3e9bb49f58795a2c0ffae443dc1ebbe0bd005e8c829bfd3f36627f14b5e23ac6

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c808d8fc8072ee1cedd4c84ea0d0c342.html
Size

2KB
MD5

c808d8fc8072ee1cedd4c84ea0d0c342
SHA1

d050e72b75f36a767608c86a6fedef6657dd2470
SHA256

3e9bb49f58795a2c0ffae443dc1ebbe0bd005e8c829bfd3f36627f14b5e23ac6
SHA512

13e081c5e11f7eeda9509569b4170f854e22589c57b0727bfdf52a2a01ace78cfc567ff4c725e1ae7fb6d974b3572eef4034cdbb308a756020cfbe6601a7a5a0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a4f951e075da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73349901-E1D3-11EE-BD61-56D57A935C49} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000007aebd77d833b9de06454e4c7ec277ef2f78f4129f27f8f7a33010c109a8af36c000000000e8000000002000020000000e59e86db9ded30a84d7a36e3ea2d37e4d3678a2c110167ac14394c3fae019a8d20000000c8f520db3bea08ad4659f43bdf7476f1c3b94266e1be4009a0df80595b7b81e740000000b3faae9d0f21b166e6be31b4568a52d5cce795e29aed0733a54208235dc989c6f41754174a21b3cfa7a6c9f8497f24b0a3f449fb2dbcbb305aa242d74db16a2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000ccbfaadf6d7838ac85254d27de72871b99c1cf1978616066e097ca0253b925e9000000000e8000000002000020000000d36a8623253a032eddfb17c87682b2ec20a6a968482fdfd0a3d3802f320872a590000000571e0326d77fabafa320b223390f4f4a19f9fb2e70874ad5d51f0f64358a1d88a523108d34199403e22fc619ec93b43c964757f2071c57dcb6177abbdd4b910e5344d8f29060727343b25a196891b11f54ba9f791f6a97a2806107362a29fd859ccb8bc68dc4acc2a902c29991e8020eb2ad836a0f44b5d4f6ef7b395e60380e08f1e3b984ece5a94b1cf6a1528d4d5940000000947c16f4da93a2beea6eccb507e26ffd51f6ffef86af225920f79a9321731d3c6eb7ce4ddd6ead60a0a101aee232db30190d7dfa256fded27c743d371f799f14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416562752"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2444	2880	iexplore.exe	28
PID 2880 wrote to memory of 2444	2880	iexplore.exe	28
PID 2880 wrote to memory of 2444	2880	iexplore.exe	28
PID 2880 wrote to memory of 2444	2880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c808d8fc8072ee1cedd4c84ea0d0c342.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fd8876d1c2565f21829d4d1ca3c7d54

SHA1
96bca868e412deca3c728f3f75b5ce26bcf0e7a3

SHA256
bc2313d0a959e5128c01f65acde25d310f1ac1910edcae8112fa1948827fab7e

SHA512
c42aff6f17470570f1018bf3a798b5cfbd535007d579ddfbab8bb9f564f7ed25d7087c24356eec8a1385f522e19635544c251fb8f5962c711bc46b26e261214e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bca5d6becf5909adb8de029c431f36d5

SHA1
6c22c46719664e27d07e579074215db214513d8d

SHA256
104253ecd0c6727d38097972c1bfbd3a4333f1050c4fa339cb0feb437747b17a

SHA512
47f280766283729a66abd008cbb72b4185abe79efc347feb3a075a242c6f922889ec670c93e554c668c9f0f04c7b1c19718da142f0d851baa80dbf1ae8ae7510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16c457056d2aebd52397156c3f89d7f

SHA1
a71c83ca9b40f496197e9cc0dc105d170c799c43

SHA256
18267c47d31be1bace03a2e97b0c1916a23ced240dd884c4e15be5f95ca0d1e5

SHA512
1e263642ed24b87e9a551ee474e01a6b2dbd822fb11b44df0c9771644e4db9e07534b54e07d7d66b3b4782d92f45f58ea5e4207c5e5e3cab5f266130a4a2574b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f075c942ea8ad8110c27efe033d8aca3

SHA1
22f31826dd7f10ddffca4f15325ada048189e10f

SHA256
4509a932fb7bf529b96a6e2b8f7a016e85a3d34a2dabdd641e4608df7f3fdbce

SHA512
8d428e779555dfe3e7693a28f7f3adad343262f2a3fbaaf9cc6142b5ae6db18edb0691d719dd2ca3f8852f13c11346623cb03e94862da5bbec2ed5b9af7fab31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae3a77f6b06e3b90349cba949be6c4c9

SHA1
9cc8841b6f3430da0f37511dad1028e1ccc86b91

SHA256
1c89f2cbb4542db2887e50d6d6aa00f31895b18af667eec6783ac8d044620e84

SHA512
4bb60bec724e6c9893c79b274d9fd58469601afaa2f88d47dbe6ecfb7e2dc64e837c76ee4fbcd5298e3c29fc10aad2b64cd0f666f5906a63279e06e99b8994f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e88315cc4b2f368c1aa2f10d58c33433

SHA1
25ed568cc84caae374f20fefca85f15407c1029d

SHA256
1bf3a288b44be0f8d2af11c62959d47ff1c59cd50a9d92594515f1ef44fa262f

SHA512
21380192c2f4a76cfdb3530da556bd2ddd7ff83091f89e35992ac5fd60c90ac08264540c8069c3c5e9063cc181f31222a6f237c76c6f734be4a529e66d8ab939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a25ca003d2034610492d33be2bd9a6d

SHA1
85d05b9aa343d1e00de5eef2753a39e9fde86bdd

SHA256
5a87cf8370f3aa6a4de98c173a2ddc0ab8f8f988da6e3cc940b1563476ad7ffb

SHA512
d397e7b1d4d61948a19dc7353f1a4d653fd782120daa1cf1371a82bb0e576faafd16f02be84767f21d0c4bcbc2a9f76053f15e729b3f17c728f7b36aa83cb360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c23d79094e88053bd50b96b872bb52f

SHA1
505da0e0e2afa4e1919cf460a565605fbb0ec255

SHA256
d8ef8f3e936e5968e5cd627b7b8fa07893a182685f34d309a34e1c7980aed91f

SHA512
1f30707eff0ab6c0005589d1deb7ce2d0c2e1dbce83cb533ba9b4b1965efbecc14d7af6bab3bb200ca39a38f6e6ad0d9165bf38b6d0804b871916e194698c5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd638421884a1990c2bf4ef08b1c1d6

SHA1
3c3c81be6e699543e37ec49f0edfda66382fe060

SHA256
485e1469df2503b1d379fe2f5f094eab6b622361fb275ee1337adff0980d8374

SHA512
da9f828ca7aa23dd42b6ee32c8ab653d0d2679774ef9bd39e99304bcb01b45bce25ee338dcbae7e2b57c404115964efc50ef0a2e17cef12e8c9e8ab5903e8fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7af4d495fada09eb87570a464535f996

SHA1
cf0f3bd848a86b3443c0753226ea500cc5b6e3ff

SHA256
5c59a176c90925518af140ea4056dbebd341be26a81c1e247378deb8b1144f81

SHA512
0e3ad16b130919abcafc60543d9bc0af04424338b6ef1bd0d954ed77610a8a64692b3b3401a245987417c65f1d0885bd8e3e4655bc826844339824209c61e43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4774de06e195bd9795ae07f709aa1201

SHA1
69c93887d9319da3038092e85933d1f600a16873

SHA256
387fabe056d481733ddd01b8657754ad7bc763a7e2c2b78ec409bc33a20c5795

SHA512
e9dc3ede0a322982eaf3972bf2f7d44bb8bcc0fbd52ca67c6576cd112ac8c2007b710bac3e12d9af5b1bf4a7dcb3d60eb4fffd7992bb6fb18ee4e69f3be0cee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5daba054cdcae721c17595b54206d5b4

SHA1
6c0fb4c241eea158de61ae4ca39a041c1d354a64

SHA256
2699a985bb24868ac1d0377605a23f54b9e8893d6bc16a0de4441b203a041eaf

SHA512
e980b2d26a25b98556affce2b49e7c9062d1cab19feaefbfc8154b4ace5d90068ac60a78ed40d3bc2993e981f13ef57247206d45b29cb2318219c0eff5875474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4499736df5bf35b118e74a51dfd71fe

SHA1
606b34d3588790bcf39fe29c850e7585c25b7852

SHA256
edf27cad77024087d492f0897c9e7f06f6cce21b50a52169377086ef7cdee6bf

SHA512
b4a58f474146413d9fabfeb1e4c03aead2491d217962bebc4c454fe3f7711e963e88b6ee5260f0c34dc4c2329de56777ce7bbb0db9a5c5f80c629d43cfd5ee41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
086fc3b4f700f4576cce9c717f807e6a

SHA1
8d8fb9d644a717526b06908fc0e99ca552caf5c3

SHA256
e42b4159037cf70b40c1f766c278ee4c381c91c0fa84cbc2903e302b1d8ebc19

SHA512
8900ac912ff9b78e656e477e71fecf268bb6f9949424c93b676c0bafff772eb82429c0426d0ff55865e920880e69f3e46ee7f6fc4648c11160afcf5252e2ea14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5e93b3d21ad2496a4e0393031b0bbf1

SHA1
ed868e52bd61f829f4ef7316ff69d8936708bb8e

SHA256
e71328cd725b2f64f08513d0c49ff599de2cf359c49795ee367a4b46b0e522cb

SHA512
bfa29a213239e98a6b329abb0881bd8ab177c5c0d3925f2f90e486fae0af7a1bbe36144d1b4a37cc9397810cd764c5d709a77032e680eb405f7baa53f40b4e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD185.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2C4.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit