3605cf5b5993a4c9110acb289ac871a164b73b3a37f337f1da915b3928a4d43f

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7ce942fed22afbfb80c639b4205386b.html
Size

60KB
MD5

c7ce942fed22afbfb80c639b4205386b
SHA1

6437d47d6d288609cf18a238ed8afda1f3052f5c
SHA256

3605cf5b5993a4c9110acb289ac871a164b73b3a37f337f1da915b3928a4d43f
SHA512

dfe0b606b200b397134386d88db307987921bc2ade477f0d4c82b03c17f2800032fa0ace890f6cef1b35f9c48c2fc8ebf8527d76833803c701dfd8dc6e06310d
SSDEEP

384:nqV830TtAVzcEZ58hjXDPb/LTVkteriRmM0L8ZgNn1u4ms48rosTRHRdP7JQ0umK:nqV24EZ+lPmtElr1LDTd60WqbzlkvKYf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06decc3d075da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000002705b000f69abd3578c77c4c125974ceccd4db28ac596cd3ff1e64a2304c3577000000000e8000000002000020000000b8ae69d86d3821eedd64dbf33da458f927bd56a74f43f3c721371fd6fa8f918c900000002b697ecd2f6e257b65f956423c674f20a7959257c2e52e3731a56225f6f7a6d3519c9da897da4053858adbe26809df6f3bb249344c0b33162952be3ec5238924b35297be01e94036fd907267f120065c3e6a99c9fd4cf7a1511309af6b81ca5fd26f351df2fc66046a52f705e305b253d4423b2e781e0128400907d9bdeb330a96937ecec1a271e6e164de9ac49076c04000000079648b19b9470bd8b0ae182efdbf7c7738439af4420670ec07aa90581b30ab9e9b5593c918a55cc5b409389eeb8ac8c404448a5f0ec5d135722fabb37b1f58e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000215cb9c2f90c835a4837d9ac4f285808048e1e2a01d12da79661dc4677f9da43000000000e8000000002000020000000f49024c13262a460b86fd8b3677d0f70983f3b0c9b039dd5b512ca35a6c7874d20000000ccfd71476d9a2423afd7314371d76be8af9addd0ffde6022931be7ec93305aec400000007f1ace760be164b3073b21787ee07e0dbcbce5d07963b46b9dc0ae4b93f654c9dfb073e1136a4b8a08139d2cf32499f0e55af52c6750867ab00a16f0e666d8dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416556085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE056F71-E1C3-11EE-A2DF-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2508	1640	iexplore.exe	28
PID 1640 wrote to memory of 2508	1640	iexplore.exe	28
PID 1640 wrote to memory of 2508	1640	iexplore.exe	28
PID 1640 wrote to memory of 2508	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7ce942fed22afbfb80c639b4205386b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c73232cd74f943cd428b98262d642ab

SHA1
4396e1a0ffe43615eeb6ea3a38e9429f69e3baed

SHA256
44221ac9e203190b0a6347a7ec470fb1acffc0768c8fdd943a4f16dd7e47b3b0

SHA512
c32d86b867ff4012c3e20398fb7515f449bb016fb74340c4b66832710b7dd72c25fefc83651a4e0d0be7def0483a63a88cd55384fb9262ca2879ec976fb5ed0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdac4956f65439da7cca9c90c46e8dcb

SHA1
0c2fd7aad3c8b37462e0a10c55f3cf3a1188398a

SHA256
3f3829558ea6819a7f28bc700f830aaf1d20c7386902db1f6237f3bf508f025c

SHA512
af6e67f58e45a80fd4f33e3dc54ac5faa757adb1960f5e37ae99ce4d971936778647ad49076c7282118c7fa0c66b24e5b2200934a74f43e1c405058fb0466687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb60be8f2afd9f24f4848f2488c8a05

SHA1
a0d0252ecd6a47ba573f73157aaa7bd392abd6a5

SHA256
9cf9dea52ff949d8668fe45aac0beece60f62e8b6a048abb485ee2ebd8890b4c

SHA512
c5f5b2987fd82a3bf54d35760956b5f8b9b96aec849cb1e48a37f2d1d69446fe31f6c82842238651d7f0e4e3290d75198640b5534b92101811c7f9c9891ccf2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ba43bf6a786447b51c6d1b9f939c28

SHA1
6161d4551f0d2569f5adc8a0a5fe4705b0f2dac3

SHA256
076946b9d5aee59a2cffc613344b772c2a972e13693428c643fb841a0053ab54

SHA512
d354a7e185a0a6552d075a54d9a3595764c68df150f80665bd487618c0a382b67106dd6616905c1d16e931792f125cdc868561f688a0854ecd2ec53c63412eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a598a1969bbe2a44b7795bfd3456172

SHA1
0e39303973d94733246b2ab138bce4f3ee669efe

SHA256
3b51388ad4a547290222e10c6bbad318b80d62695164a4d193ae483ae6c37cc6

SHA512
39dc4be9f737f81dcd134a902b0458bed292afac311813e561b8c350792224b6dabf943112d52efcbe9cfd8a22265473bb6f35179ba2334b39651e9a02aab607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b78d7bbf28c4e29de7dd3bba6e1316dc

SHA1
5514676855906e1f6abb17c903395b45c4f03716

SHA256
7815ebc36e4f5b4fdf64a1db7857d3928dbf81ba634891a289d0d508dd3fead2

SHA512
694a986ad4fdb49867518fc7ed61e7cb6d2833032166fc28d7de20d06639be738dbf1a6524f6ea4442fc6a33c42cebacace35a8df39b47ce15f1a715ae2dec75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee96b7dfbe3fadd8866374a86ab768c

SHA1
14c68bb380549b372ef0ab28f21e339d313acfb9

SHA256
c9a4858c4ca43c3767193e9291e7c37b2b4dbf14c3022503c95c4afd51093dd1

SHA512
12ea6b1e2b6af3a46a5a3cebee2bb8dae3e20b68903abcc785df2426520e684892248a01d7418c676f751ce435150841e383c8b034aec959724be9fef554c19c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9926466472f0ecc3fc4457e16c3eff21

SHA1
31a9a7b8e47e0549676f108c6a0eda2a7833592c

SHA256
fc0905e77e12b673cde0d5fe1cc54ec9ec82aabd605b1aa41f1048fa004f57ce

SHA512
1082169ece27e00e83564c8707e4c8edf2a57ef88e93231c0eae4edc541f76c9b92619d33a863dc6b2644a9740f18156d4e00134ecc5c0863df37b840e04e36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3204fdebdd853bb4c76cd0416bb838fd

SHA1
ed7341d707eafd5635e31adb2339946e4fbb6941

SHA256
c761f6816864da8a4ba8401627ed8351ec3463209aa2b80af20678de474eb430

SHA512
edd12d609b23021d77fa0368f9a415951c0723283b1420c98fbc7013f27b818481ad3fd13cd3eb60c31cb386512882c49df2524089a9c5e60721f8414240dd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e5bba557ec7e8c906189c72d4dd6083

SHA1
3cf15ec127afdc67bd61285362ab6c5617513d47

SHA256
1e9345a5af60d69b5afd050bc1371826569404f6dd54f02d2e503d1b86e98a0e

SHA512
9318d9cdaca744f1448a99329100ce204732579c9c05b74fb6c35dc4ec61a45d6bf1b54daa4458227db27ae62ae9121a7188122e54653e040572e38fdebb9a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b18a2ed2854abe0c4ec5f6c2cc48f0

SHA1
f574ac0b052c89267695b3f4a8e32a5d1b5c018c

SHA256
d2057f113f7aa2727c1c03f4d30ccc03a8f7987bbf00ac319665e6535cfe7a79

SHA512
3a4fce166a371ef20df876ab5f82475813169cfcc02c13a0f424e3309870141333c2b88ee65c424de8500cdb7d836f6650e7efdd6f06d129f452eefd236605f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e498c9a2e30c3f5a6d5f03b2688236c

SHA1
2488df68f8a297386159d3aae8d8ff515fc09985

SHA256
522a3776b321ac35e55689a6222123fab7217e65558a8892f4285b4f579afb21

SHA512
708d5805410261d4cbed30f772b49859f14026901b98eb1b697fe7e6a2a23f8780ad6170f40d39543b4b45c5d0dbcc2f688c1ea4ba5747d5d204d2dd13cfade6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb94c0237eaae0d0f54cf8c2cd42765

SHA1
f5b4ba623edfd7df548c3e4d383d4d1425300403

SHA256
c5b2ad4b4775e61c0fc1f6ef3ea48ab57bab78c04de4a31b7db0f2fe8f56f15e

SHA512
25ffc8da52a9c53ecaf6aea31c1e5390e4f2d05cdc403752ab7d40fc5cbe20ef489bc2a4e7772573cb8660bb279da225bb6a8df49b9fd5ab321b59384c62cd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a56d6365fef3522df70b0cb4215b7b3

SHA1
a21b25c63f07a9bbd82abc5b4ebf7104355251b8

SHA256
5cd75f3b204be845c57207e80fbf49ea59cb9e70b291826dbd0eb6c61da18fe6

SHA512
17caa0b8fa050bf1360ea8ff8f939bfcd53f0b16e1516fa4e4a2a8d7b0c2fc985174267a500700de02d89293cc4627483e609ff1269d3ad31bcd647cd09dec59

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA694.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit