ac361aa2c3e44cbcbb5330f9ca0b91e410d7aced4380b66f23617d835fd57cde

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c83052ad1d462f9976424d5d3999e112.html
Size

2KB
MD5

c83052ad1d462f9976424d5d3999e112
SHA1

21294b9c7c3a54bb35c71002a32361f627fadd7d
SHA256

ac361aa2c3e44cbcbb5330f9ca0b91e410d7aced4380b66f23617d835fd57cde
SHA512

794a5896831984bfb4e514b45d79a4010359e41d6066a2768bcd0b37dd6f5f44bdae74ebfb8730459dfddbe09acbac838e5c50d13bd81c12cef947b1a9964285

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0727ac2eb75da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416567680"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd0000000002000000000010660000000100002000000012691afa278bc84974531332637b614b411484229587b050d85afe29d535c7c0000000000e8000000002000020000000e762801d52b9f0ee63eefc23c3669a21841d6c672b42b7052cdd9fb2707741b820000000fd6021629c17a282e16065221c3434a6f95037af24ffff0438971f67c3137cae400000004bff07e9e05bc9697fa5691807a386c83ceb69a9bbd3d612ab64b6d88975cbb9ce05f34b28d2f8fba8f85113cb47494d6aaadbb5b17e0c9db02f9ff04b98e53f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000a5e342baefeb0530c8aeb8a20941e27d3cacf75aceb9459b246634dba9b1bd23000000000e80000000020000200000003ca6482845ac1b7f6b48e9e81a2f342f9bae8a101ac9209b700a694f24a500719000000071e0a549d60a02e9ef3c1c5679140e5c87f378fc69fc3587e44e757d76013b9842d02059d4833d513aa4b939f3aacb8d3c0bd6031180e40e47a6664f006e4bf4c96a6e716e933eead4f04610b0cec48bddf3d4ff4af34568060aea45d65df1b21a3cf0bd6932616602717b46a98c5d14de1bdd79de619e7804b4c40a9f4a33d44cc69ef91195a8ba7dd275dce373bf8e4000000016b075d1c35aa680456b3e456ae6791aea6ee3767e5231e1e275a319006f6866adec71dcb6fcfbee43f5b74612ee00ecf5e645597608bf9f61d5f495ed3ec1fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED8A6F31-E1DE-11EE-8DA9-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2676	1924	iexplore.exe	28
PID 1924 wrote to memory of 2676	1924	iexplore.exe	28
PID 1924 wrote to memory of 2676	1924	iexplore.exe	28
PID 1924 wrote to memory of 2676	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c83052ad1d462f9976424d5d3999e112.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9ef046da3b90da9090ba29ea3ba8d3d

SHA1
55e2765b50af7cc07b3f086c37d3c2726f2df19b

SHA256
a7227b890c66cb47d57db104eec8ebf978df98499ab9e2825c137414fa6018d9

SHA512
d1e1839d70546fa86a1875968b2c1662f20f56e62d956d05223b43fddb53d214383e80c38c3146dadf7c6895d0e085e030f235014f3664642639b88a97af4413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acc4fa7b2de6d168a16bcad08f010df4

SHA1
c2190a6e65b92336b765a2aba4d2ffe576642ea0

SHA256
15c0fc073e08bda134d3bfa4a74679a44bfba9ccd66c79252ce7d0a7f008ddbe

SHA512
7bfb828fa30da2b1aab467b47b02a1366fb4ead0457eff7cb543cb8b9ce05d1f49884de1d68a4fc8e5ea430355e3ff893fd95c7061679a9ef8448bb0f1d1c201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46fe6121819a854363dd90ec14adbe24

SHA1
4ffdc6bb60bca54497413cc1639e5b9d3e0da4a5

SHA256
823cf1b164c2cf8dc2d9a12eea1230ed71bd90d3d26a958676a65f267ed45f9b

SHA512
b4161cb6d1b41130778eef2481bfa0244ff7bc5c9350122610526e9460615de6ead8dcf5de5b9f00039f68c97505653497f0477683121d775346008d51aa01f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
114e4482af5ad9d5eca44d438cf4f8c3

SHA1
a545c66c6d3d6ebc6961a3e3a50e0e6a201f19fd

SHA256
dc7347f38419749e2ca34b090fbd6f6f54c50113302e38a49215d13f605880d4

SHA512
0baea46cd87065211dde9d19cb6245342aa01533ce14dd47f4afbe750b52cc38124c0d0db5430e205fb811fc66c3af0a2ab4148e19e1e08b3f545ccd68c9edf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c567118b22d9055ed59f928fee58d2

SHA1
f62a702e7b5f3e11be7cd27a50e6505d1b54935b

SHA256
0ed72de86fb33bdd05b45b4d0c42e5b5d562eb9d775e49756f11f2148b09bd57

SHA512
4b4b312a67af595230a06ac93843800881975d55e041d68e13d774455f12dd8201262c070ec44fbb599105457ad5c442298adfdddc23c3c38bee0649aa474701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b241282ff8046cf950eab08eb2df67

SHA1
fa005e26da860ba17cc990ccdfcdacdd4541db11

SHA256
625c874120e609e06acb20345b4bc6b6d26e8335f89eb7eead58e309b1979f13

SHA512
3078a5f2ddb985b3ebb6508a52f715a1e43bcf17f07a8aee1040aeb7b90efd583b0cc643bc383774a4abd079bb901691d4734aed13a3c8d11b2529f469f37855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d79fa09ac2c0a963223a7ca37a5509a

SHA1
5a97ed56df67b356384b1cfaaff2af386807a26c

SHA256
71c3ace140f54500225d11430b54aa893d5ba5bae568a5975295208a4c81053e

SHA512
becc9779f2056a81580380a55c902d77e39e403e622430e21f6cf3c733638f555179b96e5201be61734b41f4200ede771edb8b2f8f49eaca53d59930f70ab9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cec3e7ec8f122156f7fd0a573c118934

SHA1
107cf77780381bcf81ef6e9616b3332890aff325

SHA256
9c2321b456297866df0e1674ca831c8c005e86845e6cce3de3cfa9d01126f23b

SHA512
105c5c4d90ead9129ecdc37323d978f2841f3a376bf43f166de39727674e18ac444238ab7e48e10707a2fa643930e26c1df2b191b705962c8261e7bd297bbf8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
105fe0a75e5781c2d392604ce8493e18

SHA1
47b38541eeeebfa0bb384e4feda334e652fefb6b

SHA256
5a28d6f3f5bcb1e78d47ed74c7e4c1f2fa0c2cf8a8f3d1df4a1af9834df50f3f

SHA512
f32a8e9d5591306d6a766783243465ae3989cd72b91a27c1c8be35cfce05ab43d55e492ffd5478e018cec897f99568ae877263567779fb0c666b06f97c0f0ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18f68df5e65409b7b0c604d69ba54851

SHA1
84731aa7167b005de6007858892f8bc34aa7633d

SHA256
6a883be3e5ceff93b36b22abd8c6b8aaad2318d454edbe7dbd06df9cac036817

SHA512
3c5d7437e48704b44ce1800eae8e611beba033c84e60993a7a6b9eb1864cf6bc9f908681de34248043c4307d4c2d6c1abbf65111870c15a8f6b558b6edbfcf24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1df3afaa1ba39c7d6afbd951f2ba36e7

SHA1
ec1a5e465b3367a20e7e7685485b8ab4ac78f116

SHA256
51de1e83cc6c5491be9313370f8a98d16c3d97e91c59bd22bb8363beba1b57c6

SHA512
e07e5610bd6394f5fc506d6a5aa71d6ef00e5edcabc31a2783a4ec50dfec9b07651217fabd1f8f1fc93990b13baa5b1b8f7083b6ee87b071059ba408893edca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0219f32c66e008f9ff5e089fd2e2b045

SHA1
c4ec8086c3178014ff1003885b884b2ebf970e05

SHA256
c36fad72871507eab70ea77aca43af369834cca588ff5166bb937884530ceeac

SHA512
f888bd1bdd34d3339a839955c00ecfad05150afc96ff259bb4062df04542b74a51dd59258dcd311fa4108908767d566c8ee423211bfeec49a3badccf002d9c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d598d882ab654a0fc11991cbee04f98

SHA1
2e5a6c2feb682dd10b00d863136a00a1c9ffc2f9

SHA256
3447cbb99c2b715135a7649f221ad074d0eb3e7c8f8acca6c1565b45431401b2

SHA512
9afea0b6e665d3b60cecadb37f3a374c3000c85c82a41f7fd3c2d196a0af0985be32872e22148ab25d772e48de47882fc88b96cc32dd25558dc86ac823e65314

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8182.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87A1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit