5c44633655e9e21877bc9592193bfe20c3905859f5d2e6790b7c2f54b218a0fc

Analysis

max time kernel
138s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9aa2cac33aadcc985d0907833370ff0.html
Size

1KB
MD5

c9aa2cac33aadcc985d0907833370ff0
SHA1

3479a31157cb67abb0edaf4e83b5bf9f983dfc0e
SHA256

5c44633655e9e21877bc9592193bfe20c3905859f5d2e6790b7c2f54b218a0fc
SHA512

cc53668cdd9f9a95b90486a76dc93d6f42788e83b5ae552325f74d1cdc4fcc0e408188a72bc9ca864b726e03352cb1d9dd2d815afbe6ecc55eb78001fcc0dda5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000009ef312c6b5fec1bbd8d283a332cb5289ea7acfaa9e4038b67b8fe419d6428f4f000000000e8000000002000020000000f4d2b6566bd24f941ef1473de752cf3c9708a6ecc75f9a506b32f8c607f4617e900000006b31544045a8888e4c4adba9c887c943e3a24e3833fa2a808c2c01022ea2260c13d31ae1c9e37d2f2baec7fd02b741e498591e15ba3cf6aba43d49a2b41e9b5e0f1c8a7fefc963d342ddc8c75b5e236eccd289e2198c856b4039f8344e9c5981f339ff825bcef14a87f5681695790bfb3eff57829e0de8b8bc132cc801ec3fde1bb745c3b0f3c2194f7f71573c28aa7a40000000f624b57b4278cf2d8ef30fa5353ff4c5d23a24336fdde8c770431f71304dbb631ba9b933b8ea3b15d316deb364e28d838c1db4d99b43787ce1d3f0aa659c9e5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709e320b5776da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416613762"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000001394a84779172f34ed2415f14f270d56b14b5e3e081357a370e28e1666fb7c0b000000000e80000000020000200000009e3785c409cdf4768fe00ce9a85081f81272d8f0cf4ffa5fbff9baf0aa2c5dc020000000d6200a1ea92774000542ee3fa131dddf2ac4b181f9ffa29c05e7d387ca23fdf640000000887fac83504fe33ca00da409a79e18c406bc3cd28e4bf3969007106906a2a406bc9c9cf54d34ff881e145d37857570c4bf5e2028fc56dc8f944e953f2e501ca3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{348450C1-E24A-11EE-A1FD-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2584	2164	iexplore.exe	28
PID 2164 wrote to memory of 2584	2164	iexplore.exe	28
PID 2164 wrote to memory of 2584	2164	iexplore.exe	28
PID 2164 wrote to memory of 2584	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9aa2cac33aadcc985d0907833370ff0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
409e79f3f5115377e75ad4e56d773aad

SHA1
e9ba0f7db87d0648c2654396f57b17a952c65f9a

SHA256
9b8af70516478551f51074e652e34e9a7158d55433e2ab98ba84e69d706414a7

SHA512
3186561b6f6a4fa6b32f088ee3751b8ca9600f4219e88a61ad05fde1462131185db70c9c77799b440a9ef60c9167c237f6a4fb7ce4f40265f6d0f264381c4534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf61d92161b7383d857d2d36fbc5bde4

SHA1
7d523062ec94364775ecbbea9eded7fe1af02897

SHA256
22f26a3d6415372db8b8771ac0c271f15c90f92d71500862f22c800248f3c97d

SHA512
124df7fa477065e3650fbcc2a6dfa20e6e33f5fff89150c0ab4d3e2b0e6739e98c86ac1e1a306617503aa10ae7dbe0b91f850c2884d00fa1744b0f241092d294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db971a1d9f4a1e9970a35bc60ca10aca

SHA1
54114ccbb2129ef64e07d01d332a85509502409b

SHA256
dbf65f7ec3a213575e558bc517f7635e4ee5fbd3d4977ed6c4c6d90d329e3097

SHA512
ec5c4dea23d62bb0bfe5ba4303dbc4fd77da79a412dd2dbf5ab552f4a376c4cf309066762665d4884a51d3ab27b31a4240ccbe6eeb2aebccfc9cca081bce1553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9b62ea1d0588fa11e68ac874f5ccae

SHA1
c4fc5f0803581a1d52c70c44e1b2f21ad85c1112

SHA256
139fce852cb172bed5631a6efbdc55a4cb366e2e10b936471d8eb0a80ac897b3

SHA512
6176b7b560364dd378d08dc579ce9023b64d3c5be8dc9f31e003c5b4fd01831e2bcd9d7da9ea611ce43637dc499573d15776a00a2140d4b85f43e6a0650c336a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f65848f88659cd062d63874c0998c56

SHA1
1ee144d841fbef9a58b35f3548f59d75e731554f

SHA256
da0a12e62d3ac270d928bb1d0bba9de3a5c7686677845fed5558f6fd7433b8ba

SHA512
a0a7506fac48bed9dffa00e9612b279ab56e4ad00dd84975a3249efac63cdaddcf63899e62b20d02281762eb8b409378c55be06db8f95970edcfdf1d12608fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c2f0169767da2829cfae96d45b8f3a9

SHA1
042d7c9c1198517770c8cb935f25e9839cadef7e

SHA256
6deea845e98d2095eda456a913b84e955c5f751a5735e2ac0cdd45bf6599c501

SHA512
7a694905cced29086f9f0593380fdcad68e59414a7d8b60400dde0d5ecb54440d76de287037104fede2d503ee671c38a33d7348457e18ba15f4adc1ca3275982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b6d55a3fef09970762bcec6be9df4d

SHA1
2a547103c8b0e8ac263b4a48efefe07e230c4998

SHA256
0ee791b33471fe8c6a43f5aadf85da978f271deba39fcf188bc48ac5acfbdc43

SHA512
20753c886ced36dc6eea9c92f9752b89fa63f9bd61ebdc79a2fd6fc5083849dde55eadb9c7d845cd1a529e9a70c458bb0a7b2b32d3837ce7f936cfdf5b8dc954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9841e99ff1fc8c02ab54e24d6edfed7

SHA1
77d2444d537920d5819e3919119f1662bf64e320

SHA256
8b398ff01076e4114ef4357563822772d34a6494b757ada7b0caef9d3522c912

SHA512
e7f1f12e595ec209c24c61f05bbf2440b846bf59d7d073ac983cbd2e04331da53c6bd8799187f319cae044d4d3968bdce900931a9d51a71e27ee41bd84902f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7571.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82D1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit