f208d4654161f2198f00c25755378bd0b235c57b74825d01440a3ce9ad2aa9ec

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c83ef2226456047feddc02b37f691054.html
Size

12KB
MD5

c83ef2226456047feddc02b37f691054
SHA1

4ab9e7c31f04a3c8ddd0f85b2f7908dd82565b2a
SHA256

f208d4654161f2198f00c25755378bd0b235c57b74825d01440a3ce9ad2aa9ec
SHA512

a7b772f1b9972a8c34a3ac077ca20e2cf4456737240b1eaf73d70fc41fea6900a6b9b11dd39c932051de5c141a79a623a40d797c8f02da5713177b3ec80284a4
SSDEEP

192:jYakOThrfyCsLkSZfjLIWbsVXLbGheMGQjnUhpn2ibAqXrotLU1H82gR79Fav:jGEOLkSZfK1SvGGUH2iEqQUV8c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000fdf5ef1e8a670cfd23a15af01860390d74555a569821f2c47935000b905ba79b000000000e8000000002000020000000db72b5c9427c5f2c064e296254f369b5c0921604b9a1cc742700ee86ce9ea485900000006d023fedc88fa94d855d60a8c77e84d32f73def6fda21b28c0136f1eb128bd5a1ef49ad7785bebe12b0bd2186289d82f76241730d5e86d34098af2e78164068ffee42c2ea7417b2592b78002438abde1608c1284e582bc8a7e6c553d440d0ad9f5ffbfaaf02bdf034c15d850b08114032ac015beac78c4c278cf543e5031ce23ab0d6a1161266dfd68f92127beb0640740000000366a9407d2e59036c4f4e00292e4debe0cafb8a7b98726e8f527e2c361a5bf54dbb2da6a56c3f56ecf9b0bcb4f80a1b9465cee62055bffbc599de79f03ed21de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F98F03F1-E1E2-11EE-9E49-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416569419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40256adfef75da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000006a34911bfc8cf5f8ca8a07dd90b261c28599857f7ef1f606db894ceef50213d0000000000e8000000002000020000000d0d921106638a80701b7a01f6ce4ff6fe0ba744d4d20829d2a624eabfa3a522720000000ae0521dc79d9f6b5e4f54216d34e510338cf94d176d5f6637462f01c121c8e1c40000000a3ab7410b0ba44a81982b73952e5fc36321a28996554bc524bd421756e639ee7c6357fd1a78fb497591fded0cdd544a8060dd4aa53105307a860c2279be7e29c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2536	3032	iexplore.exe	28
PID 3032 wrote to memory of 2536	3032	iexplore.exe	28
PID 3032 wrote to memory of 2536	3032	iexplore.exe	28
PID 3032 wrote to memory of 2536	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c83ef2226456047feddc02b37f691054.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f523063f04971a1533215116ce3bf6b

SHA1
5e3b8684e5e2f6ad33ef391aa7192e0aa8c462c5

SHA256
8daf5dcf30c3e468947dfe9c5accf3967dfdfb51fb9ff7ef6d5d7fb5fd649a4d

SHA512
56ee1f98fc8006c43a3229bb1b091bf0ba3d242523bdcf3444f7b7a6cff33305a122f68f78ef6ccb873e5b8aaf72b8877cfb51f724e46cd7094e9bb029f68e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b50a25eb6174e0b35f82efc87e46161

SHA1
19e672bbd783ef3d95bcaafcad07ed62ddd70887

SHA256
364f980d42d302561914d49c75b879292c0a6b7f0540e67db672f0de9f70dfb9

SHA512
9e7fc21bc022423b80236bfb85696960912a5f11b2d172f354a526160a407e564ce14e45d8e8e0d922dc573b217fafe56f51bea1a29cb14e5d09e28eb5bc6ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbe03491505af836ac97bdb6e7fda0d

SHA1
ae523e4cc1aadada996a0358659583c0fd20226d

SHA256
f73804b57fe8d39f8a05dd5fd0122ad205d33a8272ef200896376a6a5b4a0b48

SHA512
e10854cfc2b2fa103583a19ab4be65b9a99779ca1b77c803be9b3926fa4e19da15d1f4238362a4bfbbd239caa2aa30f7ed61b8d18601052d2ac8b5ade872d2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d437fe9c4114918b7bbdcf187cbeb4

SHA1
0cd4dbac65bde0a1cc85bea404badd87a7dac653

SHA256
caca683eb00c10ca3f42bd93a85f81f73313fdfe333e50e96e346d072dc5f986

SHA512
3444bbfeaeaebcda581ebb3b5db8b6ef2c560d42586fe25f3f01cb6fd7060b59cf48b711f4d50eae72519f03b99f8bf0eec0c86d300fd69a6420a9eeb198a56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0f30993fb16b3b88a16b9eafe6f371

SHA1
6f3f03964d5d28fc91d5912e0fe0a4004236893c

SHA256
8504d7dd08c828299c7d83e883ecfa84cd8b8707b7ed7589ab8d8ee3e131e819

SHA512
d482991ca47a920a7d9fcb1899832f70fe61ab40c0d12ebde46b3f3e485e363318db94d5ffab356dd1a4399410534489cadc23d16902a46d62aa56580bad8d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd48f452578b51bbded9b303c63e68a7

SHA1
6e67b32f31b5ebd0eb0b31bae9945af1cb0c1da0

SHA256
16879e5bd75188e973efc76f6b2115a968d959f69759397688a52772d0c61ae7

SHA512
4d00c467d195f63131dcb586f480341a37d28922c819c4f385cd928500db1a6a65720fe1622fb39dba80abcfd977718548fdd87964e46c7d2086f1415b2f4655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1ccab78dc0f0009a39245f44a0d672

SHA1
aa6038ddbae0addd1f94b3902fd02e25eb91ae54

SHA256
13febb8b3e77a10cb722d74ae76f895ad4d2da2ab15df2ba842337ffeadd7691

SHA512
17c91753dd64e1b8c557fbef33087d21045c6fb886f7462a81bb3636441ba19e8accd5d230fa5850a41999412d109aa74ce4151cbe612f73fc7896c5cf671896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
975336a7ac68c4dc2ebcb8276db94bb3

SHA1
c3ad9b70f1321b14d34399093d302e52079adce7

SHA256
0d16980665983b964c597ee9a02001fa7c4d7134e378bd3c79140fdd3b4d90a9

SHA512
4e6f34e7081b8628837c1210a4c11e672f77fa3f0136415a1874e673152b5843d8a4c36577dd12512195b7f06ce027271198f327fe6ce4640ca70954e870d59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f87e72512200932a331ca28e6b6039b9

SHA1
cf8ad15d9c00b07fcc9b6bff863d41535346d7e4

SHA256
e4a0ee905d8456da7d03523e0c9a7566ac8ecd49a2482cfaf7896d8c9470312d

SHA512
67306be25bb8bb1b3b63406a321a2f01f9ee148986248475dd8ff5be7e04c5070704fa808461ff8ffcd11dfd2c2072e4c8f9b312376d19eb736a8d9cfa66709d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83bed9b6b43c21434e7c740b80c1227f

SHA1
caffca5cf52df16be9fe97519956d07dfec1b43f

SHA256
7a87d4be57c0e4d78a1b54785eacaadabcd8f00d72b5c7efd3224a1976b8a12c

SHA512
154d99434a45870059b8ae0c2e11471f3d25187150b2384a22d7f270652d8243df837bb75c88f85086b3ec0e1fcc7b5b2cb337e5cbc410b46393b2cdf71ae548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7118a0ef22611ae75b84ff127679d79

SHA1
cf6f8fe411e9500d1e7d7b6d8d5b2c2865f13b7e

SHA256
a8e1b08016272d9b860ed13762ffbd6dbc150b271f80c833509ceac9461fda6a

SHA512
0b424c82382acc379e104431bcbec4d275d54b5fa334d9eb27b18d91ba19ce1c1b2b7183f1d4e39da681e18ff806c8fdd8d962b5de0765acfaa37fb0badff71f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8698ddf62c10e98cf5275216c0e9f0f0

SHA1
81307eebf6dac246e8087fedeab89d0a529132b8

SHA256
4f8802159723e5fc1a42f0f4cebe5d416982371874dc27385442b5d3d85da942

SHA512
732c565aa47d5249eacbffc9a5dfa67e6fe37d5be484568af8188faf5a3e19a0f14faee82a7feefc4fa5a66c26f91e51d919fc802dc321a1bccc2809858cf2d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f8408450f8e5113c2894e5f1c16d12

SHA1
65ec8092c9daa3303ec1cb179d39905f0044cd52

SHA256
bf763f84468f34c96370b94be0c4a764dd42dcc47b29ad4c6889a74852c7c84d

SHA512
b332965d3c7a0a085ad14d30e2d4c829c13ecc95d5d919707daebd94ab33ffd7e3e180ebf9bb121e80940c7aef439c960ffc3087f53437a2877a9842bd830991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96f8152f1d7d02511d2ed261a0f3ae6

SHA1
d9773047950dac98cee0d87059be12902ffd2e68

SHA256
30682de2e514ce72ed462543bd4ea9e87a8559bc0f6e4571dbfb7d2332c3d97e

SHA512
09d33b8675664dc78c36e7abb95378dc75fee276c1e911e7d81f28ce637f5ab2fcf9171d7ce0a84d0f47ac7188b0fc26ce28d3c55cd14388391cfedf786d5b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aa155ddbfbc6e815c34b2ca2af2af95

SHA1
ef0dfccc6cffc9952080ca8795a5f04376c18409

SHA256
b874e0159777fb7fc2a0176722d56c5687c9e285e75dbcae68ad6020941f37dd

SHA512
454d5c58fb3ab60aaea04da89f0c274d7e1552ad91489d86103ae1090cb762adaa5228502f514502743b0d3bc33eeba643cef52de5c20b25f417c8faf56978ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf78c597b4989999c8e3bcbcba1ba5b0

SHA1
1ab7bf9f89c3ea8aedf1f4e87655ef7aa1ebc322

SHA256
24afa3971bb10af8141eedfb23d439faf36ae7854802e155810ba435eb1912c5

SHA512
214baef76a1d35baff9928511054911ec9cb889d9e47d024e74ec6888e11cd1f440fa91f31d89d90da784e7d54a43c11b707ab6b72fbf4f474f772c6a6fc70ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9064.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit