dd3f9239c8e5247f6c0f614c3e2045ca4b1c3905b2b2cac142a4f89ab59b2c23

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c74f3c6fdad05fe5407ea766497477c3.html
Size

13KB
MD5

c74f3c6fdad05fe5407ea766497477c3
SHA1

55941fc1d383e77a7622a3527e045160f199ce0b
SHA256

dd3f9239c8e5247f6c0f614c3e2045ca4b1c3905b2b2cac142a4f89ab59b2c23
SHA512

a132ce0a14293cb0642e233d392d59d3083270ac55f6347112308870bb3f7cba945ab9c7554000d878b18b1ca3a47b87b5c01bdf276c42172667fb84200c69c0
SSDEEP

384:szlIcyVnjns/guLBkZcnY1DA70amzguLZ:Sgh6t6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D131FE1-E1A0-11EE-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416540782"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28
PID 1612 wrote to memory of 2352	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c74f3c6fdad05fe5407ea766497477c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de7b173fe2390aab7e539ff1b709363

SHA1
2f98d116fb852f602b216fdd776857a3edddffb9

SHA256
19f4610ac1c6ffdb398ce09bd644512864b61bc9d966110eb9bde9b13539bb9d

SHA512
465774f6956e85fcee59eb0119a323a944128be47f83758186339efed7a5d97f2fd4dc74c0fa2743d5b3887b5fdfe769333d97d69d068dce99b49d5658ef41ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ec6b4b2a98f715ccf3f64cab84d09a

SHA1
99a697c6f6bf298036c9f2451c4df0a861f7913a

SHA256
6bcaa37795aeff82a6609a5dae7629753f2740026854f29fc8991e1e590105c4

SHA512
ee70bdd585476c18c6c88f5a286dd5db7b340b920afd36cb621d1a419ae659441f3db1d593519f0cff2399ec1d6739c29867e32fcd894e778e8b7094c7cd24bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f262f83e413506f20a451edc4d888816

SHA1
9855989f4cf30c2c59e5413f1b2f7b58b1989527

SHA256
99376929d665b3478274710df5a2d9b2737ceb0e14724c4be9fdf51881f3fb56

SHA512
349601ed9e0a91c578b4cc49548103a0fa8e6039d6244764bc453f2b0ce24ec852b70f80ebb2178c803c01c09cfd0a95fe17bb6fec98819dd8d9c8dad6bd3972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051e9e53bcaec407b5cb6a2a89eaf70a

SHA1
c4d139874e63df979a6bdb6b2420ff292c2bb5d4

SHA256
0b49074f4dc5838e9119c3f7126926d9c02ce38fb0924bcbff3c72daa992929a

SHA512
915263f42d2d14558fb35a1d6342dd2b5f9d1c820ed29e263128136ca998001554087df6d846d73c80ca86847087c40a9bfe3a1f3db33464f9cde84443123c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ed02b708bbf569c913f353761edeb1

SHA1
5e93495af7699291215c68139c4d365987a6205c

SHA256
4881d3a1f5c8b6ad7f5d543a14f58999fb3c3c5929b1a388de09b5e4e558abc2

SHA512
43930c628532881e9ecf236f3a91bac69ba8b8921487f05974a3d7d3e18d4d91f015f27ad7b1e8b797fe0549621e74bba8b22893ca25e9589c14d7b1d292f4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a410387081e1e8fbc3703bee17f6b08

SHA1
6b9ad8afa3f37ebeb737abb7c361fc4183047be1

SHA256
098b57fe564d56b6a5c522b976294caf3dd713c43ff9f5333427aab3bb7408b4

SHA512
9748bc079ccfd82f894c8ed0394d4324602ae65014a039a91c11c768bd407e7b25427858d594eadd7ebd623cc69646a8c418634602b83fa9cdea144070e012ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bcc0ae0f4a5a33d9f5915c0d4785865

SHA1
58d970c00ada653d50cbd30e2d06df6be75bac88

SHA256
66e96eca81be71c5360387b4e54c57fe79882120338377aaa0afe6569b4b28d0

SHA512
0f18f940590eec773f184c19450402a82dba3ecf51dcf73f2cc37b1dd8ab8427ac50c323f9ed2bce5c5d9fd5a7aea6e708d73e5cd30a2eed3f67a57a5e98661a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fd3279d3ddd7a5ca1a5141e5a46805b

SHA1
adeaed035c56f795b62a3a468529ef693bc208ef

SHA256
6af23e8acf88ff1d5761a771d600f42ae408cee761162f8c0a5e1b3ac38c8870

SHA512
6dff0fe0a4300661abf719e9304fed3f4eed33352a557d01d20fed24cbb6e72366e546710818429ca4a896a52fb3015dfe91b1c8de448d3292fc0f62eced8610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b14f4f3b717598e9a031406ac614c3c1

SHA1
0f08f4760e8ad71d388ceb5c62cccd984236c5b3

SHA256
2641486e537b7b5eef252be5dfaa86d72d26f3991d03b98272b5cfdabdafa15c

SHA512
c0b788ffce64b16102492fa4b5f6e0962bc46b3179dfd0d2e651e76565a46e811e3d051f4297d0b8293b12e2deb0c39aea4469bdfc17dae02004da9e2e0a4e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E6B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9078.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit