85a7a732270231c924047af8ae1fdb34ef010da480b3f325237de3be4f675824

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c76323b98392b24d96a5edebf8ab21d3.html
Size

55KB
MD5

c76323b98392b24d96a5edebf8ab21d3
SHA1

21679e2de548391cbebf4e20a3f79ffdcda3153a
SHA256

85a7a732270231c924047af8ae1fdb34ef010da480b3f325237de3be4f675824
SHA512

358fff8078e17fdc307cff7a31a1bcb8799be96f398b6a05760a896253ba9e486c93ebfff3e684550996d6e22d9c34df5c0ee9016dabfb29cc3a3273494dc90f
SSDEEP

384:+Gqo6ZnpVpr1tJoeZL/O8qA15o9ALkYoSc5PHr5PZKmhubl:+Gqo6dpVwgqI11oSc5PL5PZLubl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000005516a1610dfa3a365ff7acfe2b45fe2171c654fa8e76b2df284096ce3de808df000000000e8000000002000020000000dd393fe724ec5ea9b1df5d170db784ec137c9abae7cb5123698f5de517f084d1900000007d6dae302d2061bec131ab87f177d5ea10f91fd53fe88a17541e5dd872ed92952c6b7ba511f0abb4a997ffe90693cd8c2f4ca1ceabbce40a6d4d1273ae01447d0ce53732932840b819b128e3cdd91d42cb5cd2b018c318d39a451b0c5f45658721234c769e786cf4b46ed11b2e33c7f08900b012e513c1d4152b1e382767bddf051d87c0c3613a32a32d59a9e1b5db5b400000003ecfa6ad3be377f71f4ffc009177bd98a0ae3cebe33b2b45934889d3609c212b3d0e799de4a32cb2a8026cd22c1fc18c0d70be803b8a55cf03d7d382b24c2c3e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3E16C81-E1A5-11EE-94DC-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000ad61ee0db4a940406299fd157ca4ffd26add6da63b75edbca1ac543025053436000000000e8000000002000020000000d9b4c3f26ee22c3b81e516119398d3e9bac9e94282bab01e3b8c14cf6760fb1320000000abe69f0661fd6e8026440a3decef02dddc46c0453fbd1aadfb7d225fc0ed65e34000000053badfd14733947c2de0c0e75b2e32cdfe8199fa01dd9c229a8f04236569eb1ed1fcad0ef768bdc221d9ecc2c9c878b5498534a167137109b9b659be53b7c4fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7729eb275da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416543126"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
932	iexplore.exe
932	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2044	932	iexplore.exe	28
PID 932 wrote to memory of 2044	932	iexplore.exe	28
PID 932 wrote to memory of 2044	932	iexplore.exe	28
PID 932 wrote to memory of 2044	932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c76323b98392b24d96a5edebf8ab21d3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3b5b3403b4dafe63659fa375b6cdb0a

SHA1
0ce43543e052c4589aeb87816196b1815a6f4377

SHA256
5d84f5ac6a3878105786cbe2e1431d92784e2baa9edbd4a5c37d03ee977decc7

SHA512
32f9e2b8a56c0fa4f8d0a4d75496ca8c043beae18a3f6a00811b2d00e35023c191c231df6a1e41c656b7218dc453f63de37c04bc0ad1a8174c70d2b04b9ee20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a1af7548de0cc13364feb6657b2107

SHA1
0d0d9c45f536b6b43efccb8467990096f1479dbb

SHA256
a12ed47c6de52ba5567592f138a6f643109a3b1aba75db77b6e60de3b3f653f1

SHA512
a78e5aeada5f5a854849495b6cabb2d5a89c6115dfc2feadc674d366f7942d6aa3b3704dc2f09113791af1ee2f6870e76b42331a343d6dacf99c29588b40a788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1177dd5fafbcde0a8e04c36a26ae9315

SHA1
a6587b10ca2d3eea9655d4535e21ba45a4049882

SHA256
4c7f31484aac55a06afdcc0b21d25488c349473a6390f359fea7c7fcddf75f97

SHA512
892d6a3c9707e0a3970b8258a89908ea2418b7421c41464e68c10c8beab09ea0a3cd05c3011772d810dac236b77e91bf39dd3a65a879432ee4ccd9b406ceca4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2821acf14338edef82c0ba15c40f724

SHA1
55af15d59657f638a9f924da1362e7dd76b00b5d

SHA256
84dcb77325be4de18f49b573b119f2c910e52f40b976fbd5311e0afd76aca5ff

SHA512
15c8cc062ae642d33d95cbbbcd14486b15d4dfa73921cfdca04cde08349b20850f6afd68a6449e64f3f6c287c01a026ba169277fa2248e0aa824f9b11c66a0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc6cc28d31b274bc40686e8c7f17332

SHA1
0f74e1f3d7ef59f90dd6eaa58d5f59f9ff5e8415

SHA256
82ab19aab06b57c212a662caab5c6a964ef417c324f7618f886d0109e6332fe7

SHA512
f04983e417dcb312cba8819f9271579fda0ea57faaeadb2ce8700f5f1c32913ae61591a6315d7d37368c4c6c79418796d53b5eefcda4b9d08eb53df9301f6dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ef551cf4bf1d6b1fda1b97da9d73317

SHA1
42db38d71cc86dbe0d38db2e7af06d3c906df397

SHA256
85bda19643d2bf9355eee37b9f929448640a94aec53ad9af62750289fde56a4d

SHA512
d063888e9acdbe1b3e088d1da592907251bd371455e24fe0ddc9f629084576f6fbf2775b6ab09258f42e686bb0b79c63dd3573c77a702337bcecb3402930d489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc021fbc8a5a502702d36b98b7891f6

SHA1
54b862e1d8f6c73b0246988494ee3bd65e1ea7c4

SHA256
f554524ea51050dd43d83fa391d81a83c63ca054ee39a026b2010f5ca3375f4b

SHA512
de3d2dd3cef5623645f0cceafac076c8070cf8496697803d4f0035117c2579201181bafe2b237e3d9ec2e39d1bf581f9ec6646c24f002f8fbee01cb72aed41ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b6d66e5e17351d6a7ada96188c0c01

SHA1
034d030abeef5ce7eece183ed4c591f4ad2f2adc

SHA256
fc0269c38fcddbf9d5863be555118bcaeeb42cbb4dda78dc82bf0142019a2ca8

SHA512
fa1ff2bcfdd20088d75651637d9d87616e879b12e9bfe2e71c30d1acea7b500e4ca0b4ed8fc88a7743022d0ba23cab680274acb82bc3ae3d5b3ff30abc72bed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4db91f0af870e5ff62ca400133f4735e

SHA1
9cac1de455a300e81e3244991701d81645556bb7

SHA256
c10533316f47a085a8f59dfb5d18e573f6dcbc22e1d7cf1c98b3d18fdcb8251c

SHA512
e1100e6697aee866d30be1740549c7b1be5bd7b83237dd49e162b08e13cf84620ca4c45d7952db25af9e86320747ec1c860f79c39fa4b868abe8916af4b97c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a06b10d9883deb1df9453a5c7016d2

SHA1
bf1a0f68f5b73168386f99cc997f8bde8664b6f0

SHA256
f959fbda9363efab72c0d5dc77e050fb17abe4debabad6ebfccfd0902774285d

SHA512
0ea3196f5c0230f101fb638b485ba85e403026a77f89c56ac6037e45f3898e71a01eb21f5e1bd45380d0c34608dd4d96266e8991f6d31de17dae5e881d69b4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c88449d84fd4f92930b467e32567488

SHA1
a1a8b78ca164001a15be5e278f53b52886a6e6c3

SHA256
a0a45677c079eb96ca21a67ab8cb97431a6ed1f308d0cbe9ef457989bd95825b

SHA512
da7379be277ac8623bf65596797a0b4353b254dca71e8f2a9135b1ca454ac3d1a0852c7be69af8ddb411cc82612fc54bbdc672b729e580895961b193051223d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459103a758773a3cf5336e8ee1c94f2f

SHA1
25f87f03758f3ba1376794f9d076c9460e92b9e3

SHA256
e826cd46a573a016741a14d7476d8dc79cffa14a46de14b0f28bd88d002261c3

SHA512
361d1d068187b81855b490b6e7f2418b7dd19457fa36d8063965ed33b93133a5079f48bb8e4872f6063639b8d9fa30238fe00248a8ad256a7adbb8979871e7be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b70fd52cf2bae859738c53b4f92c19c8

SHA1
c256e061cab863544fda15c1734d1dffb7608d94

SHA256
a0e6c1352e91e7cde01dfeea04b907a4b2cecf414d9019064b736b94f4eefca1

SHA512
e7fbf0d7972fbe85ebcf31f56e6a2aaf1ad6817d58efdf5bd9ef559ac9c5ca40b51453af26ffe961f3ac00391f01d4e2b98ef689e8133e8876b94e553457186d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B4HDT8MX\analytics[1].js

Filesize
51KB

MD5
575b5480531da4d14e7453e2016fe0bc

SHA1
e5c5f3134fe29e60b591c87ea85951f0aea36ee1

SHA256
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

SHA512
174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5524.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59FA.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5556.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A0E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit