26868e82f6154ef492a707e2ab719917cb22f1da6beebe08e6f5926117edd866

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c9ad60e01bed21a78d5d03982f6b97bc.html
Size

9KB
MD5

c9ad60e01bed21a78d5d03982f6b97bc
SHA1

53fdf6bf33a9a0e1253e7d8d377fc86646fa84c5
SHA256

26868e82f6154ef492a707e2ab719917cb22f1da6beebe08e6f5926117edd866
SHA512

1b37cc8c1fbaf7201aadcf152add7b88d86338e2a3e450959136690397d345131fcd38e2c16c9ecc6ded4ee6e990cf434f0acb43af7ee1031d6ac9925dec8e8f
SSDEEP

192:Ff+OfeAMRyibWXByXEO1lT3Zc3tAOrT+saSb:F9fRo9llTJStrrysaSb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d3c0e65776da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006adec1f8e6041856efd68d674b8355bf5907b5e961b5e4aeb7f563e7abbf9d5b000000000e800000000200002000000008d7ddf8fbd836e6fe66eceae39aed50ae3d996a528e1366cdba592d29507a9c20000000ac1325dca397219a29cd49073a254bc7ae6d31db3025f44baf4c50d715bc0e1640000000139fec97c10b9d9aca78422defe33042179066077c8433d413d4b671e71f7b49450f2b8a1759cb44014e5770dded416b6b7b676502cb119f1ffd41fbaeb4ce48	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416614127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F61CBA1-E24B-11EE-A3B3-6A83D32C515E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000051373df6ed1466e850f251d36b77486e065df1849465e9c517dfcb8ebbf4142e000000000e8000000002000020000000c0fbbcee8f5ae2eed1c2709721fc272f7a4595e45f48e635b12b069753283d689000000069a5ac43a0cac757581c7771c59d08edda76e1cf98a8bd6a19795bd6ad1f57abfd1cc03c63d2654fc11d2e6260cbc5290171cd726252a3522bb2951b9379fefdfb5400fb50c193257c1d12c953f2fc5b8fae04411282929f2439ae105234a4379b4c3ff2045cf7ad5ee1d3f2d3940610f1e4576d377506fddd72268e07d0cdf7b74051015ef08c02f1f93feed0bd734240000000c15db4c17d33771a3630ba445f06478295997fefff608c710697355a389ccc5411d7bb9b04aece3408d5cac5c6e10282b6f8a5d8c93dcd02de037d703e289516	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2060	1712	iexplore.exe	28
PID 1712 wrote to memory of 2060	1712	iexplore.exe	28
PID 1712 wrote to memory of 2060	1712	iexplore.exe	28
PID 1712 wrote to memory of 2060	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9ad60e01bed21a78d5d03982f6b97bc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790f0e8a308fef672b326815f4507ab3

SHA1
10cffd73a40ca7a4b171f622b718f6be6928952c

SHA256
acdd43fb7cbc8d4c74ffad3bf19e93be9032fa83d9335e5fb03285af04aa3201

SHA512
99fba0343294db9d6954fc4da47dd5ed80ef6b32c1f1bb634a1ddf13897e77302b5baa9ea419e8a2194b09c6456df22196a765e53d93ae061c8f537ef42faab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac7c38546ad940fc95b81ab9ed4ead5

SHA1
496a57ac466c444f5d28f3114e9095a76d19f64f

SHA256
cf935ee6db338cd2485d5f27d7ea609d27012d6da1c7a48ca71143dc41d19e5d

SHA512
a3e21b16fbdea4b7ece401e5a4dc89bd2b03cf409a9785b51d5ca593ee4134800ee106ed751c467af60386dd4b49fe9e807edd38902b9e346bcf5234284b1dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd47466cf2fb5c462b9f056f7c59436b

SHA1
515673889a9ba81341514e3432ac5e0aea17142f

SHA256
031bfb33ce322833e28aa66bce9c9a6d9f6e03f8d61e54b63bad158995df470b

SHA512
3bd924db44cba9f534397b1e25aab60322bd6a3081eb57802cebd429b850c2711730d807b9ff9456160fea30e945e6d19bc3a1f9b3f1bd5d0c334f8ae21de9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f15bbc793ed530ef96ffcf715d506bd

SHA1
3672f8d57d0c9578e788fb62d4a9364b66f72119

SHA256
f6ef94e49da334472c3fcd088d428f13b43998abc8ba74ce4b9e6af5b2c7ff1f

SHA512
233d461b2e8447351dbcb7f9b6a74c0c46ad3bffcbdc111228e66817abdcfabf26856b2e1baf48f39ab20b9b7f0c9025380946736f692b3855ca546f2d117d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb4e24cf7d5d1be06049e9465583a2f7

SHA1
07c1fc7b1e6f6b715c59e5b30efd3b973dc74ca6

SHA256
1f06c3838e8b2b0701fb26c518adc49e268928124bd5963f44cda9283a8ff863

SHA512
6d3c075c893fe63d9fb193e486b94f7a0428b8015db1536e9bcf8c658c5fc71865020e93da0a86ed75304c0dfe27341ea86fa56be6bd635ada7cc60a3206a747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd760484f16fd774accaaed6db6a005

SHA1
9f7236d46f99012014aa8c710d5f45d75e22269e

SHA256
f960c29558b35e4ba04067ea2fee7471e310b518e28ddc8a998d0b57df0da83a

SHA512
883eb17c162bdf341d5c2f2d328835a7ddb5a7740aade304f6f09e1c3e64e12eebecf15c49c16ae029e7e7c6206bb30fceb78b84097dc18bec5b6830026ced18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4090531565397763eb087584fb959d44

SHA1
69528ae127b65bedb64fe0e7070013d7715f3321

SHA256
33ddc44a30875bd06b5289b3bdddf3b437b4b6e3dc0a575fce283afc88bccaed

SHA512
c1676bb5fa572fe108be8fdd3ea8914c212cfee52edada10dc970bc0a70a7a50be3949fb692598ae247f790296c8bda186f3dc1b60f7c7fa57f94b246063cbd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf95029659095d2ec01e7292c480e21

SHA1
247437f498fad37171e109d928690770221d9640

SHA256
5ebd75cc3970df8238a61f3d9897ca06e28910d9382f8e121a8aa843db8014e3

SHA512
3364afd5193da46f5612d81416f736d35d7812d81ba15ea0d61c0f979b77ea57b65e44d16b74e6e30f07d26c3907332faa5b481bb79be52bec8894d53c05ccef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42655471a301a98ed6e0c6cef70e0177

SHA1
26249a4d79656677cefb880d460b5aec009884a1

SHA256
6835e79fd961ab2cffd1f7301fccca4e17f601030a226d9fd0d67ead1a9c001c

SHA512
15a745b4ae3c63fed289f6ba22e52d881a0f7013c7c77d5a6b90ce51e4b32de4b1f6fe37f72e14e58b978af36bd6258a76ba423029d67004a3dbeb2fe8e96915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9dea801919e9b1bce3650e48d0febc

SHA1
5b9ac9fb02b696ca0778eb4ee3aab14a4b0d7492

SHA256
bac0b782e1200acd96618837e1a381126c0276186b462aaed71b36ca88febadd

SHA512
a196ef1aba2476aa07de7d689cc77fa508a410b93a12c898fda6a0339afd44a1e0814be2d7988244a1e25dd2c4b7f39d7dd23ea92014065aa7e20747b25d253c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6530aa2a542278838ac34722abccf915

SHA1
43f3006db643705c675ecf63caec4aa1dc196254

SHA256
5b15a58d4aa9d81e81b0edc40aa4788712ef38af12cd294cba74ec8a141cba36

SHA512
753fbe25c06919cb5213ca5657664f447bb89a0fb135177eb21028ffb95a89a54b426bb11044e4ffb52dd800d4afdadbb83a4c8e3f3c37dec08e8165a3cdbcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4481.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5184.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit