605c3ac707b1dbf77a07bcff1f383fdad11451f8ca7241c15d4179bb841dbbf0

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8552e9d374201c0dcc55f369eb67247.html
Size

82KB
MD5

c8552e9d374201c0dcc55f369eb67247
SHA1

a682e14d8d213f7f5243bbb6b188ea7ae25293b2
SHA256

605c3ac707b1dbf77a07bcff1f383fdad11451f8ca7241c15d4179bb841dbbf0
SHA512

d547ac2e2b8a5f46d14a6bcb8d6140e5daec31c1e88533c9d796d1795f76d6ddecb64ec6c39d636a23a6cf1d3dc53191fc2418fca24b3bc7afbb312039d4c28b
SSDEEP

1536:/InNpBWRW1p/o9v8zAxWzXxfUHCiImcwlpt2U6gopyetHsKqCOt4TykB9rbdQiR9:QnNpBWRV8cxSXLmcwlpt2U6gopyetL/F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008ef375d22437629a71d48e5475d6cc26862a74db54e5aa4953af6c9a1ac8ccb7000000000e80000000020000200000006373183a4879c8f8d7e770565b61edb929255a23e95d6ba22e7466ca20b14d1390000000d6c283e169812c33126d3acb022b808d1a0861a35dbf3fd921345f15855c418b462e3180fe395c58d9dc7b0ddfac38ae59908974ee89e7c5c5fa983a2423d621fb7ddce91c9f9e7959e7d1bd13e63902b91ac3bad434d3c6b8b54a9665dab0e8c646f75bb5c24bb0b5076b4a09ed353dd94cef6f3e93f41b2303fe511fe6f57fb5fd65ce1b0040aef8540e583fe7cb8b40000000facb8aed9c7d212db31a2f98de627f1f8422ebc1d99fa1e577131b06f56c30c9541c77790c038b9b290cfcc6d041881d519190a46406ad4f12f185f2cf027151	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416572010"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050BE801-E1E9-11EE-9ED8-52FE85537310} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ec111152dd1924fd123ddf8bd3e5267119d863bb5a8adad3cd4b07de2ebcc25d000000000e8000000002000020000000d2d307c0cbe046cef60fb7360dc2266b46b6e6f1ce46a217f087080582716cc82000000096e8d3292ddfa48e0709f6c8d2251df45f4656fa06fe800fa0cd351f7e5dd401400000009fcee54cd574b040f25a83bf05ea44eb4fdf473305bf28cc4348935df7502fde2c12935604b8f661a06ed803001ec173bdfa8a99e1b8df0ca274c5c6520efff7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a658def575da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2508	3028	iexplore.exe	28
PID 3028 wrote to memory of 2508	3028	iexplore.exe	28
PID 3028 wrote to memory of 2508	3028	iexplore.exe	28
PID 3028 wrote to memory of 2508	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8552e9d374201c0dcc55f369eb67247.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29596c18de6c8b6de928d713c03ce7c4

SHA1
621f32921ca68edce61a453f76c9f1b37c768bd1

SHA256
a66bcf782052e6e6a0e473ce346c2a9e55e5f60fdee781d14349a8c30828f25c

SHA512
5b9e66c400fd28e128728c4c3fe43410f42d46af2fc5fdd6b56deec8e5b322324c896aaa761bf78dd32be8710582cfdc032dac1bb84e6bf50ff10bd567f7f26a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8daa2efa6bfc133c8dfd5e917b9d29c8

SHA1
927a35eb325556a941a989137fa5f1963f425378

SHA256
606863a6aabd3b079661ed6df67679b783658addaa9cc6701ce34a6b950b354a

SHA512
40fc020365d7b5d4cdaccddb13e27be44331eda11503ed3838581101bd0de358c44a09a5fa4109b9edbcf3e317148bf9ac36d707755f4173e62495f94af6e386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed40906bdfaaf5c622a81a165431ff8c

SHA1
d5c4df9cc6dac8a2d744dc945442cf29d5ce2331

SHA256
437fa2e3d2e8d01a8c6103dd3dfe1a513dd6d2dd6d69e647e24bcb4acb95e7c6

SHA512
c632e1df8f7862198fa52d94cb436d349dfb46b3b209c711bfd60c0fd928dac6e7cc1c31bfab3255dfd09d69354a7163a129b9e61ff57093efd0ab12a7ef7e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a20d6140be8fc1aac8ce940fc57db0b

SHA1
2f8bcc6dee90396f768925fea16c6f236d3d7d6b

SHA256
5a0571b77e85ae35cec8689ff85827dda339964e736c9c7ed5a4e0ac85d2f6ce

SHA512
2a777c8d1e73c37857df220d27e086ccecf4779a80f3f01f07b7a0c0aa90f00de688dbf4e371ebb3d5b9ef04d526cd35b049481502e26022b9aa668eefe19cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b9e0802339359bd878bd8ef2faf2b3

SHA1
225ba34dc343b7ee7c6b96b3f796430d24c7d435

SHA256
d3853da2ec1b808e9ee35a89d0dcf2cf13b76f622808ff16087122551db13240

SHA512
7f9d5773997263531594a845ccdfa37060edf55a5b0568306e6f054173979a29d154e51359e9b0f7003bc54cd42d00668ae548e8aec20c096c2286d9724a03fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb70899a2cd6e9a5c19a11f648f8fb34

SHA1
c14ec8a2754630071da76d335ab22a4eca613ba1

SHA256
193dfb769a0dd58ab60fa98ff8c6b4677b6087b0627cbbf294f714c3461f6efa

SHA512
de5a2726a1d6ed33ee672213dd5c2fde8b50160adcb34c3bb0b635535c394218a64cc52772c3b9d8b637e4df728df8f0d715c03a1707bf1ac97223c07b0e5725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45310409dd208e9bf7aee3492f89608

SHA1
99ad442dedf0721508b27a0a5852394e56d61439

SHA256
71b104be79eecbdee9a6363558fa28e542f5cc9614228a79628594e66deedd22

SHA512
3e21a7f292945cbc2684553b9a6f27f735d466bf394f6e6f92e009abfb94ed745c76108abf1a27908f3d5fa008d856d67a011ecb53db8165043680af42012289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c384569efebdd43a4f149178c73adcf

SHA1
926edbbb52ecef79e52935b62355509566791996

SHA256
8d3341131c226e1d23d124b3541a4ef63d2fd88fb9dfd09b6d530454df107e9e

SHA512
fc0a5d3e370822763816844afd2c5cc6fceaead9acfad73deefde673f3fa3e2e82325241fe23a0ad87c4d979e193c648be538d0d96c18a9aaa2a0a94b6a0fda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7113661e58ddf85cae44fad65547fa5

SHA1
b8b4d9c1a80d497dbe99ea3b66f450a21a7fa648

SHA256
4e6f55cef2831b0bde31bc53cbc2b238f5c8f77b20b8b52023edc2ad74d51635

SHA512
bb673aeaa4faec0a8dcc855f875810b10305bc0f75892eb3b20be15ca93d1052d0574a8b001b0acdba1577ef26ab0eafcf41a050362b1b28b3864c9eb0b243ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7295f2632f3cb444ad866e87729f33

SHA1
b6b1f492034da878019127b7a1f6b2f828eb5183

SHA256
b71b9b6c2a4a4673684bb66ea2ac66e8ee986846d3c84dde7ca210a9d1e3d7f1

SHA512
90907f9cb59aa3c0abbf0bb90a47ea382d166656ce5263e7cb5346c6f4c3e5f06d143de4b18c60fb6d797cdacd4d9b484ebd7ff59c573d143c98a24bccefd5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CA2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E4A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FB7.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit