bae1a6a17f622a0a4295b9ccb812f6813ffcbabc07448ad43408905cd5583

Analysis

max time kernel
137s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6c77ff041f3c54b5af3185e3ada1399.html
Size

9KB
MD5

c6c77ff041f3c54b5af3185e3ada1399
SHA1

d6356c7dc8b5d9762be19edf37d9dc8e9af5e532
SHA256

e33bae1a6a17f622a0a4295b9ccb812f6813ffcbabc07448ad43408905cd5583
SHA512

df3c3f309333fb516c3cb2190058254997ca30b86c578b55d088cba8c4a78f0709c71acb948c874090323c1877e3def5667cbed7800cf108c3cc61a89b028a9c
SSDEEP

96:uzVs+ux7ZOLLY1k9o84d12ef7CSTUFjGT/kzupk8S7NqKsKlVHcEZ7ru7f:csz7ZOAYS/EokL7YKsKPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000e055db558aea6a40a803f1ce2972dfab243d2d7bb675953d9562225630638808000000000e800000000200002000000014807ca48ef3b759b478336ec5b63fc218c293409e577ad43946a219fb25dd7b90000000c8dbad485898b60600ce91b960ab0197f6a2853b6d92c9f89874851d908d943b24bf10377ecfa0115bc8501acdcd74804c3ffe3e5b3281794a200b72b18b2d766785138674a15c5c7c4bdbbc1424a28f023e1f912d31c56a889897db6fc246b04bb2a5c875a591c6d64f9527097e1b0cac466b2c568672edc2286c086f34f93f44789d7f5c7169d28c473894aca0866140000000b8abb044b6610286160d8c2b02b794e23b2a5da705cc89544f42ab5dbcf7bbc59c84a649fe7325d752fe16014fdcbee4fb9dfa2f818393f35047c2017e81c2c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f62f4e8475da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76E74D61-E177-11EE-BFAA-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000c8534d8b19f0908979818ba8d79f040bafcff7914815d7bd071d7089c43fd064000000000e80000000020000200000008bac5ca129bc59b138228e50216c6684bb6073a62e9886337dd7489b6d90187520000000b9c8dcf58cc2801004c8e738502a1ea089383fe239d6a1e3978b10be157e010d40000000ce14ab6b1333ae75db6ed5a62892b0b82601f88f9ad5ec3ff2edba82ffdecb17f0976488c08b36a575dd2c42d18b617677418ddda332a83e7e4ebe86bbb87cdd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416523245"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2908	2488	iexplore.exe	28
PID 2488 wrote to memory of 2908	2488	iexplore.exe	28
PID 2488 wrote to memory of 2908	2488	iexplore.exe	28
PID 2488 wrote to memory of 2908	2488	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c6c77ff041f3c54b5af3185e3ada1399.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f82e033035fc0d44d450beb60a90450

SHA1
51813be4a35a1b3430b4f9660a85ff08be0796be

SHA256
242f827de6335723da4c1e88898e18e57a270bc8553bc4c66a32393dd9f874aa

SHA512
ec545221feca7a2fe4fffc853634e71bc0be4d1bcc88c2a3cb4d001e761b9d155895dc4744df4a790091a276eb8e66f7687697b4fa06aff02c71ff7a72c8eb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c531d2e3bcf1dde33d463e58876d73

SHA1
6debacf546af40b40719af95577084e98f0b2d73

SHA256
9b28ada1cf047b3ab8170bfbec6f8d3dede9ab41bb19331ab15091ca2aa606a1

SHA512
fdccb2cfef15432ae32efcb48de8c977e9ffe533249a6eb1247cd50808c44fcc498da87386e6adc8c93daae3b09aedcc729250f3d55457c93caca323ccb93613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f109be722d128906c85d50990703c36

SHA1
1e2b5e4934a81c18b9a53ddef3fe3b22552af972

SHA256
cb68885a37c18185124fa1382e640b8c78972eb46d162e7674b3f938b4cfbe27

SHA512
b66cc7ec5183bdf39ae2454f8151a89d465ff8f71131fe17898fdd66d42dddeef1ccd4da22915aa71a3e3b7400f05ea11f4aec8e0c43901d07d7cc3f82c9d707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9b61b37ebf8b6e21025f32f52087ab

SHA1
de2d9dec38920f1eb9d111b014094bd088cc17a4

SHA256
d86aae9f43e73337cba178d2d508a73ec9c4f777ad43fe9674acc02148ba68ac

SHA512
a7e7608e36aab4483cdf6fd2f4efa14f2a2a1dd32f6e31656dc1c5c2ad07ed8090bc5ece8d0108ada568dbbf7b38825efbe3354eee18e0fb66cf616661599e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50aabfeb20152bf447b352ace257cc04

SHA1
fa33aa1b67084166fb5aa944c1769fef8f46edd4

SHA256
7e813691fe2253245e8cf051c0bda3eba23622579a59b906670460d1548d3883

SHA512
795411c161cde546bdf82739d117cb0ec215abdeda5fb05f68bb340c5bdcb194677ccae07435825bfad560c05ded61ebc46394d5eba677e45e1d618c906eaf8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bdd0f22431f043f6ed80d91ab507d7e

SHA1
9b6be0dd0fab7aa71ec3795c404b4d91f0147d02

SHA256
897d1c7f77a63cba88bf8698e342d676e5f6c454fb500bd6d60345f45a7e8b9d

SHA512
8c1377a2bf2179a6c04327949e525148f45ad11ff5b26b8eb7ec81d9ad695087212b85ff06bf3f67ffd64d418ff023b6b9f71a83accc576a118f0904306a9c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25fcbd58d230351d777dfcb5f323b2c5

SHA1
5bf266958807632c314cce2abbde4000e8fa9cca

SHA256
332f9a91a792c5184d228e640a51a4409cfcb4e9d63bc8390810e4a3101ca4ec

SHA512
c3ddff59231e469da75e5a5e26792222f8e9377edf4ebebb308ebe712dce67262879a233be9e8af8ff1aa22c3783567d7e3047108afce08cee0fc551228e114d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6b9206e9adb2b87cb104d4a5513ca44

SHA1
ecd104025e7e9c1ccb81878059fa06ade1782bb5

SHA256
f9368ccd66a88c56af43cb6a691be5ea07f0ab40ff8625e793f086ae89425ac9

SHA512
81088fa60162d2bd8470d7770ae1ec0d78ac4efa4476b14fd0dd7be7da885306824232f0e3eeeae08ceda8758bdd953e085913c22c593e6810139a46e33bc4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44e2ec5c92cba6a614a67b6d20a939b4

SHA1
e741845ae85b66a9b813e1d08294215077d3c673

SHA256
baa99e63f155e80f2676419ff1a9ee784787e5f8165fdfd05e38870d9e345fb4

SHA512
c56ce28bb91990dc643023a339eeda8cee97c54a72ea24d32231de744ee4e16c8fdcceed5ed3d8e48cbee0d4f7792e6abfe98530b5690552768cc52d4678e625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
013003b196c54348b9cf2ebf8638ecda

SHA1
14cda034b223a47ca5147782ab83f6d4afb13ace

SHA256
55cbffc6bcba8d842e48c510c323d11357d92e90eabbbaea01070c805b270c75

SHA512
e2d5ad4f03e53e6559729f4007a8f435efca2c99667661fd055e0f4a8676a94b27ea5808c2914877e80b51258569a9d2b74c2ebfda02fe95523f125768fa4d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21dc4df93a83e2018749b5b44d80b8b6

SHA1
c98e48f0ce4304c8a039fdb35c649604429208bb

SHA256
e651381c400779e4d7fb599a71f54c655027417e88991d2a1ba2cb0b9acca33a

SHA512
b7cb4005fc4d63f8346d00720e4a8092b1432be3657f5bea7eaa23e3b41b93334db1a904e87eefc296cfe56a8897085525d79d58cb97944a13a5c5b98acbcacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3dd585aefae179744600c4bb8943c3b

SHA1
a0ae2cace9b4d6ce1502f53244fd8240ca46f7ee

SHA256
42c01a23f5899382a6ff3d3eb395cd62e3fcc172ba3cc5520c0ffd3dbaaa416d

SHA512
0de2aed2ff453ee9f659e420044162cd1fe4bfcbe6387180efc0f1df5778a892ca0855d28796f119a977cf22c672db132017c629cae379d5852d0904ea8bd9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
076b33237099208f5dde8a640d96de4e

SHA1
f9cb09ef9157a372135bba511ab4f26942a76e64

SHA256
a24da21486f0b9a600a4b48a39f4c736a4a3d4e411dcb73dac738abb1def28fc

SHA512
6ae8dfbcc986734d7c4092968e90d9f75e4b5300191cc7fa329172c6f03c2e83e6656ccdb299bb681f3618c809e1d2e7a1fbba3473991a8a2a8f98bf0f30dcb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar863A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit