ee04c43100a4d61ebd803a983d0df77c5ff6f23cffe21f777a932f53ac42e935

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c85b855f0c5e15c788c70fc28118a618.html
Size

5KB
MD5

c85b855f0c5e15c788c70fc28118a618
SHA1

9b73de3a482049e0264e7c8bf56760f14ca1283a
SHA256

ee04c43100a4d61ebd803a983d0df77c5ff6f23cffe21f777a932f53ac42e935
SHA512

cd23f36358bb1aae25340743eb5fa0ec2f7293214a716d29a567387930a3043e803c168bb0f93b5dbe6bc71560b3ad0a1c824f38e3cd7a6f16acedf3c300f483
SSDEEP

96:SIbKmCTiXMKiWiacAc6XHdrdChludgj7aTmxX1xdU1xD1xn1xq1xR1xjILaP8VgT:SITViZtAt0RJlUbPCJLfU5B7LG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0044308f875da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000079fc1a31d297c27a0f3fd4651b05361a8126cee963f168ed3b50a553b3d53928000000000e800000000200002000000054e87239253614ed0928ea76071fdfeabd4f91ffd4f99390fab9ba6a458b950290000000e57863a89c7037651f75f5ff2de8aef57572e8728a0aa671f0a3d2834e5024b1eea21b99e85ce8af2767e04b4b3cb4182f0c6c95fc6961b4b018603618af35010946c720bdb1023fde741add3c26168f6c303c99dc737c6c21fdac5ae807b3b1f111f234fed6ed2745b02f81e4c8c4ea57219b50a5358e0e35c971a4303313a9dae154244b9ebe08a7f6e8ee75236029400000000ab8d7334d24f6ea9d2500c7d2149472c5fdead616f00f839fcf4ec6efd9eed4dc66ff64f480e42bd4dcb1d9c9869d69f55762dd7680f0ba7728689f50293361	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E029771-E1EB-11EE-AEAA-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416572940"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000008d20657e76022576c15be0787ea9c13ba502de2405640aa5b76113e11eb226c5000000000e80000000020000200000009bcb8167d013d7683d0ed3b9386ca54bb5d6cbf2a3a650e201f4f95a4a35019a2000000090e90ed80efe0defbd1fbed435ec3237ed23f1927b8028ab08710c834fb024f940000000207ef2120e9d04206a12e9eaefe46089e747b42e237f286777103324d2e219e001f649d3115e8dece75b0831558d152578b446e7eb5cb38b01432e0570bcf86f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2808	2020	iexplore.exe	28
PID 2020 wrote to memory of 2808	2020	iexplore.exe	28
PID 2020 wrote to memory of 2808	2020	iexplore.exe	28
PID 2020 wrote to memory of 2808	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c85b855f0c5e15c788c70fc28118a618.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3ba2535ce04b996aaefc1a33d3541df

SHA1
edf07c7cfe053b7b6715304208839e94035d5406

SHA256
ed9fbcf3f0e5ef9647d75076af6fc6a4224e31b6a42eda0ffcf7a1bd5038eb43

SHA512
dd26586d6859c35fa7b66af6be16755ebc4d4576d13eff7f117fdce626568d3d2389030499095c4dca3c51d128138312d6670ccbe97fe1ab728f4853b8d2db93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
839915a69c4a1468ec37a69a8a416820

SHA1
6f0301b02ed5cb0d99ffcd074ff8e6654fbb580b

SHA256
b43c87f4d1b0e804a759f6c14c7c76648cfae8abc1a5d1ecf2fbcb869715275b

SHA512
c8a51ab8165e4ba6a3857b96c17c678e001f21d917f52df043f82f8265ac85799f86dd082309e842fdaff98222b94ec03756846776f1ec95d4ced14907e027be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ece702fe11f90a6d18fe79ab6b91e1

SHA1
1a8714b6da967de94bc217d233b3e869f3480aa6

SHA256
9e83d2cf0ce54fd4cb1fd1facc9010372eb35fc90d309f6fabbae51619a58d97

SHA512
2eff4329953a5fe5fafbcffe8083b17c3dded0905d9b3bf4b4caebb5e9aa7591ecf2377127aab31673c68fd86641c2e4d29966e31d0e0e9233a378d5a096be08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19493c8568227e5ef67514374fee57b7

SHA1
4250a0dfb1489729a16379db5cd98e5287a0e9f5

SHA256
da60c422f0c18be85578e3d81045d338f00d041a4d7a4cdce7678dfe770c52ca

SHA512
1954fa87b23a6cd0c04a084421cdea5b8f466d71a4a4a08890c62c4fc718dd9afea33038716b5ff5745915cb1229cd9cb52aec5f1d3cee2f7df263241c4767cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b74a422ddef086797f64cfed7898e6c2

SHA1
5ad66762409aa7bfb719b005021850b378d79830

SHA256
219d146f8d2429582ab30fb545d6b8ff99e88acd25db031b70c6feb4235db041

SHA512
e91fddbaee3ebc7adb9d2393663ffcadec54f480ba24a67dc7eac51498462b163caea87feb7fe4ea4f8e2798a91bc4856e76f1bedd896b7bfdcb78b2945b235d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20dd73cb4100cb56a3384b321fd04605

SHA1
855eca613c0e5ccfaa2f6f4256ed440e4007399c

SHA256
b270a4feefbf11fa595ff03f93c5795f883a8f37becd33d741442f960eb14ce1

SHA512
643f734c07f5ed85cf9d404dc54f7f8dccd73f27f22b6c9e552cf1a86e6781f3cbe75cadf18db18a9c0097b0ff48a6af9b903f8ee1eb6b0a778da3d3fa7dde26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca56be38a606757d3017b3f11372bc02

SHA1
ceaae28b0aea5b6dfe64302b263c15f2bea8d692

SHA256
7630c40fe30dda7b6adca35adb7863ad78fbcf1b9a48644515643a996b57eafe

SHA512
2ab58a1bf463a1525f794853d609bfc8f9456ad5926d9318e073f4264b09043a5cb3ecfe6ecd139fcbc1029889f45a0c669a54a852f0dde36a340a38bd8888e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a94220702cdcb3a07ebc6dbad58e3049

SHA1
1153747a16df408275b83df442eaae70f7f6c8d8

SHA256
894c53ff667d3271624925e72a80a88c97c1e933808de2981eb7d871fe67f473

SHA512
5f70f3616595c1e9fd52ca81c071e7fc8b6e71e0791dcfdae38de758e7ff0cb91181915b3d76592105d3b9a9d3ee7ca64191aae496ac0787bcbce4d9d6cbbdd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4714a94c8a8e5f16e7778af4c7f2e13

SHA1
0cf808cf7a79c86d8ebb96c634ab01e37da2ae38

SHA256
32d1e90df0020c548cbbc54c2899e2cd1c179486b94507474929c47f11f9fa25

SHA512
8c2bb0955975c87bb61d22f4e2f176383a394c807796f46a632770cf73b641b458c642b684d24e00e3eb677dfaa8b58396252259bb2a27bdf7144db3808c55f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf21dceba1228fc6084769b9ac5325a

SHA1
4bcab4897ca8a760f198d58745952f85ab70d11a

SHA256
dc669957e7261e159084fe79d274e3d2f07a8674d237e8b09238c254bd82bdab

SHA512
942220892bd411f0099abc656d8edac8b52a14e6ded44a586e520ba76e1ab04af9c82d60ccf202507aa87ab2bed719319fa4bc944cb8a0ad567ad7d0c430c5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344c65d41797226429e40a0a712674d3

SHA1
a6ac1d6bde72b83950b405756331e272148427f3

SHA256
5cd67b526d7d54e333bdfbf07e77c6c265abda18c2911d0e6468b06c94822df7

SHA512
0b390b1840a52412e49a53344ad7d9d79aebbe6a78694ce8af639ca84b032c5b42b3362a99765f3cb4236a45e0f54dcbe9aafb362c816e8cea110b386fb409cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a85e00ce370aca0a901797ff8ea899d

SHA1
9e804848b85c556b9de20d675edb3d1cb41dfbf8

SHA256
b0c0bf9604d96853425f4126771b47890a5c2cf32d857112d596644e61223ec6

SHA512
c3396b2c018e9bf2628a2a3090c905454f2bd5911254b90e18c0aa09f5b35d5db24d13255f220fb966c27b932e03c419a8cacdc9c531540d09f87417aa94c0b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d65c7d4c94554572d7c35889bb528db

SHA1
448adfc93ebda9f0160821562e6187ddd5b19989

SHA256
ca7d7a573b717cc666be4d7725af431d645cf669ff60a1da0d45eda3fdf0fc50

SHA512
6782c04c35de2ef46f2d31fe71f15da0c11b85fd5464a6d0bd51292c66829e85ef07f5df81bad9186c1cef2e40fe5fdab986adaa485643b701f2c69a6747d1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf763bb04ab4e5cee5243ffa43a46ccb

SHA1
a38072f19a22299f4fb341596d85d01563c8ad2e

SHA256
22490ed391c016ed5530ef291b2746d1be6560a92aaef9cc325823efbc354d48

SHA512
6756ed961db92806a8fb89070605121861452c184453365c2d28286cb2af7d610ac5996bd7abb9076542bb27e1b2bb661ac015ec353b7c4c0d49ee572e89cead

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab963A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97E6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit